1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 25 #ifndef _SYS_CRYPTO_IMPL_H 26 #define _SYS_CRYPTO_IMPL_H 27 28 /* 29 * Kernel Cryptographic Framework private implementation definitions. 30 */ 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 35 #ifdef _KERNEL 36 #include <sys/crypto/common.h> 37 #include <sys/crypto/api.h> 38 #include <sys/crypto/spi.h> 39 #include <sys/crypto/ioctl.h> 40 #include <sys/atomic.h> 41 #include <sys/project.h> 42 #include <sys/taskq.h> 43 #include <sys/rctl.h> 44 #include <sys/cpuvar.h> 45 #endif /* _KERNEL */ 46 47 #ifdef __cplusplus 48 extern "C" { 49 #endif 50 51 #ifdef _KERNEL 52 53 /* 54 * Prefixes convention: structures internal to the kernel cryptographic 55 * framework start with 'kcf_'. Exposed structure start with 'crypto_'. 56 */ 57 58 /* Provider stats. Not protected. */ 59 typedef struct kcf_prov_stats { 60 kstat_named_t ps_ops_total; 61 kstat_named_t ps_ops_passed; 62 kstat_named_t ps_ops_failed; 63 kstat_named_t ps_ops_busy_rval; 64 } kcf_prov_stats_t; 65 66 /* Various kcf stats. Not protected. */ 67 typedef struct kcf_stats { 68 kstat_named_t ks_thrs_in_pool; 69 kstat_named_t ks_idle_thrs; 70 kstat_named_t ks_minthrs; 71 kstat_named_t ks_maxthrs; 72 kstat_named_t ks_swq_njobs; 73 kstat_named_t ks_swq_maxjobs; 74 kstat_named_t ks_taskq_threads; 75 kstat_named_t ks_taskq_minalloc; 76 kstat_named_t ks_taskq_maxalloc; 77 } kcf_stats_t; 78 79 #define CPU_SEQID (CPU->cpu_seqid) 80 81 typedef struct kcf_lock_withpad { 82 kmutex_t kl_lock; 83 uint8_t kl_pad[64 - sizeof (kmutex_t)]; 84 } kcf_lock_withpad_t; 85 86 /* 87 * Per-CPU structure used by a provider to keep track of 88 * various counters. 89 */ 90 typedef struct kcf_prov_cpu { 91 kmutex_t kp_lock; 92 int kp_holdcnt; /* can go negative! */ 93 uint_t kp_jobcnt; 94 95 uint64_t kp_ndispatches; 96 uint64_t kp_nfails; 97 uint64_t kp_nbusy_rval; 98 kcondvar_t kp_cv; 99 100 uint8_t kp_pad[64 - sizeof (kmutex_t) - 2 * sizeof (int) - 101 3 * sizeof (uint64_t) - sizeof (kcondvar_t)]; 102 } kcf_prov_cpu_t; 103 104 /* 105 * kcf_get_refcnt(pd) is the number of inflight requests to the 106 * provider. So, it is a good measure of the load on a provider when 107 * it is not in a busy state. Once a provider notifies it is busy, requests 108 * backup in the taskq. So, we use tq_nalloc in that case which gives 109 * the number of task entries in the task queue. Note that we do not 110 * acquire any locks here as it is not critical to get the exact number 111 * and the lock contention is too costly for this code path. 112 */ 113 #define KCF_PROV_LOAD(pd) ((pd)->pd_state != KCF_PROV_BUSY ? \ 114 kcf_get_refcnt(pd, B_FALSE) : (pd)->pd_taskq->tq_nalloc) 115 116 117 /* 118 * The following two macros should be 119 * #define KCF_OPS_CLASSSIZE (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2) 120 * #define KCF_MAXMECHTAB KCF_MAXCIPHER 121 * 122 * However, doing that would involve reorganizing the header file a bit. 123 * When impl.h is broken up (bug# 4703218), this will be done. For now, 124 * we hardcode these values. 125 */ 126 #define KCF_OPS_CLASSSIZE 8 127 #define KCF_MAXMECHTAB 32 128 129 /* 130 * Valid values for the state of a provider. The order of 131 * the elements is important. 132 * 133 * Routines which get a provider or the list of providers 134 * should pick only those that are either in KCF_PROV_READY state 135 * or in KCF_PROV_BUSY state. 136 */ 137 typedef enum { 138 KCF_PROV_ALLOCATED = 1, 139 KCF_PROV_UNVERIFIED, 140 KCF_PROV_UNVERIFIED_FIPS140, 141 KCF_PROV_VERIFICATION_FAILED, 142 /* 143 * state < KCF_PROV_READY means the provider can not 144 * be used at all. 145 */ 146 KCF_PROV_READY, 147 KCF_PROV_BUSY, 148 /* 149 * state > KCF_PROV_BUSY means the provider can not 150 * be used for new requests. 151 */ 152 KCF_PROV_FAILED, 153 /* 154 * Threads setting the following two states should do so only 155 * if the current state < KCF_PROV_DISABLED. 156 */ 157 KCF_PROV_DISABLED, 158 KCF_PROV_UNREGISTERING, 159 KCF_PROV_UNREGISTERED 160 } kcf_prov_state_t; 161 162 #define KCF_IS_PROV_UNVERIFIED(pd) ((pd)->pd_state == KCF_PROV_UNVERIFIED) 163 #define KCF_IS_PROV_USABLE(pd) ((pd)->pd_state == KCF_PROV_READY || \ 164 (pd)->pd_state == KCF_PROV_BUSY) 165 #define KCF_IS_PROV_REMOVED(pd) ((pd)->pd_state >= KCF_PROV_UNREGISTERING) 166 167 /* Internal flags valid for pd_flags field */ 168 #define KCF_LPROV_MEMBER 0x80000000 /* is member of a logical provider */ 169 170 /* 171 * A provider descriptor structure. There is one such structure per 172 * provider. It is allocated and initialized at registration time and 173 * freed when the provider unregisters. 174 * 175 * pd_prov_type: Provider type, hardware or software 176 * pd_sid: Session ID of the provider used by kernel clients. 177 * This is valid only for session-oriented providers. 178 * pd_taskq: taskq used to dispatch crypto requests 179 * pd_nbins: number of bins in pd_percpu_bins 180 * pd_percpu_bins: Pointer to an array of per-CPU structures 181 * containing a lock, a cv and various counters. 182 * pd_lock: lock protects pd_state and pd_provider_list 183 * pd_state: State value of the provider 184 * pd_provider_list: Used to cross-reference logical providers and their 185 * members. Not used for software providers. 186 * pd_resume_cv: cv to wait for state to change from KCF_PROV_BUSY 187 * pd_prov_handle: Provider handle specified by provider 188 * pd_ops_vector: The ops vector specified by Provider 189 * pd_mech_indx: Lookup table which maps a core framework mechanism 190 * number to an index in pd_mechanisms array 191 * pd_mechanisms: Array of mechanisms supported by the provider, specified 192 * by the provider during registration 193 * pd_mech_list_count: The number of entries in pi_mechanisms, specified 194 * by the provider during registration 195 * pd_name: Device name or module name 196 * pd_instance: Device instance 197 * pd_module_id: Module ID returned by modload 198 * pd_mctlp: Pointer to modctl structure for this provider 199 * pd_description: Provider description string 200 * pd_flags: bitwise OR of pi_flags from crypto_provider_info_t 201 * and other internal flags defined above. 202 * pd_hash_limit: Maximum data size that hash mechanisms of this provider 203 * can support. 204 * pd_hmac_limit: Maximum data size that HMAC mechanisms of this provider 205 * can support. 206 * pd_kcf_prov_handle: KCF-private handle assigned by KCF 207 * pd_prov_id: Identification # assigned by KCF to provider 208 * pd_kstat: kstat associated with the provider 209 * pd_ks_data: kstat data 210 */ 211 typedef struct kcf_provider_desc { 212 crypto_provider_type_t pd_prov_type; 213 crypto_session_id_t pd_sid; 214 taskq_t *pd_taskq; 215 uint_t pd_nbins; 216 kcf_prov_cpu_t *pd_percpu_bins; 217 kmutex_t pd_lock; 218 kcf_prov_state_t pd_state; 219 struct kcf_provider_list *pd_provider_list; 220 kcondvar_t pd_resume_cv; 221 crypto_provider_handle_t pd_prov_handle; 222 crypto_ops_t *pd_ops_vector; 223 ushort_t pd_mech_indx[KCF_OPS_CLASSSIZE]\ 224 [KCF_MAXMECHTAB]; 225 crypto_mech_info_t *pd_mechanisms; 226 uint_t pd_mech_list_count; 227 char *pd_name; 228 uint_t pd_instance; 229 int pd_module_id; 230 struct modctl *pd_mctlp; 231 char *pd_description; 232 uint_t pd_flags; 233 uint_t pd_hash_limit; 234 uint_t pd_hmac_limit; 235 crypto_kcf_provider_handle_t pd_kcf_prov_handle; 236 crypto_provider_id_t pd_prov_id; 237 kstat_t *pd_kstat; 238 kcf_prov_stats_t pd_ks_data; 239 } kcf_provider_desc_t; 240 241 /* useful for making a list of providers */ 242 typedef struct kcf_provider_list { 243 struct kcf_provider_list *pl_next; 244 struct kcf_provider_desc *pl_provider; 245 } kcf_provider_list_t; 246 247 /* 248 * If a component has a reference to a kcf_provider_desc_t, 249 * it REFHOLD()s. A new provider descriptor which is referenced only 250 * by the providers table has a reference counter of one. 251 */ 252 #define KCF_PROV_REFHOLD(desc) { \ 253 kcf_prov_cpu_t *mp; \ 254 \ 255 mp = &((desc)->pd_percpu_bins[CPU_SEQID]); \ 256 mutex_enter(&mp->kp_lock); \ 257 mp->kp_holdcnt++; \ 258 mutex_exit(&mp->kp_lock); \ 259 } 260 261 #define KCF_PROV_REFRELE(desc) { \ 262 kcf_prov_cpu_t *mp; \ 263 \ 264 mp = &((desc)->pd_percpu_bins[CPU_SEQID]); \ 265 mutex_enter(&mp->kp_lock); \ 266 mp->kp_holdcnt--; \ 267 mutex_exit(&mp->kp_lock); \ 268 } 269 270 #define KCF_PROV_REFHELD(desc) (kcf_get_refcnt(desc, B_TRUE) >= 1) 271 272 /* 273 * The JOB macros are used only for a hardware provider. 274 * Hardware providers can have holds that stay forever. 275 * So, the job counter is used to check if it is safe to 276 * unregister a provider. 277 */ 278 #define KCF_PROV_JOB_HOLD(mp) { \ 279 mutex_enter(&(mp)->kp_lock); \ 280 (mp)->kp_jobcnt++; \ 281 mutex_exit(&(mp)->kp_lock); \ 282 } 283 284 #define KCF_PROV_JOB_RELE(mp) { \ 285 mutex_enter(&(mp)->kp_lock); \ 286 (mp)->kp_jobcnt--; \ 287 if ((mp)->kp_jobcnt == 0) \ 288 cv_signal(&(mp)->kp_cv); \ 289 mutex_exit(&(mp)->kp_lock); \ 290 } 291 292 #define KCF_PROV_JOB_RELE_STAT(mp, doincr) { \ 293 if (doincr) \ 294 (mp)->kp_nfails++; \ 295 KCF_PROV_JOB_RELE(mp); \ 296 } 297 298 #define KCF_PROV_INCRSTATS(pd, error) { \ 299 kcf_prov_cpu_t *mp; \ 300 \ 301 mp = &((pd)->pd_percpu_bins[CPU_SEQID]); \ 302 mp->kp_ndispatches++; \ 303 if ((error) == CRYPTO_BUSY) \ 304 mp->kp_nbusy_rval++; \ 305 else if ((error) != CRYPTO_SUCCESS && (error) != CRYPTO_QUEUED) \ 306 mp->kp_nfails++; \ 307 } 308 309 /* list of crypto_mech_info_t valid as the second mech in a dual operation */ 310 311 typedef struct crypto_mech_info_list { 312 struct crypto_mech_info_list *ml_next; 313 crypto_mech_type_t ml_kcf_mechid; /* KCF's id */ 314 crypto_mech_info_t ml_mech_info; 315 } crypto_mech_info_list_t; 316 317 /* 318 * An element in a mechanism provider descriptors chain. 319 * The kcf_prov_mech_desc_t is duplicated in every chain the provider belongs 320 * to. This is a small tradeoff memory vs mutex spinning time to access the 321 * common provider field. 322 */ 323 324 typedef struct kcf_prov_mech_desc { 325 struct kcf_mech_entry *pm_me; /* Back to the head */ 326 struct kcf_prov_mech_desc *pm_next; /* Next in the chain */ 327 crypto_mech_info_t pm_mech_info; /* Provider mech info */ 328 crypto_mech_info_list_t *pm_mi_list; /* list for duals */ 329 kcf_provider_desc_t *pm_prov_desc; /* Common desc. */ 330 } kcf_prov_mech_desc_t; 331 332 /* and the notation shortcuts ... */ 333 #define pm_provider_type pm_prov_desc.pd_provider_type 334 #define pm_provider_handle pm_prov_desc.pd_provider_handle 335 #define pm_ops_vector pm_prov_desc.pd_ops_vector 336 337 extern kcf_lock_withpad_t *me_mutexes; 338 339 #define KCF_CPU_PAD (128 - sizeof (crypto_mech_name_t) - \ 340 sizeof (crypto_mech_type_t) - \ 341 2 * sizeof (kcf_prov_mech_desc_t *) - \ 342 sizeof (int) - sizeof (uint32_t) - sizeof (size_t)) 343 344 /* 345 * A mechanism entry in an xxx_mech_tab[]. KCF_CPU_PAD needs 346 * to be adjusted if this structure is changed. 347 */ 348 typedef struct kcf_mech_entry { 349 crypto_mech_name_t me_name; /* mechanism name */ 350 crypto_mech_type_t me_mechid; /* Internal id for mechanism */ 351 kcf_prov_mech_desc_t *me_hw_prov_chain; /* list of HW providers */ 352 kcf_prov_mech_desc_t *me_sw_prov; /* SW provider */ 353 /* 354 * Number of HW providers in the chain. There is only one 355 * SW provider. So, we need only a count of HW providers. 356 */ 357 int me_num_hwprov; 358 /* 359 * When a SW provider is present, this is the generation number that 360 * ensures no objects from old SW providers are used in the new one 361 */ 362 uint32_t me_gen_swprov; 363 /* 364 * threshold for using hardware providers for this mech 365 */ 366 size_t me_threshold; 367 uint8_t me_pad[KCF_CPU_PAD]; 368 } kcf_mech_entry_t; 369 370 /* 371 * A policy descriptor structure. It is allocated and initialized 372 * when administrative ioctls load disabled mechanisms. 373 * 374 * pd_prov_type: Provider type, hardware or software 375 * pd_name: Device name or module name. 376 * pd_instance: Device instance. 377 * pd_refcnt: Reference counter for this policy descriptor 378 * pd_mutex: Protects array and count of disabled mechanisms. 379 * pd_disabled_count: Count of disabled mechanisms. 380 * pd_disabled_mechs: Array of disabled mechanisms. 381 */ 382 typedef struct kcf_policy_desc { 383 crypto_provider_type_t pd_prov_type; 384 char *pd_name; 385 uint_t pd_instance; 386 uint_t pd_refcnt; 387 kmutex_t pd_mutex; 388 uint_t pd_disabled_count; 389 crypto_mech_name_t *pd_disabled_mechs; 390 } kcf_policy_desc_t; 391 392 /* 393 * If a component has a reference to a kcf_policy_desc_t, 394 * it REFHOLD()s. A new policy descriptor which is referenced only 395 * by the policy table has a reference count of one. 396 */ 397 #define KCF_POLICY_REFHOLD(desc) { \ 398 atomic_inc_32(&(desc)->pd_refcnt); \ 399 ASSERT((desc)->pd_refcnt != 0); \ 400 } 401 402 /* 403 * Releases a reference to a policy descriptor. When the last 404 * reference is released, the descriptor is freed. 405 */ 406 #define KCF_POLICY_REFRELE(desc) { \ 407 ASSERT((desc)->pd_refcnt != 0); \ 408 membar_exit(); \ 409 if (atomic_dec_32_nv(&(desc)->pd_refcnt) == 0) \ 410 kcf_policy_free_desc(desc); \ 411 } 412 413 /* 414 * This entry stores the name of a software module and its 415 * mechanisms. The mechanisms are 'hints' that are used to 416 * trigger loading of the module. 417 */ 418 typedef struct kcf_soft_conf_entry { 419 struct kcf_soft_conf_entry *ce_next; 420 char *ce_name; 421 crypto_mech_name_t *ce_mechs; 422 uint_t ce_count; 423 } kcf_soft_conf_entry_t; 424 425 extern kmutex_t soft_config_mutex; 426 extern kcf_soft_conf_entry_t *soft_config_list; 427 428 /* 429 * Global tables. The sizes are from the predefined PKCS#11 v2.20 mechanisms, 430 * with a margin of few extra empty entry points 431 */ 432 433 #define KCF_MAXDIGEST 16 /* Digests */ 434 #define KCF_MAXCIPHER 64 /* Ciphers */ 435 #define KCF_MAXMAC 40 /* Message authentication codes */ 436 #define KCF_MAXSIGN 24 /* Sign/Verify */ 437 #define KCF_MAXKEYOPS 116 /* Key generation and derivation */ 438 #define KCF_MAXMISC 16 /* Others ... */ 439 440 #define KCF_MAXMECHS KCF_MAXDIGEST + KCF_MAXCIPHER + KCF_MAXMAC + \ 441 KCF_MAXSIGN + KCF_MAXKEYOPS + \ 442 KCF_MAXMISC 443 444 extern kcf_mech_entry_t kcf_digest_mechs_tab[]; 445 extern kcf_mech_entry_t kcf_cipher_mechs_tab[]; 446 extern kcf_mech_entry_t kcf_mac_mechs_tab[]; 447 extern kcf_mech_entry_t kcf_sign_mechs_tab[]; 448 extern kcf_mech_entry_t kcf_keyops_mechs_tab[]; 449 extern kcf_mech_entry_t kcf_misc_mechs_tab[]; 450 451 extern kmutex_t kcf_mech_tabs_lock; 452 453 typedef enum { 454 KCF_DIGEST_CLASS = 1, 455 KCF_CIPHER_CLASS, 456 KCF_MAC_CLASS, 457 KCF_SIGN_CLASS, 458 KCF_KEYOPS_CLASS, 459 KCF_MISC_CLASS 460 } kcf_ops_class_t; 461 462 #define KCF_FIRST_OPSCLASS KCF_DIGEST_CLASS 463 #define KCF_LAST_OPSCLASS KCF_MISC_CLASS 464 465 /* The table of all the kcf_xxx_mech_tab[]s, indexed by kcf_ops_class */ 466 467 typedef struct kcf_mech_entry_tab { 468 int met_size; /* Size of the met_tab[] */ 469 kcf_mech_entry_t *met_tab; /* the table */ 470 } kcf_mech_entry_tab_t; 471 472 extern kcf_mech_entry_tab_t kcf_mech_tabs_tab[]; 473 474 #define KCF_MECHID(class, index) \ 475 (((crypto_mech_type_t)(class) << 32) | (crypto_mech_type_t)(index)) 476 477 #define KCF_MECH2CLASS(mech_type) ((kcf_ops_class_t)((mech_type) >> 32)) 478 479 #define KCF_MECH2INDEX(mech_type) ((int)(mech_type)) 480 481 #define KCF_TO_PROV_MECH_INDX(pd, mech_type) \ 482 ((pd)->pd_mech_indx[KCF_MECH2CLASS(mech_type)] \ 483 [KCF_MECH2INDEX(mech_type)]) 484 485 #define KCF_TO_PROV_MECHINFO(pd, mech_type) \ 486 ((pd)->pd_mechanisms[KCF_TO_PROV_MECH_INDX(pd, mech_type)]) 487 488 #define KCF_TO_PROV_MECHNUM(pd, mech_type) \ 489 (KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_number) 490 491 #define KCF_CAN_SHARE_OPSTATE(pd, mech_type) \ 492 ((KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_flags) & \ 493 CRYPTO_CAN_SHARE_OPSTATE) 494 495 /* ps_refcnt is protected by cm_lock in the crypto_minor structure */ 496 typedef struct crypto_provider_session { 497 struct crypto_provider_session *ps_next; 498 crypto_session_id_t ps_session; 499 kcf_provider_desc_t *ps_provider; 500 kcf_provider_desc_t *ps_real_provider; 501 uint_t ps_refcnt; 502 } crypto_provider_session_t; 503 504 typedef struct crypto_session_data { 505 kmutex_t sd_lock; 506 kcondvar_t sd_cv; 507 uint32_t sd_flags; 508 int sd_pre_approved_amount; 509 crypto_ctx_t *sd_digest_ctx; 510 crypto_ctx_t *sd_encr_ctx; 511 crypto_ctx_t *sd_decr_ctx; 512 crypto_ctx_t *sd_mac_ctx; 513 crypto_ctx_t *sd_sign_ctx; 514 crypto_ctx_t *sd_verify_ctx; 515 crypto_ctx_t *sd_sign_recover_ctx; 516 crypto_ctx_t *sd_verify_recover_ctx; 517 kcf_provider_desc_t *sd_provider; 518 void *sd_find_init_cookie; 519 crypto_provider_session_t *sd_provider_session; 520 } crypto_session_data_t; 521 522 #define CRYPTO_SESSION_IN_USE 0x00000001 523 #define CRYPTO_SESSION_IS_BUSY 0x00000002 524 #define CRYPTO_SESSION_IS_CLOSED 0x00000004 525 526 #define KCF_MAX_PIN_LEN 1024 527 528 /* 529 * Per-minor info. 530 * 531 * cm_lock protects everything in this structure except for cm_refcnt. 532 */ 533 typedef struct crypto_minor { 534 uint_t cm_refcnt; 535 kmutex_t cm_lock; 536 kcondvar_t cm_cv; 537 crypto_session_data_t **cm_session_table; 538 uint_t cm_session_table_count; 539 kcf_provider_desc_t **cm_provider_array; 540 uint_t cm_provider_count; 541 crypto_provider_session_t *cm_provider_session; 542 } crypto_minor_t; 543 544 /* resource control framework handle used by /dev/crypto */ 545 extern rctl_hndl_t rc_project_crypto_mem; 546 /* 547 * Return codes for internal functions 548 */ 549 #define KCF_SUCCESS 0x0 /* Successful call */ 550 #define KCF_INVALID_MECH_NUMBER 0x1 /* invalid mechanism number */ 551 #define KCF_INVALID_MECH_NAME 0x2 /* invalid mechanism name */ 552 #define KCF_INVALID_MECH_CLASS 0x3 /* invalid mechanism class */ 553 #define KCF_MECH_TAB_FULL 0x4 /* Need more room in the mech tabs. */ 554 #define KCF_INVALID_INDX ((ushort_t)-1) 555 556 /* 557 * kCF internal mechanism and function group for tracking RNG providers. 558 */ 559 #define SUN_RANDOM "random" 560 #define CRYPTO_FG_RANDOM 0x80000000 /* generate_random() */ 561 562 /* 563 * Wrappers for ops vectors. In the wrapper definitions below, the pd 564 * argument always corresponds to a pointer to a provider descriptor 565 * of type kcf_prov_desc_t. 566 */ 567 568 #define KCF_PROV_CONTROL_OPS(pd) ((pd)->pd_ops_vector->co_control_ops) 569 #define KCF_PROV_CTX_OPS(pd) ((pd)->pd_ops_vector->co_ctx_ops) 570 #define KCF_PROV_DIGEST_OPS(pd) ((pd)->pd_ops_vector->co_digest_ops) 571 #define KCF_PROV_CIPHER_OPS(pd) ((pd)->pd_ops_vector->co_cipher_ops) 572 #define KCF_PROV_MAC_OPS(pd) ((pd)->pd_ops_vector->co_mac_ops) 573 #define KCF_PROV_SIGN_OPS(pd) ((pd)->pd_ops_vector->co_sign_ops) 574 #define KCF_PROV_VERIFY_OPS(pd) ((pd)->pd_ops_vector->co_verify_ops) 575 #define KCF_PROV_DUAL_OPS(pd) ((pd)->pd_ops_vector->co_dual_ops) 576 #define KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) \ 577 ((pd)->pd_ops_vector->co_dual_cipher_mac_ops) 578 #define KCF_PROV_RANDOM_OPS(pd) ((pd)->pd_ops_vector->co_random_ops) 579 #define KCF_PROV_SESSION_OPS(pd) ((pd)->pd_ops_vector->co_session_ops) 580 #define KCF_PROV_OBJECT_OPS(pd) ((pd)->pd_ops_vector->co_object_ops) 581 #define KCF_PROV_KEY_OPS(pd) ((pd)->pd_ops_vector->co_key_ops) 582 #define KCF_PROV_PROVIDER_OPS(pd) ((pd)->pd_ops_vector->co_provider_ops) 583 #define KCF_PROV_MECH_OPS(pd) ((pd)->pd_ops_vector->co_mech_ops) 584 #define KCF_PROV_NOSTORE_KEY_OPS(pd) \ 585 ((pd)->pd_ops_vector->co_nostore_key_ops) 586 #define KCF_PROV_FIPS140_OPS(pd) ((pd)->pd_ops_vector->co_fips140_ops) 587 #define KCF_PROV_PROVMGMT_OPS(pd) ((pd)->pd_ops_vector->co_provider_ops) 588 589 /* 590 * Wrappers for crypto_control_ops(9S) entry points. 591 */ 592 593 #define KCF_PROV_STATUS(pd, status) ( \ 594 (KCF_PROV_CONTROL_OPS(pd) && \ 595 KCF_PROV_CONTROL_OPS(pd)->provider_status) ? \ 596 KCF_PROV_CONTROL_OPS(pd)->provider_status( \ 597 (pd)->pd_prov_handle, status) : \ 598 CRYPTO_NOT_SUPPORTED) 599 600 /* 601 * Wrappers for crypto_ctx_ops(9S) entry points. 602 */ 603 604 #define KCF_PROV_CREATE_CTX_TEMPLATE(pd, mech, key, template, size, req) ( \ 605 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->create_ctx_template) ? \ 606 KCF_PROV_CTX_OPS(pd)->create_ctx_template( \ 607 (pd)->pd_prov_handle, mech, key, template, size, req) : \ 608 CRYPTO_NOT_SUPPORTED) 609 610 #define KCF_PROV_FREE_CONTEXT(pd, ctx) ( \ 611 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->free_context) ? \ 612 KCF_PROV_CTX_OPS(pd)->free_context(ctx) : CRYPTO_NOT_SUPPORTED) 613 614 #define KCF_PROV_COPYIN_MECH(pd, umech, kmech, errorp, mode) ( \ 615 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyin_mechanism) ? \ 616 KCF_PROV_MECH_OPS(pd)->copyin_mechanism( \ 617 (pd)->pd_prov_handle, umech, kmech, errorp, mode) : \ 618 CRYPTO_NOT_SUPPORTED) 619 620 #define KCF_PROV_COPYOUT_MECH(pd, kmech, umech, errorp, mode) ( \ 621 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyout_mechanism) ? \ 622 KCF_PROV_MECH_OPS(pd)->copyout_mechanism( \ 623 (pd)->pd_prov_handle, kmech, umech, errorp, mode) : \ 624 CRYPTO_NOT_SUPPORTED) 625 626 #define KCF_PROV_FREE_MECH(pd, prov_mech) ( \ 627 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->free_mechanism) ? \ 628 KCF_PROV_MECH_OPS(pd)->free_mechanism( \ 629 (pd)->pd_prov_handle, prov_mech) : CRYPTO_NOT_SUPPORTED) 630 631 /* 632 * Wrappers for crypto_digest_ops(9S) entry points. 633 */ 634 635 #define KCF_PROV_DIGEST_INIT(pd, ctx, mech, req) ( \ 636 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_init) ? \ 637 KCF_PROV_DIGEST_OPS(pd)->digest_init(ctx, mech, req) : \ 638 CRYPTO_NOT_SUPPORTED) 639 640 /* 641 * The _ (underscore) in _digest is needed to avoid replacing the 642 * function digest(). 643 */ 644 #define KCF_PROV_DIGEST(pd, ctx, data, _digest, req) ( \ 645 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest) ? \ 646 KCF_PROV_DIGEST_OPS(pd)->digest(ctx, data, _digest, req) : \ 647 CRYPTO_NOT_SUPPORTED) 648 649 #define KCF_PROV_DIGEST_UPDATE(pd, ctx, data, req) ( \ 650 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_update) ? \ 651 KCF_PROV_DIGEST_OPS(pd)->digest_update(ctx, data, req) : \ 652 CRYPTO_NOT_SUPPORTED) 653 654 #define KCF_PROV_DIGEST_KEY(pd, ctx, key, req) ( \ 655 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_key) ? \ 656 KCF_PROV_DIGEST_OPS(pd)->digest_key(ctx, key, req) : \ 657 CRYPTO_NOT_SUPPORTED) 658 659 #define KCF_PROV_DIGEST_FINAL(pd, ctx, digest, req) ( \ 660 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_final) ? \ 661 KCF_PROV_DIGEST_OPS(pd)->digest_final(ctx, digest, req) : \ 662 CRYPTO_NOT_SUPPORTED) 663 664 #define KCF_PROV_DIGEST_ATOMIC(pd, session, mech, data, digest, req) ( \ 665 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_atomic) ? \ 666 KCF_PROV_DIGEST_OPS(pd)->digest_atomic( \ 667 (pd)->pd_prov_handle, session, mech, data, digest, req) : \ 668 CRYPTO_NOT_SUPPORTED) 669 670 /* 671 * Wrappers for crypto_cipher_ops(9S) entry points. 672 */ 673 674 #define KCF_PROV_ENCRYPT_INIT(pd, ctx, mech, key, template, req) ( \ 675 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_init) ? \ 676 KCF_PROV_CIPHER_OPS(pd)->encrypt_init(ctx, mech, key, template, \ 677 req) : \ 678 CRYPTO_NOT_SUPPORTED) 679 680 #define KCF_PROV_ENCRYPT(pd, ctx, plaintext, ciphertext, req) ( \ 681 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt) ? \ 682 KCF_PROV_CIPHER_OPS(pd)->encrypt(ctx, plaintext, ciphertext, req) : \ 683 CRYPTO_NOT_SUPPORTED) 684 685 #define KCF_PROV_ENCRYPT_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \ 686 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_update) ? \ 687 KCF_PROV_CIPHER_OPS(pd)->encrypt_update(ctx, plaintext, \ 688 ciphertext, req) : \ 689 CRYPTO_NOT_SUPPORTED) 690 691 #define KCF_PROV_ENCRYPT_FINAL(pd, ctx, ciphertext, req) ( \ 692 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_final) ? \ 693 KCF_PROV_CIPHER_OPS(pd)->encrypt_final(ctx, ciphertext, req) : \ 694 CRYPTO_NOT_SUPPORTED) 695 696 #define KCF_PROV_ENCRYPT_ATOMIC(pd, session, mech, key, plaintext, ciphertext, \ 697 template, req) ( \ 698 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic) ? \ 699 KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic( \ 700 (pd)->pd_prov_handle, session, mech, key, plaintext, ciphertext, \ 701 template, req) : \ 702 CRYPTO_NOT_SUPPORTED) 703 704 #define KCF_PROV_DECRYPT_INIT(pd, ctx, mech, key, template, req) ( \ 705 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_init) ? \ 706 KCF_PROV_CIPHER_OPS(pd)->decrypt_init(ctx, mech, key, template, \ 707 req) : \ 708 CRYPTO_NOT_SUPPORTED) 709 710 #define KCF_PROV_DECRYPT(pd, ctx, ciphertext, plaintext, req) ( \ 711 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt) ? \ 712 KCF_PROV_CIPHER_OPS(pd)->decrypt(ctx, ciphertext, plaintext, req) : \ 713 CRYPTO_NOT_SUPPORTED) 714 715 #define KCF_PROV_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \ 716 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_update) ? \ 717 KCF_PROV_CIPHER_OPS(pd)->decrypt_update(ctx, ciphertext, \ 718 plaintext, req) : \ 719 CRYPTO_NOT_SUPPORTED) 720 721 #define KCF_PROV_DECRYPT_FINAL(pd, ctx, plaintext, req) ( \ 722 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_final) ? \ 723 KCF_PROV_CIPHER_OPS(pd)->decrypt_final(ctx, plaintext, req) : \ 724 CRYPTO_NOT_SUPPORTED) 725 726 #define KCF_PROV_DECRYPT_ATOMIC(pd, session, mech, key, ciphertext, plaintext, \ 727 template, req) ( \ 728 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic) ? \ 729 KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic( \ 730 (pd)->pd_prov_handle, session, mech, key, ciphertext, plaintext, \ 731 template, req) : \ 732 CRYPTO_NOT_SUPPORTED) 733 734 /* 735 * Wrappers for crypto_mac_ops(9S) entry points. 736 */ 737 738 #define KCF_PROV_MAC_INIT(pd, ctx, mech, key, template, req) ( \ 739 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_init) ? \ 740 KCF_PROV_MAC_OPS(pd)->mac_init(ctx, mech, key, template, req) \ 741 : CRYPTO_NOT_SUPPORTED) 742 743 /* 744 * The _ (underscore) in _mac is needed to avoid replacing the 745 * function mac(). 746 */ 747 #define KCF_PROV_MAC(pd, ctx, data, _mac, req) ( \ 748 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac) ? \ 749 KCF_PROV_MAC_OPS(pd)->mac(ctx, data, _mac, req) : \ 750 CRYPTO_NOT_SUPPORTED) 751 752 #define KCF_PROV_MAC_UPDATE(pd, ctx, data, req) ( \ 753 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_update) ? \ 754 KCF_PROV_MAC_OPS(pd)->mac_update(ctx, data, req) : \ 755 CRYPTO_NOT_SUPPORTED) 756 757 #define KCF_PROV_MAC_FINAL(pd, ctx, mac, req) ( \ 758 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_final) ? \ 759 KCF_PROV_MAC_OPS(pd)->mac_final(ctx, mac, req) : \ 760 CRYPTO_NOT_SUPPORTED) 761 762 #define KCF_PROV_MAC_ATOMIC(pd, session, mech, key, data, mac, template, \ 763 req) ( \ 764 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_atomic) ? \ 765 KCF_PROV_MAC_OPS(pd)->mac_atomic( \ 766 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \ 767 req) : \ 768 CRYPTO_NOT_SUPPORTED) 769 770 #define KCF_PROV_MAC_VERIFY_ATOMIC(pd, session, mech, key, data, mac, \ 771 template, req) ( \ 772 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_verify_atomic) ? \ 773 KCF_PROV_MAC_OPS(pd)->mac_verify_atomic( \ 774 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \ 775 req) : \ 776 CRYPTO_NOT_SUPPORTED) 777 778 /* 779 * Wrappers for crypto_sign_ops(9S) entry points. 780 */ 781 782 #define KCF_PROV_SIGN_INIT(pd, ctx, mech, key, template, req) ( \ 783 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_init) ? \ 784 KCF_PROV_SIGN_OPS(pd)->sign_init( \ 785 ctx, mech, key, template, req) : CRYPTO_NOT_SUPPORTED) 786 787 #define KCF_PROV_SIGN(pd, ctx, data, sig, req) ( \ 788 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign) ? \ 789 KCF_PROV_SIGN_OPS(pd)->sign(ctx, data, sig, req) : \ 790 CRYPTO_NOT_SUPPORTED) 791 792 #define KCF_PROV_SIGN_UPDATE(pd, ctx, data, req) ( \ 793 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_update) ? \ 794 KCF_PROV_SIGN_OPS(pd)->sign_update(ctx, data, req) : \ 795 CRYPTO_NOT_SUPPORTED) 796 797 #define KCF_PROV_SIGN_FINAL(pd, ctx, sig, req) ( \ 798 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_final) ? \ 799 KCF_PROV_SIGN_OPS(pd)->sign_final(ctx, sig, req) : \ 800 CRYPTO_NOT_SUPPORTED) 801 802 #define KCF_PROV_SIGN_ATOMIC(pd, session, mech, key, data, template, \ 803 sig, req) ( \ 804 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_atomic) ? \ 805 KCF_PROV_SIGN_OPS(pd)->sign_atomic( \ 806 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 807 req) : CRYPTO_NOT_SUPPORTED) 808 809 #define KCF_PROV_SIGN_RECOVER_INIT(pd, ctx, mech, key, template, \ 810 req) ( \ 811 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover_init) ? \ 812 KCF_PROV_SIGN_OPS(pd)->sign_recover_init(ctx, mech, key, template, \ 813 req) : CRYPTO_NOT_SUPPORTED) 814 815 #define KCF_PROV_SIGN_RECOVER(pd, ctx, data, sig, req) ( \ 816 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover) ? \ 817 KCF_PROV_SIGN_OPS(pd)->sign_recover(ctx, data, sig, req) : \ 818 CRYPTO_NOT_SUPPORTED) 819 820 #define KCF_PROV_SIGN_RECOVER_ATOMIC(pd, session, mech, key, data, template, \ 821 sig, req) ( \ 822 (KCF_PROV_SIGN_OPS(pd) && \ 823 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic) ? \ 824 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic( \ 825 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 826 req) : CRYPTO_NOT_SUPPORTED) 827 828 /* 829 * Wrappers for crypto_verify_ops(9S) entry points. 830 */ 831 832 #define KCF_PROV_VERIFY_INIT(pd, ctx, mech, key, template, req) ( \ 833 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_init) ? \ 834 KCF_PROV_VERIFY_OPS(pd)->verify_init(ctx, mech, key, template, \ 835 req) : CRYPTO_NOT_SUPPORTED) 836 837 #define KCF_PROV_VERIFY(pd, ctx, data, sig, req) ( \ 838 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify) ? \ 839 KCF_PROV_VERIFY_OPS(pd)->verify(ctx, data, sig, req) : \ 840 CRYPTO_NOT_SUPPORTED) 841 842 #define KCF_PROV_VERIFY_UPDATE(pd, ctx, data, req) ( \ 843 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_update) ? \ 844 KCF_PROV_VERIFY_OPS(pd)->verify_update(ctx, data, req) : \ 845 CRYPTO_NOT_SUPPORTED) 846 847 #define KCF_PROV_VERIFY_FINAL(pd, ctx, sig, req) ( \ 848 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_final) ? \ 849 KCF_PROV_VERIFY_OPS(pd)->verify_final(ctx, sig, req) : \ 850 CRYPTO_NOT_SUPPORTED) 851 852 #define KCF_PROV_VERIFY_ATOMIC(pd, session, mech, key, data, template, sig, \ 853 req) ( \ 854 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_atomic) ? \ 855 KCF_PROV_VERIFY_OPS(pd)->verify_atomic( \ 856 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 857 req) : CRYPTO_NOT_SUPPORTED) 858 859 #define KCF_PROV_VERIFY_RECOVER_INIT(pd, ctx, mech, key, template, \ 860 req) ( \ 861 (KCF_PROV_VERIFY_OPS(pd) && \ 862 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init) ? \ 863 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init(ctx, mech, key, \ 864 template, req) : CRYPTO_NOT_SUPPORTED) 865 866 /* verify_recover() CSPI routine has different argument order than verify() */ 867 #define KCF_PROV_VERIFY_RECOVER(pd, ctx, sig, data, req) ( \ 868 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_recover) ? \ 869 KCF_PROV_VERIFY_OPS(pd)->verify_recover(ctx, sig, data, req) : \ 870 CRYPTO_NOT_SUPPORTED) 871 872 /* 873 * verify_recover_atomic() CSPI routine has different argument order 874 * than verify_atomic(). 875 */ 876 #define KCF_PROV_VERIFY_RECOVER_ATOMIC(pd, session, mech, key, sig, \ 877 template, data, req) ( \ 878 (KCF_PROV_VERIFY_OPS(pd) && \ 879 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic) ? \ 880 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic( \ 881 (pd)->pd_prov_handle, session, mech, key, sig, data, template, \ 882 req) : CRYPTO_NOT_SUPPORTED) 883 884 /* 885 * Wrappers for crypto_dual_ops(9S) entry points. 886 */ 887 888 #define KCF_PROV_DIGEST_ENCRYPT_UPDATE(digest_ctx, encrypt_ctx, plaintext, \ 889 ciphertext, req) ( \ 890 (KCF_PROV_DUAL_OPS(pd) && \ 891 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update) ? \ 892 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update( \ 893 digest_ctx, encrypt_ctx, plaintext, ciphertext, req) : \ 894 CRYPTO_NOT_SUPPORTED) 895 896 #define KCF_PROV_DECRYPT_DIGEST_UPDATE(decrypt_ctx, digest_ctx, ciphertext, \ 897 plaintext, req) ( \ 898 (KCF_PROV_DUAL_OPS(pd) && \ 899 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update) ? \ 900 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update( \ 901 decrypt_ctx, digest_ctx, ciphertext, plaintext, req) : \ 902 CRYPTO_NOT_SUPPORTED) 903 904 #define KCF_PROV_SIGN_ENCRYPT_UPDATE(sign_ctx, encrypt_ctx, plaintext, \ 905 ciphertext, req) ( \ 906 (KCF_PROV_DUAL_OPS(pd) && \ 907 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update) ? \ 908 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update( \ 909 sign_ctx, encrypt_ctx, plaintext, ciphertext, req) : \ 910 CRYPTO_NOT_SUPPORTED) 911 912 #define KCF_PROV_DECRYPT_VERIFY_UPDATE(decrypt_ctx, verify_ctx, ciphertext, \ 913 plaintext, req) ( \ 914 (KCF_PROV_DUAL_OPS(pd) && \ 915 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update) ? \ 916 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update( \ 917 decrypt_ctx, verify_ctx, ciphertext, plaintext, req) : \ 918 CRYPTO_NOT_SUPPORTED) 919 920 /* 921 * Wrappers for crypto_dual_cipher_mac_ops(9S) entry points. 922 */ 923 924 #define KCF_PROV_ENCRYPT_MAC_INIT(pd, ctx, encr_mech, encr_key, mac_mech, \ 925 mac_key, encr_ctx_template, mac_ctx_template, req) ( \ 926 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 927 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init) ? \ 928 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init( \ 929 ctx, encr_mech, encr_key, mac_mech, mac_key, encr_ctx_template, \ 930 mac_ctx_template, req) : \ 931 CRYPTO_NOT_SUPPORTED) 932 933 #define KCF_PROV_ENCRYPT_MAC(pd, ctx, plaintext, ciphertext, mac, req) ( \ 934 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 935 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac) ? \ 936 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac( \ 937 ctx, plaintext, ciphertext, mac, req) : \ 938 CRYPTO_NOT_SUPPORTED) 939 940 #define KCF_PROV_ENCRYPT_MAC_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \ 941 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 942 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update) ? \ 943 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update( \ 944 ctx, plaintext, ciphertext, req) : \ 945 CRYPTO_NOT_SUPPORTED) 946 947 #define KCF_PROV_ENCRYPT_MAC_FINAL(pd, ctx, ciphertext, mac, req) ( \ 948 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 949 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final) ? \ 950 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final( \ 951 ctx, ciphertext, mac, req) : \ 952 CRYPTO_NOT_SUPPORTED) 953 954 #define KCF_PROV_ENCRYPT_MAC_ATOMIC(pd, session, encr_mech, encr_key, \ 955 mac_mech, mac_key, plaintext, ciphertext, mac, \ 956 encr_ctx_template, mac_ctx_template, req) ( \ 957 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 958 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic) ? \ 959 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic( \ 960 (pd)->pd_prov_handle, session, encr_mech, encr_key, \ 961 mac_mech, mac_key, plaintext, ciphertext, mac, \ 962 encr_ctx_template, mac_ctx_template, req) : \ 963 CRYPTO_NOT_SUPPORTED) 964 965 #define KCF_PROV_MAC_DECRYPT_INIT(pd, ctx, mac_mech, mac_key, decr_mech, \ 966 decr_key, mac_ctx_template, decr_ctx_template, req) ( \ 967 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 968 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init) ? \ 969 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init( \ 970 ctx, mac_mech, mac_key, decr_mech, decr_key, mac_ctx_template, \ 971 decr_ctx_template, req) : \ 972 CRYPTO_NOT_SUPPORTED) 973 974 #define KCF_PROV_MAC_DECRYPT(pd, ctx, ciphertext, mac, plaintext, req) ( \ 975 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 976 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt) ? \ 977 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt( \ 978 ctx, ciphertext, mac, plaintext, req) : \ 979 CRYPTO_NOT_SUPPORTED) 980 981 #define KCF_PROV_MAC_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \ 982 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 983 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update) ? \ 984 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update( \ 985 ctx, ciphertext, plaintext, req) : \ 986 CRYPTO_NOT_SUPPORTED) 987 988 #define KCF_PROV_MAC_DECRYPT_FINAL(pd, ctx, mac, plaintext, req) ( \ 989 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 990 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final) ? \ 991 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final( \ 992 ctx, mac, plaintext, req) : \ 993 CRYPTO_NOT_SUPPORTED) 994 995 #define KCF_PROV_MAC_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \ 996 decr_mech, decr_key, ciphertext, mac, plaintext, \ 997 mac_ctx_template, decr_ctx_template, req) ( \ 998 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 999 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic) ? \ 1000 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic( \ 1001 (pd)->pd_prov_handle, session, mac_mech, mac_key, \ 1002 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1003 mac_ctx_template, decr_ctx_template, req) : \ 1004 CRYPTO_NOT_SUPPORTED) 1005 1006 #define KCF_PROV_MAC_VERIFY_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \ 1007 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1008 mac_ctx_template, decr_ctx_template, req) ( \ 1009 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 1010 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic \ 1011 != NULL) ? \ 1012 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic( \ 1013 (pd)->pd_prov_handle, session, mac_mech, mac_key, \ 1014 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1015 mac_ctx_template, decr_ctx_template, req) : \ 1016 CRYPTO_NOT_SUPPORTED) 1017 1018 /* 1019 * Wrappers for crypto_random_number_ops(9S) entry points. 1020 */ 1021 1022 #define KCF_PROV_SEED_RANDOM(pd, session, buf, len, est, flags, req) ( \ 1023 (KCF_PROV_RANDOM_OPS(pd) && KCF_PROV_RANDOM_OPS(pd)->seed_random) ? \ 1024 KCF_PROV_RANDOM_OPS(pd)->seed_random((pd)->pd_prov_handle, \ 1025 session, buf, len, est, flags, req) : CRYPTO_NOT_SUPPORTED) 1026 1027 #define KCF_PROV_GENERATE_RANDOM(pd, session, buf, len, req) ( \ 1028 (KCF_PROV_RANDOM_OPS(pd) && \ 1029 KCF_PROV_RANDOM_OPS(pd)->generate_random) ? \ 1030 KCF_PROV_RANDOM_OPS(pd)->generate_random((pd)->pd_prov_handle, \ 1031 session, buf, len, req) : CRYPTO_NOT_SUPPORTED) 1032 1033 /* 1034 * Wrappers for crypto_session_ops(9S) entry points. 1035 * 1036 * ops_pd is the provider descriptor that supplies the ops_vector. 1037 * pd is the descriptor that supplies the provider handle. 1038 * Only session open/close needs two handles. 1039 */ 1040 1041 #define KCF_PROV_SESSION_OPEN(ops_pd, session, req, pd) ( \ 1042 (KCF_PROV_SESSION_OPS(ops_pd) && \ 1043 KCF_PROV_SESSION_OPS(ops_pd)->session_open) ? \ 1044 KCF_PROV_SESSION_OPS(ops_pd)->session_open((pd)->pd_prov_handle, \ 1045 session, req) : CRYPTO_NOT_SUPPORTED) 1046 1047 #define KCF_PROV_SESSION_CLOSE(ops_pd, session, req, pd) ( \ 1048 (KCF_PROV_SESSION_OPS(ops_pd) && \ 1049 KCF_PROV_SESSION_OPS(ops_pd)->session_close) ? \ 1050 KCF_PROV_SESSION_OPS(ops_pd)->session_close((pd)->pd_prov_handle, \ 1051 session, req) : CRYPTO_NOT_SUPPORTED) 1052 1053 #define KCF_PROV_SESSION_LOGIN(pd, session, user_type, pin, len, req) ( \ 1054 (KCF_PROV_SESSION_OPS(pd) && \ 1055 KCF_PROV_SESSION_OPS(pd)->session_login) ? \ 1056 KCF_PROV_SESSION_OPS(pd)->session_login((pd)->pd_prov_handle, \ 1057 session, user_type, pin, len, req) : CRYPTO_NOT_SUPPORTED) 1058 1059 #define KCF_PROV_SESSION_LOGOUT(pd, session, req) ( \ 1060 (KCF_PROV_SESSION_OPS(pd) && \ 1061 KCF_PROV_SESSION_OPS(pd)->session_logout) ? \ 1062 KCF_PROV_SESSION_OPS(pd)->session_logout((pd)->pd_prov_handle, \ 1063 session, req) : CRYPTO_NOT_SUPPORTED) 1064 1065 /* 1066 * Wrappers for crypto_object_ops(9S) entry points. 1067 */ 1068 1069 #define KCF_PROV_OBJECT_CREATE(pd, session, template, count, object, req) ( \ 1070 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_create) ? \ 1071 KCF_PROV_OBJECT_OPS(pd)->object_create((pd)->pd_prov_handle, \ 1072 session, template, count, object, req) : CRYPTO_NOT_SUPPORTED) 1073 1074 #define KCF_PROV_OBJECT_COPY(pd, session, object, template, count, \ 1075 new_object, req) ( \ 1076 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_copy) ? \ 1077 KCF_PROV_OBJECT_OPS(pd)->object_copy((pd)->pd_prov_handle, \ 1078 session, object, template, count, new_object, req) : \ 1079 CRYPTO_NOT_SUPPORTED) 1080 1081 #define KCF_PROV_OBJECT_DESTROY(pd, session, object, req) ( \ 1082 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_destroy) ? \ 1083 KCF_PROV_OBJECT_OPS(pd)->object_destroy((pd)->pd_prov_handle, \ 1084 session, object, req) : CRYPTO_NOT_SUPPORTED) 1085 1086 #define KCF_PROV_OBJECT_GET_SIZE(pd, session, object, size, req) ( \ 1087 (KCF_PROV_OBJECT_OPS(pd) && \ 1088 KCF_PROV_OBJECT_OPS(pd)->object_get_size) ? \ 1089 KCF_PROV_OBJECT_OPS(pd)->object_get_size((pd)->pd_prov_handle, \ 1090 session, object, size, req) : CRYPTO_NOT_SUPPORTED) 1091 1092 #define KCF_PROV_OBJECT_GET_ATTRIBUTE_VALUE(pd, session, object, template, \ 1093 count, req) ( \ 1094 (KCF_PROV_OBJECT_OPS(pd) && \ 1095 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value) ? \ 1096 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value( \ 1097 (pd)->pd_prov_handle, session, object, template, count, req) : \ 1098 CRYPTO_NOT_SUPPORTED) 1099 1100 #define KCF_PROV_OBJECT_SET_ATTRIBUTE_VALUE(pd, session, object, template, \ 1101 count, req) ( \ 1102 (KCF_PROV_OBJECT_OPS(pd) && \ 1103 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value) ? \ 1104 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value( \ 1105 (pd)->pd_prov_handle, session, object, template, count, req) : \ 1106 CRYPTO_NOT_SUPPORTED) 1107 1108 #define KCF_PROV_OBJECT_FIND_INIT(pd, session, template, count, ppriv, \ 1109 req) ( \ 1110 (KCF_PROV_OBJECT_OPS(pd) && \ 1111 KCF_PROV_OBJECT_OPS(pd)->object_find_init) ? \ 1112 KCF_PROV_OBJECT_OPS(pd)->object_find_init((pd)->pd_prov_handle, \ 1113 session, template, count, ppriv, req) : CRYPTO_NOT_SUPPORTED) 1114 1115 #define KCF_PROV_OBJECT_FIND(pd, ppriv, objects, max_objects, object_count, \ 1116 req) ( \ 1117 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_find) ? \ 1118 KCF_PROV_OBJECT_OPS(pd)->object_find( \ 1119 (pd)->pd_prov_handle, ppriv, objects, max_objects, object_count, \ 1120 req) : CRYPTO_NOT_SUPPORTED) 1121 1122 #define KCF_PROV_OBJECT_FIND_FINAL(pd, ppriv, req) ( \ 1123 (KCF_PROV_OBJECT_OPS(pd) && \ 1124 KCF_PROV_OBJECT_OPS(pd)->object_find_final) ? \ 1125 KCF_PROV_OBJECT_OPS(pd)->object_find_final( \ 1126 (pd)->pd_prov_handle, ppriv, req) : CRYPTO_NOT_SUPPORTED) 1127 1128 /* 1129 * Wrappers for crypto_key_ops(9S) entry points. 1130 */ 1131 1132 #define KCF_PROV_KEY_GENERATE(pd, session, mech, template, count, object, \ 1133 req) ( \ 1134 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate) ? \ 1135 KCF_PROV_KEY_OPS(pd)->key_generate((pd)->pd_prov_handle, \ 1136 session, mech, template, count, object, req) : \ 1137 CRYPTO_NOT_SUPPORTED) 1138 1139 #define KCF_PROV_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \ 1140 pub_count, priv_template, priv_count, pub_key, priv_key, req) ( \ 1141 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate_pair) ? \ 1142 KCF_PROV_KEY_OPS(pd)->key_generate_pair((pd)->pd_prov_handle, \ 1143 session, mech, pub_template, pub_count, priv_template, \ 1144 priv_count, pub_key, priv_key, req) : \ 1145 CRYPTO_NOT_SUPPORTED) 1146 1147 #define KCF_PROV_KEY_WRAP(pd, session, mech, wrapping_key, key, wrapped_key, \ 1148 wrapped_key_len, req) ( \ 1149 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_wrap) ? \ 1150 KCF_PROV_KEY_OPS(pd)->key_wrap((pd)->pd_prov_handle, \ 1151 session, mech, wrapping_key, key, wrapped_key, wrapped_key_len, \ 1152 req) : \ 1153 CRYPTO_NOT_SUPPORTED) 1154 1155 #define KCF_PROV_KEY_UNWRAP(pd, session, mech, unwrapping_key, wrapped_key, \ 1156 wrapped_key_len, template, count, key, req) ( \ 1157 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_unwrap) ? \ 1158 KCF_PROV_KEY_OPS(pd)->key_unwrap((pd)->pd_prov_handle, \ 1159 session, mech, unwrapping_key, wrapped_key, wrapped_key_len, \ 1160 template, count, key, req) : \ 1161 CRYPTO_NOT_SUPPORTED) 1162 1163 #define KCF_PROV_KEY_DERIVE(pd, session, mech, base_key, template, count, \ 1164 key, req) ( \ 1165 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_derive) ? \ 1166 KCF_PROV_KEY_OPS(pd)->key_derive((pd)->pd_prov_handle, \ 1167 session, mech, base_key, template, count, key, req) : \ 1168 CRYPTO_NOT_SUPPORTED) 1169 1170 #define KCF_PROV_KEY_CHECK(pd, mech, key) ( \ 1171 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_check) ? \ 1172 KCF_PROV_KEY_OPS(pd)->key_check((pd)->pd_prov_handle, mech, key) : \ 1173 CRYPTO_NOT_SUPPORTED) 1174 1175 /* 1176 * Wrappers for crypto_provider_management_ops(9S) entry points. 1177 * 1178 * ops_pd is the provider descriptor that supplies the ops_vector. 1179 * pd is the descriptor that supplies the provider handle. 1180 * Only ext_info needs two handles. 1181 */ 1182 1183 #define KCF_PROV_EXT_INFO(ops_pd, provext_info, req, pd) ( \ 1184 (KCF_PROV_PROVIDER_OPS(ops_pd) && \ 1185 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info) ? \ 1186 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info((pd)->pd_prov_handle, \ 1187 provext_info, req) : CRYPTO_NOT_SUPPORTED) 1188 1189 #define KCF_PROV_INIT_TOKEN(pd, pin, pin_len, label, req) ( \ 1190 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_token) ? \ 1191 KCF_PROV_PROVIDER_OPS(pd)->init_token((pd)->pd_prov_handle, \ 1192 pin, pin_len, label, req) : CRYPTO_NOT_SUPPORTED) 1193 1194 #define KCF_PROV_INIT_PIN(pd, session, pin, pin_len, req) ( \ 1195 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_pin) ? \ 1196 KCF_PROV_PROVIDER_OPS(pd)->init_pin((pd)->pd_prov_handle, \ 1197 session, pin, pin_len, req) : CRYPTO_NOT_SUPPORTED) 1198 1199 #define KCF_PROV_SET_PIN(pd, session, old_pin, old_len, new_pin, new_len, \ 1200 req) ( \ 1201 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->set_pin) ? \ 1202 KCF_PROV_PROVIDER_OPS(pd)->set_pin((pd)->pd_prov_handle, \ 1203 session, old_pin, old_len, new_pin, new_len, req) : \ 1204 CRYPTO_NOT_SUPPORTED) 1205 1206 /* 1207 * Wrappers for crypto_nostore_key_ops(9S) entry points. 1208 */ 1209 1210 #define KCF_PROV_NOSTORE_KEY_GENERATE(pd, session, mech, template, count, \ 1211 out_template, out_count, req) ( \ 1212 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1213 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate) ? \ 1214 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate( \ 1215 (pd)->pd_prov_handle, session, mech, template, count, \ 1216 out_template, out_count, req) : CRYPTO_NOT_SUPPORTED) 1217 1218 #define KCF_PROV_NOSTORE_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \ 1219 pub_count, priv_template, priv_count, out_pub_template, \ 1220 out_pub_count, out_priv_template, out_priv_count, req) ( \ 1221 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1222 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair) ? \ 1223 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair( \ 1224 (pd)->pd_prov_handle, session, mech, pub_template, pub_count, \ 1225 priv_template, priv_count, out_pub_template, out_pub_count, \ 1226 out_priv_template, out_priv_count, req) : CRYPTO_NOT_SUPPORTED) 1227 1228 #define KCF_PROV_NOSTORE_KEY_DERIVE(pd, session, mech, base_key, template, \ 1229 count, out_template, out_count, req) ( \ 1230 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1231 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive) ? \ 1232 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive( \ 1233 (pd)->pd_prov_handle, session, mech, base_key, template, count, \ 1234 out_template, out_count, req) : CRYPTO_NOT_SUPPORTED) 1235 1236 /* 1237 * The following routines are exported by the kcf module (/kernel/misc/kcf) 1238 * to the crypto and cryptoadmin modules. 1239 */ 1240 1241 /* Digest/mac/cipher entry points that take a provider descriptor and session */ 1242 extern int crypto_digest_single(crypto_context_t, crypto_data_t *, 1243 crypto_data_t *, crypto_call_req_t *); 1244 1245 extern int crypto_mac_single(crypto_context_t, crypto_data_t *, 1246 crypto_data_t *, crypto_call_req_t *); 1247 1248 extern int crypto_encrypt_single(crypto_context_t, crypto_data_t *, 1249 crypto_data_t *, crypto_call_req_t *); 1250 1251 extern int crypto_decrypt_single(crypto_context_t, crypto_data_t *, 1252 crypto_data_t *, crypto_call_req_t *); 1253 1254 1255 /* Other private digest/mac/cipher entry points not exported through k-API */ 1256 extern int crypto_digest_key_prov(crypto_context_t, crypto_key_t *, 1257 crypto_call_req_t *); 1258 1259 /* Private sign entry points exported by KCF */ 1260 extern int crypto_sign_single(crypto_context_t, crypto_data_t *, 1261 crypto_data_t *, crypto_call_req_t *); 1262 1263 extern int crypto_sign_recover_single(crypto_context_t, crypto_data_t *, 1264 crypto_data_t *, crypto_call_req_t *); 1265 1266 /* Private verify entry points exported by KCF */ 1267 extern int crypto_verify_single(crypto_context_t, crypto_data_t *, 1268 crypto_data_t *, crypto_call_req_t *); 1269 1270 extern int crypto_verify_recover_single(crypto_context_t, crypto_data_t *, 1271 crypto_data_t *, crypto_call_req_t *); 1272 1273 /* Private dual operations entry points exported by KCF */ 1274 extern int crypto_digest_encrypt_update(crypto_context_t, crypto_context_t, 1275 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1276 extern int crypto_decrypt_digest_update(crypto_context_t, crypto_context_t, 1277 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1278 extern int crypto_sign_encrypt_update(crypto_context_t, crypto_context_t, 1279 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1280 extern int crypto_decrypt_verify_update(crypto_context_t, crypto_context_t, 1281 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1282 1283 /* Random Number Generation */ 1284 int crypto_seed_random(crypto_provider_handle_t provider, uchar_t *buf, 1285 size_t len, crypto_call_req_t *req); 1286 int crypto_generate_random(crypto_provider_handle_t provider, uchar_t *buf, 1287 size_t len, crypto_call_req_t *req); 1288 1289 /* Provider Management */ 1290 int crypto_get_provider_info(crypto_provider_id_t id, 1291 crypto_provider_info_t **info, crypto_call_req_t *req); 1292 int crypto_get_provider_mechanisms(crypto_minor_t *, crypto_provider_id_t id, 1293 uint_t *count, crypto_mech_name_t **list); 1294 int crypto_init_token(crypto_provider_handle_t provider, char *pin, 1295 size_t pin_len, char *label, crypto_call_req_t *); 1296 int crypto_init_pin(crypto_provider_handle_t provider, char *pin, 1297 size_t pin_len, crypto_call_req_t *req); 1298 int crypto_set_pin(crypto_provider_handle_t provider, char *old_pin, 1299 size_t old_len, char *new_pin, size_t new_len, crypto_call_req_t *req); 1300 void crypto_free_provider_list(crypto_provider_entry_t *list, uint_t count); 1301 void crypto_free_provider_info(crypto_provider_info_t *info); 1302 1303 /* Administrative */ 1304 int crypto_get_dev_list(uint_t *count, crypto_dev_list_entry_t **list); 1305 int crypto_get_soft_list(uint_t *count, char **list, size_t *len); 1306 int crypto_get_dev_info(char *name, uint_t instance, uint_t *count, 1307 crypto_mech_name_t **list); 1308 int crypto_get_soft_info(caddr_t name, uint_t *count, 1309 crypto_mech_name_t **list); 1310 int crypto_load_dev_disabled(char *name, uint_t instance, uint_t count, 1311 crypto_mech_name_t *list); 1312 int crypto_load_soft_disabled(caddr_t name, uint_t count, 1313 crypto_mech_name_t *list); 1314 int crypto_unload_soft_module(caddr_t path); 1315 int crypto_load_soft_config(caddr_t name, uint_t count, 1316 crypto_mech_name_t *list); 1317 int crypto_load_door(uint_t did); 1318 void crypto_free_mech_list(crypto_mech_name_t *list, uint_t count); 1319 void crypto_free_dev_list(crypto_dev_list_entry_t *list, uint_t count); 1320 extern void kcf_activate(); 1321 1322 /* Miscellaneous */ 1323 int crypto_get_mechanism_number(caddr_t name, crypto_mech_type_t *number); 1324 int crypto_get_function_list(crypto_provider_id_t id, 1325 crypto_function_list_t **list, int kmflag); 1326 void crypto_free_function_list(crypto_function_list_t *list); 1327 int crypto_build_permitted_mech_names(kcf_provider_desc_t *, 1328 crypto_mech_name_t **, uint_t *, int); 1329 extern void kcf_init_mech_tabs(void); 1330 extern int kcf_add_mech_provider(short, kcf_provider_desc_t *, 1331 kcf_prov_mech_desc_t **); 1332 extern void kcf_remove_mech_provider(char *, kcf_provider_desc_t *); 1333 extern int kcf_get_mech_entry(crypto_mech_type_t, kcf_mech_entry_t **); 1334 extern kcf_provider_desc_t *kcf_alloc_provider_desc(crypto_provider_info_t *); 1335 extern void kcf_free_provider_desc(kcf_provider_desc_t *); 1336 extern void kcf_soft_config_init(void); 1337 extern int get_sw_provider_for_mech(crypto_mech_name_t, char **); 1338 extern crypto_mech_type_t crypto_mech2id_common(char *, boolean_t); 1339 extern void undo_register_provider(kcf_provider_desc_t *, boolean_t); 1340 extern void redo_register_provider(kcf_provider_desc_t *); 1341 extern void kcf_rnd_init(); 1342 extern boolean_t kcf_rngprov_check(void); 1343 extern int kcf_rnd_get_pseudo_bytes(uint8_t *, size_t); 1344 extern int kcf_rnd_get_bytes(uint8_t *, size_t, boolean_t); 1345 extern int random_add_pseudo_entropy(uint8_t *, size_t, uint_t); 1346 extern void kcf_rnd_chpoll(short, int, short *, struct pollhead **); 1347 extern int crypto_uio_data(crypto_data_t *, uchar_t *, int, cmd_type_t, 1348 void *, void (*update)()); 1349 extern int crypto_mblk_data(crypto_data_t *, uchar_t *, int, cmd_type_t, 1350 void *, void (*update)()); 1351 extern int crypto_put_output_data(uchar_t *, crypto_data_t *, int); 1352 extern int crypto_get_input_data(crypto_data_t *, uchar_t **, uchar_t *); 1353 extern int crypto_copy_key_to_ctx(crypto_key_t *, crypto_key_t **, size_t *, 1354 int kmflag); 1355 extern int crypto_digest_data(crypto_data_t *, void *, uchar_t *, 1356 void (*update)(), void (*final)(), uchar_t); 1357 extern int crypto_update_iov(void *, crypto_data_t *, crypto_data_t *, 1358 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1359 void (*copy_block)(uint8_t *, uint64_t *)); 1360 extern int crypto_update_uio(void *, crypto_data_t *, crypto_data_t *, 1361 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1362 void (*copy_block)(uint8_t *, uint64_t *)); 1363 extern int crypto_update_mp(void *, crypto_data_t *, crypto_data_t *, 1364 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1365 void (*copy_block)(uint8_t *, uint64_t *)); 1366 extern int crypto_get_key_attr(crypto_key_t *, crypto_attr_type_t, uchar_t **, 1367 ssize_t *); 1368 1369 /* Access to the provider's table */ 1370 extern void kcf_prov_tab_init(void); 1371 extern int kcf_prov_tab_add_provider(kcf_provider_desc_t *); 1372 extern int kcf_prov_tab_rem_provider(crypto_provider_id_t); 1373 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_name(char *); 1374 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_dev(char *, uint_t); 1375 extern int kcf_get_hw_prov_tab(uint_t *, kcf_provider_desc_t ***, int, 1376 char *, uint_t, boolean_t); 1377 extern int kcf_get_slot_list(uint_t *, kcf_provider_desc_t ***, boolean_t); 1378 extern void kcf_free_provider_tab(uint_t, kcf_provider_desc_t **); 1379 extern kcf_provider_desc_t *kcf_prov_tab_lookup(crypto_provider_id_t); 1380 extern int kcf_get_sw_prov(crypto_mech_type_t, kcf_provider_desc_t **, 1381 kcf_mech_entry_t **, boolean_t); 1382 1383 extern kmutex_t prov_tab_mutex; 1384 extern boolean_t kcf_need_provtab_walk; 1385 extern int kcf_get_refcnt(kcf_provider_desc_t *, boolean_t); 1386 1387 /* Access to the policy table */ 1388 extern boolean_t is_mech_disabled(kcf_provider_desc_t *, crypto_mech_name_t); 1389 extern boolean_t is_mech_disabled_byname(crypto_provider_type_t, char *, 1390 uint_t, crypto_mech_name_t); 1391 extern void kcf_policy_tab_init(void); 1392 extern void kcf_policy_free_desc(kcf_policy_desc_t *); 1393 extern void kcf_policy_remove_by_name(char *, uint_t *, crypto_mech_name_t **); 1394 extern void kcf_policy_remove_by_dev(char *, uint_t, uint_t *, 1395 crypto_mech_name_t **); 1396 extern kcf_policy_desc_t *kcf_policy_lookup_by_name(char *); 1397 extern kcf_policy_desc_t *kcf_policy_lookup_by_dev(char *, uint_t); 1398 extern int kcf_policy_load_soft_disabled(char *, uint_t, crypto_mech_name_t *, 1399 uint_t *, crypto_mech_name_t **); 1400 extern int kcf_policy_load_dev_disabled(char *, uint_t, uint_t, 1401 crypto_mech_name_t *, uint_t *, crypto_mech_name_t **); 1402 extern void remove_soft_config(char *); 1403 1404 #endif /* _KERNEL */ 1405 1406 #ifdef __cplusplus 1407 } 1408 #endif 1409 1410 #endif /* _SYS_CRYPTO_IMPL_H */ 1411