xref: /freebsd/sys/opencrypto/crypto.c (revision 8881d206f4e68b564c2c5f50fc717086fc3e827a)
1 /*-
2  * Copyright (c) 2002-2006 Sam Leffler.  All rights reserved.
3  * Copyright (c) 2021 The FreeBSD Foundation
4  *
5  * Portions of this software were developed by Ararat River
6  * Consulting, LLC under sponsorship of the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 /*
33  * Cryptographic Subsystem.
34  *
35  * This code is derived from the Openbsd Cryptographic Framework (OCF)
36  * that has the copyright shown below.  Very little of the original
37  * code remains.
38  */
39 
40 /*-
41  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
42  *
43  * This code was written by Angelos D. Keromytis in Athens, Greece, in
44  * February 2000. Network Security Technologies Inc. (NSTI) kindly
45  * supported the development of this code.
46  *
47  * Copyright (c) 2000, 2001 Angelos D. Keromytis
48  *
49  * Permission to use, copy, and modify this software with or without fee
50  * is hereby granted, provided that this entire notice is included in
51  * all source code copies of any software which is or includes a copy or
52  * modification of this software.
53  *
54  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
55  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
56  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
57  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
58  * PURPOSE.
59  */
60 
61 #include "opt_compat.h"
62 #include "opt_ddb.h"
63 
64 #include <sys/param.h>
65 #include <sys/systm.h>
66 #include <sys/counter.h>
67 #include <sys/kernel.h>
68 #include <sys/kthread.h>
69 #include <sys/linker.h>
70 #include <sys/lock.h>
71 #include <sys/module.h>
72 #include <sys/mutex.h>
73 #include <sys/malloc.h>
74 #include <sys/mbuf.h>
75 #include <sys/proc.h>
76 #include <sys/refcount.h>
77 #include <sys/sdt.h>
78 #include <sys/smp.h>
79 #include <sys/sysctl.h>
80 #include <sys/taskqueue.h>
81 #include <sys/uio.h>
82 
83 #include <ddb/ddb.h>
84 
85 #include <machine/vmparam.h>
86 #include <vm/uma.h>
87 
88 #include <crypto/intake.h>
89 #include <opencrypto/cryptodev.h>
90 #include <opencrypto/xform_auth.h>
91 #include <opencrypto/xform_enc.h>
92 
93 #include <sys/kobj.h>
94 #include <sys/bus.h>
95 #include "cryptodev_if.h"
96 
97 #if defined(__i386__) || defined(__amd64__) || defined(__aarch64__)
98 #include <machine/pcb.h>
99 #endif
100 
101 SDT_PROVIDER_DEFINE(opencrypto);
102 
103 /*
104  * Crypto drivers register themselves by allocating a slot in the
105  * crypto_drivers table with crypto_get_driverid().
106  */
107 static	struct mtx crypto_drivers_mtx;		/* lock on driver table */
108 #define	CRYPTO_DRIVER_LOCK()	mtx_lock(&crypto_drivers_mtx)
109 #define	CRYPTO_DRIVER_UNLOCK()	mtx_unlock(&crypto_drivers_mtx)
110 #define	CRYPTO_DRIVER_ASSERT()	mtx_assert(&crypto_drivers_mtx, MA_OWNED)
111 
112 /*
113  * Crypto device/driver capabilities structure.
114  *
115  * Synchronization:
116  * (d) - protected by CRYPTO_DRIVER_LOCK()
117  * (q) - protected by CRYPTO_Q_LOCK()
118  * Not tagged fields are read-only.
119  */
120 struct cryptocap {
121 	device_t	cc_dev;
122 	uint32_t	cc_hid;
123 	uint32_t	cc_sessions;		/* (d) # of sessions */
124 
125 	int		cc_flags;		/* (d) flags */
126 #define CRYPTOCAP_F_CLEANUP	0x80000000	/* needs resource cleanup */
127 	int		cc_qblocked;		/* (q) symmetric q blocked */
128 	size_t		cc_session_size;
129 	volatile int	cc_refs;
130 };
131 
132 static	struct cryptocap **crypto_drivers = NULL;
133 static	int crypto_drivers_size = 0;
134 
135 struct crypto_session {
136 	struct cryptocap *cap;
137 	struct crypto_session_params csp;
138 	uint64_t id;
139 	/* Driver softc follows. */
140 };
141 
142 static	int crp_sleep = 0;
143 static	TAILQ_HEAD(cryptop_q ,cryptop) crp_q;		/* request queues */
144 static	struct mtx crypto_q_mtx;
145 #define	CRYPTO_Q_LOCK()		mtx_lock(&crypto_q_mtx)
146 #define	CRYPTO_Q_UNLOCK()	mtx_unlock(&crypto_q_mtx)
147 
148 SYSCTL_NODE(_kern, OID_AUTO, crypto, CTLFLAG_RW, 0,
149     "In-kernel cryptography");
150 
151 /*
152  * Taskqueue used to dispatch the crypto requests
153  * that have the CRYPTO_F_ASYNC flag
154  */
155 static struct taskqueue *crypto_tq;
156 
157 /*
158  * Crypto seq numbers are operated on with modular arithmetic
159  */
160 #define	CRYPTO_SEQ_GT(a,b)	((int)((a)-(b)) > 0)
161 
162 struct crypto_ret_worker {
163 	struct mtx crypto_ret_mtx;
164 
165 	TAILQ_HEAD(,cryptop) crp_ordered_ret_q;	/* ordered callback queue for symetric jobs */
166 	TAILQ_HEAD(,cryptop) crp_ret_q;		/* callback queue for symetric jobs */
167 
168 	uint32_t reorder_ops;		/* total ordered sym jobs received */
169 	uint32_t reorder_cur_seq;	/* current sym job dispatched */
170 
171 	struct thread *td;
172 };
173 static struct crypto_ret_worker *crypto_ret_workers = NULL;
174 
175 #define CRYPTO_RETW(i)		(&crypto_ret_workers[i])
176 #define CRYPTO_RETW_ID(w)	((w) - crypto_ret_workers)
177 #define FOREACH_CRYPTO_RETW(w) \
178 	for (w = crypto_ret_workers; w < crypto_ret_workers + crypto_workers_num; ++w)
179 
180 #define	CRYPTO_RETW_LOCK(w)	mtx_lock(&w->crypto_ret_mtx)
181 #define	CRYPTO_RETW_UNLOCK(w)	mtx_unlock(&w->crypto_ret_mtx)
182 
183 static int crypto_workers_num = 0;
184 SYSCTL_INT(_kern_crypto, OID_AUTO, num_workers, CTLFLAG_RDTUN,
185 	   &crypto_workers_num, 0,
186 	   "Number of crypto workers used to dispatch crypto jobs");
187 #ifdef COMPAT_FREEBSD12
188 SYSCTL_INT(_kern, OID_AUTO, crypto_workers_num, CTLFLAG_RDTUN,
189 	   &crypto_workers_num, 0,
190 	   "Number of crypto workers used to dispatch crypto jobs");
191 #endif
192 
193 static	uma_zone_t cryptop_zone;
194 
195 int	crypto_devallowsoft = 0;
196 SYSCTL_INT(_kern_crypto, OID_AUTO, allow_soft, CTLFLAG_RWTUN,
197 	   &crypto_devallowsoft, 0,
198 	   "Enable use of software crypto by /dev/crypto");
199 #ifdef COMPAT_FREEBSD12
200 SYSCTL_INT(_kern, OID_AUTO, cryptodevallowsoft, CTLFLAG_RWTUN,
201 	   &crypto_devallowsoft, 0,
202 	   "Enable/disable use of software crypto by /dev/crypto");
203 #endif
204 
205 #ifdef DIAGNOSTIC
206 bool crypto_destroyreq_check;
207 SYSCTL_BOOL(_kern_crypto, OID_AUTO, destroyreq_check, CTLFLAG_RWTUN,
208 	   &crypto_destroyreq_check, 0,
209 	   "Enable checks when destroying a request");
210 #endif
211 
212 MALLOC_DEFINE(M_CRYPTO_DATA, "crypto", "crypto session records");
213 
214 static	void crypto_dispatch_thread(void *arg);
215 static	struct thread *cryptotd;
216 static	void crypto_ret_thread(void *arg);
217 static	void crypto_destroy(void);
218 static	int crypto_invoke(struct cryptocap *cap, struct cryptop *crp, int hint);
219 static	void crypto_task_invoke(void *ctx, int pending);
220 static void crypto_batch_enqueue(struct cryptop *crp);
221 
222 static counter_u64_t cryptostats[sizeof(struct cryptostats) / sizeof(uint64_t)];
223 SYSCTL_COUNTER_U64_ARRAY(_kern_crypto, OID_AUTO, stats, CTLFLAG_RW,
224     cryptostats, nitems(cryptostats),
225     "Crypto system statistics");
226 
227 #define	CRYPTOSTAT_INC(stat) do {					\
228 	counter_u64_add(						\
229 	    cryptostats[offsetof(struct cryptostats, stat) / sizeof(uint64_t)],\
230 	    1);								\
231 } while (0)
232 
233 static void
234 cryptostats_init(void *arg __unused)
235 {
236 	COUNTER_ARRAY_ALLOC(cryptostats, nitems(cryptostats), M_WAITOK);
237 }
238 SYSINIT(cryptostats_init, SI_SUB_COUNTER, SI_ORDER_ANY, cryptostats_init, NULL);
239 
240 static void
241 cryptostats_fini(void *arg __unused)
242 {
243 	COUNTER_ARRAY_FREE(cryptostats, nitems(cryptostats));
244 }
245 SYSUNINIT(cryptostats_fini, SI_SUB_COUNTER, SI_ORDER_ANY, cryptostats_fini,
246     NULL);
247 
248 /* Try to avoid directly exposing the key buffer as a symbol */
249 static struct keybuf *keybuf;
250 
251 static struct keybuf empty_keybuf = {
252         .kb_nents = 0
253 };
254 
255 /* Obtain the key buffer from boot metadata */
256 static void
257 keybuf_init(void)
258 {
259 	caddr_t kmdp;
260 
261 	kmdp = preload_search_by_type("elf kernel");
262 
263 	if (kmdp == NULL)
264 		kmdp = preload_search_by_type("elf64 kernel");
265 
266 	keybuf = (struct keybuf *)preload_search_info(kmdp,
267 	    MODINFO_METADATA | MODINFOMD_KEYBUF);
268 
269         if (keybuf == NULL)
270                 keybuf = &empty_keybuf;
271 }
272 
273 /* It'd be nice if we could store these in some kind of secure memory... */
274 struct keybuf *
275 get_keybuf(void)
276 {
277 
278         return (keybuf);
279 }
280 
281 static struct cryptocap *
282 cap_ref(struct cryptocap *cap)
283 {
284 
285 	refcount_acquire(&cap->cc_refs);
286 	return (cap);
287 }
288 
289 static void
290 cap_rele(struct cryptocap *cap)
291 {
292 
293 	if (refcount_release(&cap->cc_refs) == 0)
294 		return;
295 
296 	KASSERT(cap->cc_sessions == 0,
297 	    ("freeing crypto driver with active sessions"));
298 
299 	free(cap, M_CRYPTO_DATA);
300 }
301 
302 static int
303 crypto_init(void)
304 {
305 	struct crypto_ret_worker *ret_worker;
306 	struct proc *p;
307 	int error;
308 
309 	mtx_init(&crypto_drivers_mtx, "crypto driver table", NULL, MTX_DEF);
310 
311 	TAILQ_INIT(&crp_q);
312 	mtx_init(&crypto_q_mtx, "crypto op queues", NULL, MTX_DEF);
313 
314 	cryptop_zone = uma_zcreate("cryptop",
315 	    sizeof(struct cryptop), NULL, NULL, NULL, NULL,
316 	    UMA_ALIGN_PTR, UMA_ZONE_ZINIT);
317 
318 	crypto_drivers_size = CRYPTO_DRIVERS_INITIAL;
319 	crypto_drivers = malloc(crypto_drivers_size *
320 	    sizeof(struct cryptocap), M_CRYPTO_DATA, M_WAITOK | M_ZERO);
321 
322 	if (crypto_workers_num < 1 || crypto_workers_num > mp_ncpus)
323 		crypto_workers_num = mp_ncpus;
324 
325 	crypto_tq = taskqueue_create("crypto", M_WAITOK | M_ZERO,
326 	    taskqueue_thread_enqueue, &crypto_tq);
327 
328 	taskqueue_start_threads(&crypto_tq, crypto_workers_num, PRI_MIN_KERN,
329 	    "crypto");
330 
331 	p = NULL;
332 	error = kproc_kthread_add(crypto_dispatch_thread, NULL, &p, &cryptotd,
333 	    0, 0, "crypto", "crypto");
334 	if (error) {
335 		printf("crypto_init: cannot start crypto thread; error %d",
336 			error);
337 		goto bad;
338 	}
339 
340 	crypto_ret_workers = mallocarray(crypto_workers_num,
341 	    sizeof(struct crypto_ret_worker), M_CRYPTO_DATA, M_WAITOK | M_ZERO);
342 
343 	FOREACH_CRYPTO_RETW(ret_worker) {
344 		TAILQ_INIT(&ret_worker->crp_ordered_ret_q);
345 		TAILQ_INIT(&ret_worker->crp_ret_q);
346 
347 		ret_worker->reorder_ops = 0;
348 		ret_worker->reorder_cur_seq = 0;
349 
350 		mtx_init(&ret_worker->crypto_ret_mtx, "crypto return queues",
351 		    NULL, MTX_DEF);
352 
353 		error = kthread_add(crypto_ret_thread, ret_worker, p,
354 		    &ret_worker->td, 0, 0, "crypto returns %td",
355 		    CRYPTO_RETW_ID(ret_worker));
356 		if (error) {
357 			printf("crypto_init: cannot start cryptoret thread; error %d",
358 				error);
359 			goto bad;
360 		}
361 	}
362 
363 	keybuf_init();
364 
365 	return 0;
366 bad:
367 	crypto_destroy();
368 	return error;
369 }
370 
371 /*
372  * Signal a crypto thread to terminate.  We use the driver
373  * table lock to synchronize the sleep/wakeups so that we
374  * are sure the threads have terminated before we release
375  * the data structures they use.  See crypto_finis below
376  * for the other half of this song-and-dance.
377  */
378 static void
379 crypto_terminate(struct thread **tdp, void *q)
380 {
381 	struct thread *td;
382 
383 	mtx_assert(&crypto_drivers_mtx, MA_OWNED);
384 	td = *tdp;
385 	*tdp = NULL;
386 	if (td != NULL) {
387 		wakeup_one(q);
388 		mtx_sleep(td, &crypto_drivers_mtx, PWAIT, "crypto_destroy", 0);
389 	}
390 }
391 
392 static void
393 hmac_init_pad(const struct auth_hash *axf, const char *key, int klen,
394     void *auth_ctx, uint8_t padval)
395 {
396 	uint8_t hmac_key[HMAC_MAX_BLOCK_LEN];
397 	u_int i;
398 
399 	KASSERT(axf->blocksize <= sizeof(hmac_key),
400 	    ("Invalid HMAC block size %d", axf->blocksize));
401 
402 	/*
403 	 * If the key is larger than the block size, use the digest of
404 	 * the key as the key instead.
405 	 */
406 	memset(hmac_key, 0, sizeof(hmac_key));
407 	if (klen > axf->blocksize) {
408 		axf->Init(auth_ctx);
409 		axf->Update(auth_ctx, key, klen);
410 		axf->Final(hmac_key, auth_ctx);
411 		klen = axf->hashsize;
412 	} else
413 		memcpy(hmac_key, key, klen);
414 
415 	for (i = 0; i < axf->blocksize; i++)
416 		hmac_key[i] ^= padval;
417 
418 	axf->Init(auth_ctx);
419 	axf->Update(auth_ctx, hmac_key, axf->blocksize);
420 	explicit_bzero(hmac_key, sizeof(hmac_key));
421 }
422 
423 void
424 hmac_init_ipad(const struct auth_hash *axf, const char *key, int klen,
425     void *auth_ctx)
426 {
427 
428 	hmac_init_pad(axf, key, klen, auth_ctx, HMAC_IPAD_VAL);
429 }
430 
431 void
432 hmac_init_opad(const struct auth_hash *axf, const char *key, int klen,
433     void *auth_ctx)
434 {
435 
436 	hmac_init_pad(axf, key, klen, auth_ctx, HMAC_OPAD_VAL);
437 }
438 
439 static void
440 crypto_destroy(void)
441 {
442 	struct crypto_ret_worker *ret_worker;
443 	int i;
444 
445 	/*
446 	 * Terminate any crypto threads.
447 	 */
448 	if (crypto_tq != NULL)
449 		taskqueue_drain_all(crypto_tq);
450 	CRYPTO_DRIVER_LOCK();
451 	crypto_terminate(&cryptotd, &crp_q);
452 	FOREACH_CRYPTO_RETW(ret_worker)
453 		crypto_terminate(&ret_worker->td, &ret_worker->crp_ret_q);
454 	CRYPTO_DRIVER_UNLOCK();
455 
456 	/* XXX flush queues??? */
457 
458 	/*
459 	 * Reclaim dynamically allocated resources.
460 	 */
461 	for (i = 0; i < crypto_drivers_size; i++) {
462 		if (crypto_drivers[i] != NULL)
463 			cap_rele(crypto_drivers[i]);
464 	}
465 	free(crypto_drivers, M_CRYPTO_DATA);
466 
467 	if (cryptop_zone != NULL)
468 		uma_zdestroy(cryptop_zone);
469 	mtx_destroy(&crypto_q_mtx);
470 	FOREACH_CRYPTO_RETW(ret_worker)
471 		mtx_destroy(&ret_worker->crypto_ret_mtx);
472 	free(crypto_ret_workers, M_CRYPTO_DATA);
473 	if (crypto_tq != NULL)
474 		taskqueue_free(crypto_tq);
475 	mtx_destroy(&crypto_drivers_mtx);
476 }
477 
478 uint32_t
479 crypto_ses2hid(crypto_session_t crypto_session)
480 {
481 	return (crypto_session->cap->cc_hid);
482 }
483 
484 uint32_t
485 crypto_ses2caps(crypto_session_t crypto_session)
486 {
487 	return (crypto_session->cap->cc_flags & 0xff000000);
488 }
489 
490 void *
491 crypto_get_driver_session(crypto_session_t crypto_session)
492 {
493 	return (crypto_session + 1);
494 }
495 
496 const struct crypto_session_params *
497 crypto_get_params(crypto_session_t crypto_session)
498 {
499 	return (&crypto_session->csp);
500 }
501 
502 const struct auth_hash *
503 crypto_auth_hash(const struct crypto_session_params *csp)
504 {
505 
506 	switch (csp->csp_auth_alg) {
507 	case CRYPTO_SHA1_HMAC:
508 		return (&auth_hash_hmac_sha1);
509 	case CRYPTO_SHA2_224_HMAC:
510 		return (&auth_hash_hmac_sha2_224);
511 	case CRYPTO_SHA2_256_HMAC:
512 		return (&auth_hash_hmac_sha2_256);
513 	case CRYPTO_SHA2_384_HMAC:
514 		return (&auth_hash_hmac_sha2_384);
515 	case CRYPTO_SHA2_512_HMAC:
516 		return (&auth_hash_hmac_sha2_512);
517 	case CRYPTO_NULL_HMAC:
518 		return (&auth_hash_null);
519 	case CRYPTO_RIPEMD160_HMAC:
520 		return (&auth_hash_hmac_ripemd_160);
521 	case CRYPTO_RIPEMD160:
522 		return (&auth_hash_ripemd_160);
523 	case CRYPTO_SHA1:
524 		return (&auth_hash_sha1);
525 	case CRYPTO_SHA2_224:
526 		return (&auth_hash_sha2_224);
527 	case CRYPTO_SHA2_256:
528 		return (&auth_hash_sha2_256);
529 	case CRYPTO_SHA2_384:
530 		return (&auth_hash_sha2_384);
531 	case CRYPTO_SHA2_512:
532 		return (&auth_hash_sha2_512);
533 	case CRYPTO_AES_NIST_GMAC:
534 		switch (csp->csp_auth_klen) {
535 		case 128 / 8:
536 			return (&auth_hash_nist_gmac_aes_128);
537 		case 192 / 8:
538 			return (&auth_hash_nist_gmac_aes_192);
539 		case 256 / 8:
540 			return (&auth_hash_nist_gmac_aes_256);
541 		default:
542 			return (NULL);
543 		}
544 	case CRYPTO_BLAKE2B:
545 		return (&auth_hash_blake2b);
546 	case CRYPTO_BLAKE2S:
547 		return (&auth_hash_blake2s);
548 	case CRYPTO_POLY1305:
549 		return (&auth_hash_poly1305);
550 	case CRYPTO_AES_CCM_CBC_MAC:
551 		switch (csp->csp_auth_klen) {
552 		case 128 / 8:
553 			return (&auth_hash_ccm_cbc_mac_128);
554 		case 192 / 8:
555 			return (&auth_hash_ccm_cbc_mac_192);
556 		case 256 / 8:
557 			return (&auth_hash_ccm_cbc_mac_256);
558 		default:
559 			return (NULL);
560 		}
561 	default:
562 		return (NULL);
563 	}
564 }
565 
566 const struct enc_xform *
567 crypto_cipher(const struct crypto_session_params *csp)
568 {
569 
570 	switch (csp->csp_cipher_alg) {
571 	case CRYPTO_AES_CBC:
572 		return (&enc_xform_aes_cbc);
573 	case CRYPTO_AES_XTS:
574 		return (&enc_xform_aes_xts);
575 	case CRYPTO_AES_ICM:
576 		return (&enc_xform_aes_icm);
577 	case CRYPTO_AES_NIST_GCM_16:
578 		return (&enc_xform_aes_nist_gcm);
579 	case CRYPTO_CAMELLIA_CBC:
580 		return (&enc_xform_camellia);
581 	case CRYPTO_NULL_CBC:
582 		return (&enc_xform_null);
583 	case CRYPTO_CHACHA20:
584 		return (&enc_xform_chacha20);
585 	case CRYPTO_AES_CCM_16:
586 		return (&enc_xform_ccm);
587 	case CRYPTO_CHACHA20_POLY1305:
588 		return (&enc_xform_chacha20_poly1305);
589 	case CRYPTO_XCHACHA20_POLY1305:
590 		return (&enc_xform_xchacha20_poly1305);
591 	default:
592 		return (NULL);
593 	}
594 }
595 
596 static struct cryptocap *
597 crypto_checkdriver(uint32_t hid)
598 {
599 
600 	return (hid >= crypto_drivers_size ? NULL : crypto_drivers[hid]);
601 }
602 
603 /*
604  * Select a driver for a new session that supports the specified
605  * algorithms and, optionally, is constrained according to the flags.
606  */
607 static struct cryptocap *
608 crypto_select_driver(const struct crypto_session_params *csp, int flags)
609 {
610 	struct cryptocap *cap, *best;
611 	int best_match, error, hid;
612 
613 	CRYPTO_DRIVER_ASSERT();
614 
615 	best = NULL;
616 	for (hid = 0; hid < crypto_drivers_size; hid++) {
617 		/*
618 		 * If there is no driver for this slot, or the driver
619 		 * is not appropriate (hardware or software based on
620 		 * match), then skip.
621 		 */
622 		cap = crypto_drivers[hid];
623 		if (cap == NULL ||
624 		    (cap->cc_flags & flags) == 0)
625 			continue;
626 
627 		error = CRYPTODEV_PROBESESSION(cap->cc_dev, csp);
628 		if (error >= 0)
629 			continue;
630 
631 		/*
632 		 * Use the driver with the highest probe value.
633 		 * Hardware drivers use a higher probe value than
634 		 * software.  In case of a tie, prefer the driver with
635 		 * the fewest active sessions.
636 		 */
637 		if (best == NULL || error > best_match ||
638 		    (error == best_match &&
639 		    cap->cc_sessions < best->cc_sessions)) {
640 			best = cap;
641 			best_match = error;
642 		}
643 	}
644 	return best;
645 }
646 
647 static enum alg_type {
648 	ALG_NONE = 0,
649 	ALG_CIPHER,
650 	ALG_DIGEST,
651 	ALG_KEYED_DIGEST,
652 	ALG_COMPRESSION,
653 	ALG_AEAD
654 } alg_types[] = {
655 	[CRYPTO_SHA1_HMAC] = ALG_KEYED_DIGEST,
656 	[CRYPTO_RIPEMD160_HMAC] = ALG_KEYED_DIGEST,
657 	[CRYPTO_AES_CBC] = ALG_CIPHER,
658 	[CRYPTO_SHA1] = ALG_DIGEST,
659 	[CRYPTO_NULL_HMAC] = ALG_DIGEST,
660 	[CRYPTO_NULL_CBC] = ALG_CIPHER,
661 	[CRYPTO_DEFLATE_COMP] = ALG_COMPRESSION,
662 	[CRYPTO_SHA2_256_HMAC] = ALG_KEYED_DIGEST,
663 	[CRYPTO_SHA2_384_HMAC] = ALG_KEYED_DIGEST,
664 	[CRYPTO_SHA2_512_HMAC] = ALG_KEYED_DIGEST,
665 	[CRYPTO_CAMELLIA_CBC] = ALG_CIPHER,
666 	[CRYPTO_AES_XTS] = ALG_CIPHER,
667 	[CRYPTO_AES_ICM] = ALG_CIPHER,
668 	[CRYPTO_AES_NIST_GMAC] = ALG_KEYED_DIGEST,
669 	[CRYPTO_AES_NIST_GCM_16] = ALG_AEAD,
670 	[CRYPTO_BLAKE2B] = ALG_KEYED_DIGEST,
671 	[CRYPTO_BLAKE2S] = ALG_KEYED_DIGEST,
672 	[CRYPTO_CHACHA20] = ALG_CIPHER,
673 	[CRYPTO_SHA2_224_HMAC] = ALG_KEYED_DIGEST,
674 	[CRYPTO_RIPEMD160] = ALG_DIGEST,
675 	[CRYPTO_SHA2_224] = ALG_DIGEST,
676 	[CRYPTO_SHA2_256] = ALG_DIGEST,
677 	[CRYPTO_SHA2_384] = ALG_DIGEST,
678 	[CRYPTO_SHA2_512] = ALG_DIGEST,
679 	[CRYPTO_POLY1305] = ALG_KEYED_DIGEST,
680 	[CRYPTO_AES_CCM_CBC_MAC] = ALG_KEYED_DIGEST,
681 	[CRYPTO_AES_CCM_16] = ALG_AEAD,
682 	[CRYPTO_CHACHA20_POLY1305] = ALG_AEAD,
683 	[CRYPTO_XCHACHA20_POLY1305] = ALG_AEAD,
684 };
685 
686 static enum alg_type
687 alg_type(int alg)
688 {
689 
690 	if (alg < nitems(alg_types))
691 		return (alg_types[alg]);
692 	return (ALG_NONE);
693 }
694 
695 static bool
696 alg_is_compression(int alg)
697 {
698 
699 	return (alg_type(alg) == ALG_COMPRESSION);
700 }
701 
702 static bool
703 alg_is_cipher(int alg)
704 {
705 
706 	return (alg_type(alg) == ALG_CIPHER);
707 }
708 
709 static bool
710 alg_is_digest(int alg)
711 {
712 
713 	return (alg_type(alg) == ALG_DIGEST ||
714 	    alg_type(alg) == ALG_KEYED_DIGEST);
715 }
716 
717 static bool
718 alg_is_keyed_digest(int alg)
719 {
720 
721 	return (alg_type(alg) == ALG_KEYED_DIGEST);
722 }
723 
724 static bool
725 alg_is_aead(int alg)
726 {
727 
728 	return (alg_type(alg) == ALG_AEAD);
729 }
730 
731 static bool
732 ccm_tag_length_valid(int len)
733 {
734 	/* RFC 3610 */
735 	switch (len) {
736 	case 4:
737 	case 6:
738 	case 8:
739 	case 10:
740 	case 12:
741 	case 14:
742 	case 16:
743 		return (true);
744 	default:
745 		return (false);
746 	}
747 }
748 
749 #define SUPPORTED_SES (CSP_F_SEPARATE_OUTPUT | CSP_F_SEPARATE_AAD | CSP_F_ESN)
750 
751 /* Various sanity checks on crypto session parameters. */
752 static bool
753 check_csp(const struct crypto_session_params *csp)
754 {
755 	const struct auth_hash *axf;
756 
757 	/* Mode-independent checks. */
758 	if ((csp->csp_flags & ~(SUPPORTED_SES)) != 0)
759 		return (false);
760 	if (csp->csp_ivlen < 0 || csp->csp_cipher_klen < 0 ||
761 	    csp->csp_auth_klen < 0 || csp->csp_auth_mlen < 0)
762 		return (false);
763 	if (csp->csp_auth_key != NULL && csp->csp_auth_klen == 0)
764 		return (false);
765 	if (csp->csp_cipher_key != NULL && csp->csp_cipher_klen == 0)
766 		return (false);
767 
768 	switch (csp->csp_mode) {
769 	case CSP_MODE_COMPRESS:
770 		if (!alg_is_compression(csp->csp_cipher_alg))
771 			return (false);
772 		if (csp->csp_flags & CSP_F_SEPARATE_OUTPUT)
773 			return (false);
774 		if (csp->csp_flags & CSP_F_SEPARATE_AAD)
775 			return (false);
776 		if (csp->csp_cipher_klen != 0 || csp->csp_ivlen != 0 ||
777 		    csp->csp_auth_alg != 0 || csp->csp_auth_klen != 0 ||
778 		    csp->csp_auth_mlen != 0)
779 			return (false);
780 		break;
781 	case CSP_MODE_CIPHER:
782 		if (!alg_is_cipher(csp->csp_cipher_alg))
783 			return (false);
784 		if (csp->csp_flags & CSP_F_SEPARATE_AAD)
785 			return (false);
786 		if (csp->csp_cipher_alg != CRYPTO_NULL_CBC) {
787 			if (csp->csp_cipher_klen == 0)
788 				return (false);
789 			if (csp->csp_ivlen == 0)
790 				return (false);
791 		}
792 		if (csp->csp_ivlen >= EALG_MAX_BLOCK_LEN)
793 			return (false);
794 		if (csp->csp_auth_alg != 0 || csp->csp_auth_klen != 0 ||
795 		    csp->csp_auth_mlen != 0)
796 			return (false);
797 		break;
798 	case CSP_MODE_DIGEST:
799 		if (csp->csp_cipher_alg != 0 || csp->csp_cipher_klen != 0)
800 			return (false);
801 
802 		if (csp->csp_flags & CSP_F_SEPARATE_AAD)
803 			return (false);
804 
805 		/* IV is optional for digests (e.g. GMAC). */
806 		switch (csp->csp_auth_alg) {
807 		case CRYPTO_AES_CCM_CBC_MAC:
808 			if (csp->csp_ivlen < 7 || csp->csp_ivlen > 13)
809 				return (false);
810 			break;
811 		case CRYPTO_AES_NIST_GMAC:
812 			if (csp->csp_ivlen != AES_GCM_IV_LEN)
813 				return (false);
814 			break;
815 		default:
816 			if (csp->csp_ivlen != 0)
817 				return (false);
818 			break;
819 		}
820 
821 		if (!alg_is_digest(csp->csp_auth_alg))
822 			return (false);
823 
824 		/* Key is optional for BLAKE2 digests. */
825 		if (csp->csp_auth_alg == CRYPTO_BLAKE2B ||
826 		    csp->csp_auth_alg == CRYPTO_BLAKE2S)
827 			;
828 		else if (alg_is_keyed_digest(csp->csp_auth_alg)) {
829 			if (csp->csp_auth_klen == 0)
830 				return (false);
831 		} else {
832 			if (csp->csp_auth_klen != 0)
833 				return (false);
834 		}
835 		if (csp->csp_auth_mlen != 0) {
836 			axf = crypto_auth_hash(csp);
837 			if (axf == NULL || csp->csp_auth_mlen > axf->hashsize)
838 				return (false);
839 
840 			if (csp->csp_auth_alg == CRYPTO_AES_CCM_CBC_MAC &&
841 			    !ccm_tag_length_valid(csp->csp_auth_mlen))
842 				return (false);
843 		}
844 		break;
845 	case CSP_MODE_AEAD:
846 		if (!alg_is_aead(csp->csp_cipher_alg))
847 			return (false);
848 		if (csp->csp_cipher_klen == 0)
849 			return (false);
850 		if (csp->csp_ivlen == 0 ||
851 		    csp->csp_ivlen >= EALG_MAX_BLOCK_LEN)
852 			return (false);
853 		if (csp->csp_auth_alg != 0 || csp->csp_auth_klen != 0)
854 			return (false);
855 
856 		switch (csp->csp_cipher_alg) {
857 		case CRYPTO_AES_CCM_16:
858 			if (csp->csp_auth_mlen != 0 &&
859 			    !ccm_tag_length_valid(csp->csp_auth_mlen))
860 				return (false);
861 
862 			if (csp->csp_ivlen < 7 || csp->csp_ivlen > 13)
863 				return (false);
864 			break;
865 		case CRYPTO_AES_NIST_GCM_16:
866 			if (csp->csp_auth_mlen > AES_GMAC_HASH_LEN)
867 				return (false);
868 
869 			if (csp->csp_ivlen != AES_GCM_IV_LEN)
870 				return (false);
871 			break;
872 		case CRYPTO_CHACHA20_POLY1305:
873 			if (csp->csp_ivlen != 8 && csp->csp_ivlen != 12)
874 				return (false);
875 			if (csp->csp_auth_mlen > POLY1305_HASH_LEN)
876 				return (false);
877 			break;
878 		case CRYPTO_XCHACHA20_POLY1305:
879 			if (csp->csp_ivlen != XCHACHA20_POLY1305_IV_LEN)
880 				return (false);
881 			if (csp->csp_auth_mlen > POLY1305_HASH_LEN)
882 				return (false);
883 			break;
884 		}
885 		break;
886 	case CSP_MODE_ETA:
887 		if (!alg_is_cipher(csp->csp_cipher_alg))
888 			return (false);
889 		if (csp->csp_cipher_alg != CRYPTO_NULL_CBC) {
890 			if (csp->csp_cipher_klen == 0)
891 				return (false);
892 			if (csp->csp_ivlen == 0)
893 				return (false);
894 		}
895 		if (csp->csp_ivlen >= EALG_MAX_BLOCK_LEN)
896 			return (false);
897 		if (!alg_is_digest(csp->csp_auth_alg))
898 			return (false);
899 
900 		/* Key is optional for BLAKE2 digests. */
901 		if (csp->csp_auth_alg == CRYPTO_BLAKE2B ||
902 		    csp->csp_auth_alg == CRYPTO_BLAKE2S)
903 			;
904 		else if (alg_is_keyed_digest(csp->csp_auth_alg)) {
905 			if (csp->csp_auth_klen == 0)
906 				return (false);
907 		} else {
908 			if (csp->csp_auth_klen != 0)
909 				return (false);
910 		}
911 		if (csp->csp_auth_mlen != 0) {
912 			axf = crypto_auth_hash(csp);
913 			if (axf == NULL || csp->csp_auth_mlen > axf->hashsize)
914 				return (false);
915 		}
916 		break;
917 	default:
918 		return (false);
919 	}
920 
921 	return (true);
922 }
923 
924 /*
925  * Delete a session after it has been detached from its driver.
926  */
927 static void
928 crypto_deletesession(crypto_session_t cses)
929 {
930 	struct cryptocap *cap;
931 
932 	cap = cses->cap;
933 
934 	zfree(cses, M_CRYPTO_DATA);
935 
936 	CRYPTO_DRIVER_LOCK();
937 	cap->cc_sessions--;
938 	if (cap->cc_sessions == 0 && cap->cc_flags & CRYPTOCAP_F_CLEANUP)
939 		wakeup(cap);
940 	CRYPTO_DRIVER_UNLOCK();
941 	cap_rele(cap);
942 }
943 
944 /*
945  * Create a new session.  The crid argument specifies a crypto
946  * driver to use or constraints on a driver to select (hardware
947  * only, software only, either).  Whatever driver is selected
948  * must be capable of the requested crypto algorithms.
949  */
950 int
951 crypto_newsession(crypto_session_t *cses,
952     const struct crypto_session_params *csp, int crid)
953 {
954 	static uint64_t sessid = 0;
955 	crypto_session_t res;
956 	struct cryptocap *cap;
957 	int err;
958 
959 	if (!check_csp(csp))
960 		return (EINVAL);
961 
962 	res = NULL;
963 
964 	CRYPTO_DRIVER_LOCK();
965 	if ((crid & (CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE)) == 0) {
966 		/*
967 		 * Use specified driver; verify it is capable.
968 		 */
969 		cap = crypto_checkdriver(crid);
970 		if (cap != NULL && CRYPTODEV_PROBESESSION(cap->cc_dev, csp) > 0)
971 			cap = NULL;
972 	} else {
973 		/*
974 		 * No requested driver; select based on crid flags.
975 		 */
976 		cap = crypto_select_driver(csp, crid);
977 	}
978 	if (cap == NULL) {
979 		CRYPTO_DRIVER_UNLOCK();
980 		CRYPTDEB("no driver");
981 		return (EOPNOTSUPP);
982 	}
983 	cap_ref(cap);
984 	cap->cc_sessions++;
985 	CRYPTO_DRIVER_UNLOCK();
986 
987 	/* Allocate a single block for the generic session and driver softc. */
988 	res = malloc(sizeof(*res) + cap->cc_session_size, M_CRYPTO_DATA,
989 	    M_WAITOK | M_ZERO);
990 	res->cap = cap;
991 	res->csp = *csp;
992 	res->id = atomic_fetchadd_64(&sessid, 1);
993 
994 	/* Call the driver initialization routine. */
995 	err = CRYPTODEV_NEWSESSION(cap->cc_dev, res, csp);
996 	if (err != 0) {
997 		CRYPTDEB("dev newsession failed: %d", err);
998 		crypto_deletesession(res);
999 		return (err);
1000 	}
1001 
1002 	*cses = res;
1003 	return (0);
1004 }
1005 
1006 /*
1007  * Delete an existing session (or a reserved session on an unregistered
1008  * driver).
1009  */
1010 void
1011 crypto_freesession(crypto_session_t cses)
1012 {
1013 	struct cryptocap *cap;
1014 
1015 	if (cses == NULL)
1016 		return;
1017 
1018 	cap = cses->cap;
1019 
1020 	/* Call the driver cleanup routine, if available. */
1021 	CRYPTODEV_FREESESSION(cap->cc_dev, cses);
1022 
1023 	crypto_deletesession(cses);
1024 }
1025 
1026 /*
1027  * Return a new driver id.  Registers a driver with the system so that
1028  * it can be probed by subsequent sessions.
1029  */
1030 int32_t
1031 crypto_get_driverid(device_t dev, size_t sessionsize, int flags)
1032 {
1033 	struct cryptocap *cap, **newdrv;
1034 	int i;
1035 
1036 	if ((flags & (CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE)) == 0) {
1037 		device_printf(dev,
1038 		    "no flags specified when registering driver\n");
1039 		return -1;
1040 	}
1041 
1042 	cap = malloc(sizeof(*cap), M_CRYPTO_DATA, M_WAITOK | M_ZERO);
1043 	cap->cc_dev = dev;
1044 	cap->cc_session_size = sessionsize;
1045 	cap->cc_flags = flags;
1046 	refcount_init(&cap->cc_refs, 1);
1047 
1048 	CRYPTO_DRIVER_LOCK();
1049 	for (;;) {
1050 		for (i = 0; i < crypto_drivers_size; i++) {
1051 			if (crypto_drivers[i] == NULL)
1052 				break;
1053 		}
1054 
1055 		if (i < crypto_drivers_size)
1056 			break;
1057 
1058 		/* Out of entries, allocate some more. */
1059 
1060 		if (2 * crypto_drivers_size <= crypto_drivers_size) {
1061 			CRYPTO_DRIVER_UNLOCK();
1062 			printf("crypto: driver count wraparound!\n");
1063 			cap_rele(cap);
1064 			return (-1);
1065 		}
1066 		CRYPTO_DRIVER_UNLOCK();
1067 
1068 		newdrv = malloc(2 * crypto_drivers_size *
1069 		    sizeof(*crypto_drivers), M_CRYPTO_DATA, M_WAITOK | M_ZERO);
1070 
1071 		CRYPTO_DRIVER_LOCK();
1072 		memcpy(newdrv, crypto_drivers,
1073 		    crypto_drivers_size * sizeof(*crypto_drivers));
1074 
1075 		crypto_drivers_size *= 2;
1076 
1077 		free(crypto_drivers, M_CRYPTO_DATA);
1078 		crypto_drivers = newdrv;
1079 	}
1080 
1081 	cap->cc_hid = i;
1082 	crypto_drivers[i] = cap;
1083 	CRYPTO_DRIVER_UNLOCK();
1084 
1085 	if (bootverbose)
1086 		printf("crypto: assign %s driver id %u, flags 0x%x\n",
1087 		    device_get_nameunit(dev), i, flags);
1088 
1089 	return i;
1090 }
1091 
1092 /*
1093  * Lookup a driver by name.  We match against the full device
1094  * name and unit, and against just the name.  The latter gives
1095  * us a simple widlcarding by device name.  On success return the
1096  * driver/hardware identifier; otherwise return -1.
1097  */
1098 int
1099 crypto_find_driver(const char *match)
1100 {
1101 	struct cryptocap *cap;
1102 	int i, len = strlen(match);
1103 
1104 	CRYPTO_DRIVER_LOCK();
1105 	for (i = 0; i < crypto_drivers_size; i++) {
1106 		if (crypto_drivers[i] == NULL)
1107 			continue;
1108 		cap = crypto_drivers[i];
1109 		if (strncmp(match, device_get_nameunit(cap->cc_dev), len) == 0 ||
1110 		    strncmp(match, device_get_name(cap->cc_dev), len) == 0) {
1111 			CRYPTO_DRIVER_UNLOCK();
1112 			return (i);
1113 		}
1114 	}
1115 	CRYPTO_DRIVER_UNLOCK();
1116 	return (-1);
1117 }
1118 
1119 /*
1120  * Return the device_t for the specified driver or NULL
1121  * if the driver identifier is invalid.
1122  */
1123 device_t
1124 crypto_find_device_byhid(int hid)
1125 {
1126 	struct cryptocap *cap;
1127 	device_t dev;
1128 
1129 	dev = NULL;
1130 	CRYPTO_DRIVER_LOCK();
1131 	cap = crypto_checkdriver(hid);
1132 	if (cap != NULL)
1133 		dev = cap->cc_dev;
1134 	CRYPTO_DRIVER_UNLOCK();
1135 	return (dev);
1136 }
1137 
1138 /*
1139  * Return the device/driver capabilities.
1140  */
1141 int
1142 crypto_getcaps(int hid)
1143 {
1144 	struct cryptocap *cap;
1145 	int flags;
1146 
1147 	flags = 0;
1148 	CRYPTO_DRIVER_LOCK();
1149 	cap = crypto_checkdriver(hid);
1150 	if (cap != NULL)
1151 		flags = cap->cc_flags;
1152 	CRYPTO_DRIVER_UNLOCK();
1153 	return (flags);
1154 }
1155 
1156 /*
1157  * Unregister all algorithms associated with a crypto driver.
1158  * If there are pending sessions using it, leave enough information
1159  * around so that subsequent calls using those sessions will
1160  * correctly detect the driver has been unregistered and reroute
1161  * requests.
1162  */
1163 int
1164 crypto_unregister_all(uint32_t driverid)
1165 {
1166 	struct cryptocap *cap;
1167 
1168 	CRYPTO_DRIVER_LOCK();
1169 	cap = crypto_checkdriver(driverid);
1170 	if (cap == NULL) {
1171 		CRYPTO_DRIVER_UNLOCK();
1172 		return (EINVAL);
1173 	}
1174 
1175 	cap->cc_flags |= CRYPTOCAP_F_CLEANUP;
1176 	crypto_drivers[driverid] = NULL;
1177 
1178 	/*
1179 	 * XXX: This doesn't do anything to kick sessions that
1180 	 * have no pending operations.
1181 	 */
1182 	while (cap->cc_sessions != 0)
1183 		mtx_sleep(cap, &crypto_drivers_mtx, 0, "cryunreg", 0);
1184 	CRYPTO_DRIVER_UNLOCK();
1185 	cap_rele(cap);
1186 
1187 	return (0);
1188 }
1189 
1190 /*
1191  * Clear blockage on a driver.  The what parameter indicates whether
1192  * the driver is now ready for cryptop's and/or cryptokop's.
1193  */
1194 int
1195 crypto_unblock(uint32_t driverid, int what)
1196 {
1197 	struct cryptocap *cap;
1198 	int err;
1199 
1200 	CRYPTO_Q_LOCK();
1201 	cap = crypto_checkdriver(driverid);
1202 	if (cap != NULL) {
1203 		if (what & CRYPTO_SYMQ)
1204 			cap->cc_qblocked = 0;
1205 		if (crp_sleep)
1206 			wakeup_one(&crp_q);
1207 		err = 0;
1208 	} else
1209 		err = EINVAL;
1210 	CRYPTO_Q_UNLOCK();
1211 
1212 	return err;
1213 }
1214 
1215 size_t
1216 crypto_buffer_len(struct crypto_buffer *cb)
1217 {
1218 	switch (cb->cb_type) {
1219 	case CRYPTO_BUF_CONTIG:
1220 		return (cb->cb_buf_len);
1221 	case CRYPTO_BUF_MBUF:
1222 		if (cb->cb_mbuf->m_flags & M_PKTHDR)
1223 			return (cb->cb_mbuf->m_pkthdr.len);
1224 		return (m_length(cb->cb_mbuf, NULL));
1225 	case CRYPTO_BUF_SINGLE_MBUF:
1226 		return (cb->cb_mbuf->m_len);
1227 	case CRYPTO_BUF_VMPAGE:
1228 		return (cb->cb_vm_page_len);
1229 	case CRYPTO_BUF_UIO:
1230 		return (cb->cb_uio->uio_resid);
1231 	default:
1232 		return (0);
1233 	}
1234 }
1235 
1236 #ifdef INVARIANTS
1237 /* Various sanity checks on crypto requests. */
1238 static void
1239 cb_sanity(struct crypto_buffer *cb, const char *name)
1240 {
1241 	KASSERT(cb->cb_type > CRYPTO_BUF_NONE && cb->cb_type <= CRYPTO_BUF_LAST,
1242 	    ("incoming crp with invalid %s buffer type", name));
1243 	switch (cb->cb_type) {
1244 	case CRYPTO_BUF_CONTIG:
1245 		KASSERT(cb->cb_buf_len >= 0,
1246 		    ("incoming crp with -ve %s buffer length", name));
1247 		break;
1248 	case CRYPTO_BUF_VMPAGE:
1249 		KASSERT(CRYPTO_HAS_VMPAGE,
1250 		    ("incoming crp uses dmap on supported arch"));
1251 		KASSERT(cb->cb_vm_page_len >= 0,
1252 		    ("incoming crp with -ve %s buffer length", name));
1253 		KASSERT(cb->cb_vm_page_offset >= 0,
1254 		    ("incoming crp with -ve %s buffer offset", name));
1255 		KASSERT(cb->cb_vm_page_offset < PAGE_SIZE,
1256 		    ("incoming crp with %s buffer offset greater than page size"
1257 		     , name));
1258 		break;
1259 	default:
1260 		break;
1261 	}
1262 }
1263 
1264 static void
1265 crp_sanity(struct cryptop *crp)
1266 {
1267 	struct crypto_session_params *csp;
1268 	struct crypto_buffer *out;
1269 	size_t ilen, len, olen;
1270 
1271 	KASSERT(crp->crp_session != NULL, ("incoming crp without a session"));
1272 	KASSERT(crp->crp_obuf.cb_type >= CRYPTO_BUF_NONE &&
1273 	    crp->crp_obuf.cb_type <= CRYPTO_BUF_LAST,
1274 	    ("incoming crp with invalid output buffer type"));
1275 	KASSERT(crp->crp_etype == 0, ("incoming crp with error"));
1276 	KASSERT(!(crp->crp_flags & CRYPTO_F_DONE),
1277 	    ("incoming crp already done"));
1278 
1279 	csp = &crp->crp_session->csp;
1280 	cb_sanity(&crp->crp_buf, "input");
1281 	ilen = crypto_buffer_len(&crp->crp_buf);
1282 	olen = ilen;
1283 	out = NULL;
1284 	if (csp->csp_flags & CSP_F_SEPARATE_OUTPUT) {
1285 		if (crp->crp_obuf.cb_type != CRYPTO_BUF_NONE) {
1286 			cb_sanity(&crp->crp_obuf, "output");
1287 			out = &crp->crp_obuf;
1288 			olen = crypto_buffer_len(out);
1289 		}
1290 	} else
1291 		KASSERT(crp->crp_obuf.cb_type == CRYPTO_BUF_NONE,
1292 		    ("incoming crp with separate output buffer "
1293 		    "but no session support"));
1294 
1295 	switch (csp->csp_mode) {
1296 	case CSP_MODE_COMPRESS:
1297 		KASSERT(crp->crp_op == CRYPTO_OP_COMPRESS ||
1298 		    crp->crp_op == CRYPTO_OP_DECOMPRESS,
1299 		    ("invalid compression op %x", crp->crp_op));
1300 		break;
1301 	case CSP_MODE_CIPHER:
1302 		KASSERT(crp->crp_op == CRYPTO_OP_ENCRYPT ||
1303 		    crp->crp_op == CRYPTO_OP_DECRYPT,
1304 		    ("invalid cipher op %x", crp->crp_op));
1305 		break;
1306 	case CSP_MODE_DIGEST:
1307 		KASSERT(crp->crp_op == CRYPTO_OP_COMPUTE_DIGEST ||
1308 		    crp->crp_op == CRYPTO_OP_VERIFY_DIGEST,
1309 		    ("invalid digest op %x", crp->crp_op));
1310 		break;
1311 	case CSP_MODE_AEAD:
1312 		KASSERT(crp->crp_op ==
1313 		    (CRYPTO_OP_ENCRYPT | CRYPTO_OP_COMPUTE_DIGEST) ||
1314 		    crp->crp_op ==
1315 		    (CRYPTO_OP_DECRYPT | CRYPTO_OP_VERIFY_DIGEST),
1316 		    ("invalid AEAD op %x", crp->crp_op));
1317 		KASSERT(crp->crp_flags & CRYPTO_F_IV_SEPARATE,
1318 		    ("AEAD without a separate IV"));
1319 		break;
1320 	case CSP_MODE_ETA:
1321 		KASSERT(crp->crp_op ==
1322 		    (CRYPTO_OP_ENCRYPT | CRYPTO_OP_COMPUTE_DIGEST) ||
1323 		    crp->crp_op ==
1324 		    (CRYPTO_OP_DECRYPT | CRYPTO_OP_VERIFY_DIGEST),
1325 		    ("invalid ETA op %x", crp->crp_op));
1326 		break;
1327 	}
1328 	if (csp->csp_mode == CSP_MODE_AEAD || csp->csp_mode == CSP_MODE_ETA) {
1329 		if (crp->crp_aad == NULL) {
1330 			KASSERT(crp->crp_aad_start == 0 ||
1331 			    crp->crp_aad_start < ilen,
1332 			    ("invalid AAD start"));
1333 			KASSERT(crp->crp_aad_length != 0 ||
1334 			    crp->crp_aad_start == 0,
1335 			    ("AAD with zero length and non-zero start"));
1336 			KASSERT(crp->crp_aad_length == 0 ||
1337 			    crp->crp_aad_start + crp->crp_aad_length <= ilen,
1338 			    ("AAD outside input length"));
1339 		} else {
1340 			KASSERT(csp->csp_flags & CSP_F_SEPARATE_AAD,
1341 			    ("session doesn't support separate AAD buffer"));
1342 			KASSERT(crp->crp_aad_start == 0,
1343 			    ("separate AAD buffer with non-zero AAD start"));
1344 			KASSERT(crp->crp_aad_length != 0,
1345 			    ("separate AAD buffer with zero length"));
1346 		}
1347 	} else {
1348 		KASSERT(crp->crp_aad == NULL && crp->crp_aad_start == 0 &&
1349 		    crp->crp_aad_length == 0,
1350 		    ("AAD region in request not supporting AAD"));
1351 	}
1352 	if (csp->csp_ivlen == 0) {
1353 		KASSERT((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0,
1354 		    ("IV_SEPARATE set when IV isn't used"));
1355 		KASSERT(crp->crp_iv_start == 0,
1356 		    ("crp_iv_start set when IV isn't used"));
1357 	} else if (crp->crp_flags & CRYPTO_F_IV_SEPARATE) {
1358 		KASSERT(crp->crp_iv_start == 0,
1359 		    ("IV_SEPARATE used with non-zero IV start"));
1360 	} else {
1361 		KASSERT(crp->crp_iv_start < ilen,
1362 		    ("invalid IV start"));
1363 		KASSERT(crp->crp_iv_start + csp->csp_ivlen <= ilen,
1364 		    ("IV outside buffer length"));
1365 	}
1366 	/* XXX: payload_start of 0 should always be < ilen? */
1367 	KASSERT(crp->crp_payload_start == 0 ||
1368 	    crp->crp_payload_start < ilen,
1369 	    ("invalid payload start"));
1370 	KASSERT(crp->crp_payload_start + crp->crp_payload_length <=
1371 	    ilen, ("payload outside input buffer"));
1372 	if (out == NULL) {
1373 		KASSERT(crp->crp_payload_output_start == 0,
1374 		    ("payload output start non-zero without output buffer"));
1375 	} else {
1376 		KASSERT(crp->crp_payload_output_start == 0 ||
1377 		    crp->crp_payload_output_start < olen,
1378 		    ("invalid payload output start"));
1379 		KASSERT(crp->crp_payload_output_start +
1380 		    crp->crp_payload_length <= olen,
1381 		    ("payload outside output buffer"));
1382 	}
1383 	if (csp->csp_mode == CSP_MODE_DIGEST ||
1384 	    csp->csp_mode == CSP_MODE_AEAD || csp->csp_mode == CSP_MODE_ETA) {
1385 		if (crp->crp_op & CRYPTO_OP_VERIFY_DIGEST)
1386 			len = ilen;
1387 		else
1388 			len = olen;
1389 		KASSERT(crp->crp_digest_start == 0 ||
1390 		    crp->crp_digest_start < len,
1391 		    ("invalid digest start"));
1392 		/* XXX: For the mlen == 0 case this check isn't perfect. */
1393 		KASSERT(crp->crp_digest_start + csp->csp_auth_mlen <= len,
1394 		    ("digest outside buffer"));
1395 	} else {
1396 		KASSERT(crp->crp_digest_start == 0,
1397 		    ("non-zero digest start for request without a digest"));
1398 	}
1399 	if (csp->csp_cipher_klen != 0)
1400 		KASSERT(csp->csp_cipher_key != NULL ||
1401 		    crp->crp_cipher_key != NULL,
1402 		    ("cipher request without a key"));
1403 	if (csp->csp_auth_klen != 0)
1404 		KASSERT(csp->csp_auth_key != NULL || crp->crp_auth_key != NULL,
1405 		    ("auth request without a key"));
1406 	KASSERT(crp->crp_callback != NULL, ("incoming crp without callback"));
1407 }
1408 #endif
1409 
1410 static int
1411 crypto_dispatch_one(struct cryptop *crp, int hint)
1412 {
1413 	struct cryptocap *cap;
1414 	int result;
1415 
1416 #ifdef INVARIANTS
1417 	crp_sanity(crp);
1418 #endif
1419 	CRYPTOSTAT_INC(cs_ops);
1420 
1421 	crp->crp_retw_id = crp->crp_session->id % crypto_workers_num;
1422 
1423 	/*
1424 	 * Caller marked the request to be processed immediately; dispatch it
1425 	 * directly to the driver unless the driver is currently blocked, in
1426 	 * which case it is queued for deferred dispatch.
1427 	 */
1428 	cap = crp->crp_session->cap;
1429 	if (!atomic_load_int(&cap->cc_qblocked)) {
1430 		result = crypto_invoke(cap, crp, hint);
1431 		if (result != ERESTART)
1432 			return (result);
1433 
1434 		/*
1435 		 * The driver ran out of resources, put the request on the
1436 		 * queue.
1437 		 */
1438 	}
1439 	crypto_batch_enqueue(crp);
1440 	return (0);
1441 }
1442 
1443 int
1444 crypto_dispatch(struct cryptop *crp)
1445 {
1446 	return (crypto_dispatch_one(crp, 0));
1447 }
1448 
1449 int
1450 crypto_dispatch_async(struct cryptop *crp, int flags)
1451 {
1452 	struct crypto_ret_worker *ret_worker;
1453 
1454 	if (!CRYPTO_SESS_SYNC(crp->crp_session)) {
1455 		/*
1456 		 * The driver issues completions asynchonously, don't bother
1457 		 * deferring dispatch to a worker thread.
1458 		 */
1459 		return (crypto_dispatch(crp));
1460 	}
1461 
1462 #ifdef INVARIANTS
1463 	crp_sanity(crp);
1464 #endif
1465 	CRYPTOSTAT_INC(cs_ops);
1466 
1467 	crp->crp_retw_id = crp->crp_session->id % crypto_workers_num;
1468 	if ((flags & CRYPTO_ASYNC_ORDERED) != 0) {
1469 		crp->crp_flags |= CRYPTO_F_ASYNC_ORDERED;
1470 		ret_worker = CRYPTO_RETW(crp->crp_retw_id);
1471 		CRYPTO_RETW_LOCK(ret_worker);
1472 		crp->crp_seq = ret_worker->reorder_ops++;
1473 		CRYPTO_RETW_UNLOCK(ret_worker);
1474 	}
1475 	TASK_INIT(&crp->crp_task, 0, crypto_task_invoke, crp);
1476 	taskqueue_enqueue(crypto_tq, &crp->crp_task);
1477 	return (0);
1478 }
1479 
1480 void
1481 crypto_dispatch_batch(struct cryptopq *crpq, int flags)
1482 {
1483 	struct cryptop *crp;
1484 	int hint;
1485 
1486 	while ((crp = TAILQ_FIRST(crpq)) != NULL) {
1487 		hint = TAILQ_NEXT(crp, crp_next) != NULL ? CRYPTO_HINT_MORE : 0;
1488 		TAILQ_REMOVE(crpq, crp, crp_next);
1489 		if (crypto_dispatch_one(crp, hint) != 0)
1490 			crypto_batch_enqueue(crp);
1491 	}
1492 }
1493 
1494 static void
1495 crypto_batch_enqueue(struct cryptop *crp)
1496 {
1497 
1498 	CRYPTO_Q_LOCK();
1499 	TAILQ_INSERT_TAIL(&crp_q, crp, crp_next);
1500 	if (crp_sleep)
1501 		wakeup_one(&crp_q);
1502 	CRYPTO_Q_UNLOCK();
1503 }
1504 
1505 static void
1506 crypto_task_invoke(void *ctx, int pending)
1507 {
1508 	struct cryptocap *cap;
1509 	struct cryptop *crp;
1510 	int result;
1511 
1512 	crp = (struct cryptop *)ctx;
1513 	cap = crp->crp_session->cap;
1514 	result = crypto_invoke(cap, crp, 0);
1515 	if (result == ERESTART)
1516 		crypto_batch_enqueue(crp);
1517 }
1518 
1519 /*
1520  * Dispatch a crypto request to the appropriate crypto devices.
1521  */
1522 static int
1523 crypto_invoke(struct cryptocap *cap, struct cryptop *crp, int hint)
1524 {
1525 
1526 	KASSERT(crp != NULL, ("%s: crp == NULL", __func__));
1527 	KASSERT(crp->crp_callback != NULL,
1528 	    ("%s: crp->crp_callback == NULL", __func__));
1529 	KASSERT(crp->crp_session != NULL,
1530 	    ("%s: crp->crp_session == NULL", __func__));
1531 
1532 	if (cap->cc_flags & CRYPTOCAP_F_CLEANUP) {
1533 		struct crypto_session_params csp;
1534 		crypto_session_t nses;
1535 
1536 		/*
1537 		 * Driver has unregistered; migrate the session and return
1538 		 * an error to the caller so they'll resubmit the op.
1539 		 *
1540 		 * XXX: What if there are more already queued requests for this
1541 		 *      session?
1542 		 *
1543 		 * XXX: Real solution is to make sessions refcounted
1544 		 * and force callers to hold a reference when
1545 		 * assigning to crp_session.  Could maybe change
1546 		 * crypto_getreq to accept a session pointer to make
1547 		 * that work.  Alternatively, we could abandon the
1548 		 * notion of rewriting crp_session in requests forcing
1549 		 * the caller to deal with allocating a new session.
1550 		 * Perhaps provide a method to allow a crp's session to
1551 		 * be swapped that callers could use.
1552 		 */
1553 		csp = crp->crp_session->csp;
1554 		crypto_freesession(crp->crp_session);
1555 
1556 		/*
1557 		 * XXX: Key pointers may no longer be valid.  If we
1558 		 * really want to support this we need to define the
1559 		 * KPI such that 'csp' is required to be valid for the
1560 		 * duration of a session by the caller perhaps.
1561 		 *
1562 		 * XXX: If the keys have been changed this will reuse
1563 		 * the old keys.  This probably suggests making
1564 		 * rekeying more explicit and updating the key
1565 		 * pointers in 'csp' when the keys change.
1566 		 */
1567 		if (crypto_newsession(&nses, &csp,
1568 		    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE) == 0)
1569 			crp->crp_session = nses;
1570 
1571 		crp->crp_etype = EAGAIN;
1572 		crypto_done(crp);
1573 		return 0;
1574 	} else {
1575 		/*
1576 		 * Invoke the driver to process the request.
1577 		 */
1578 		return CRYPTODEV_PROCESS(cap->cc_dev, crp, hint);
1579 	}
1580 }
1581 
1582 void
1583 crypto_destroyreq(struct cryptop *crp)
1584 {
1585 #ifdef DIAGNOSTIC
1586 	{
1587 		struct cryptop *crp2;
1588 		struct crypto_ret_worker *ret_worker;
1589 
1590 		if (!crypto_destroyreq_check)
1591 			return;
1592 
1593 		CRYPTO_Q_LOCK();
1594 		TAILQ_FOREACH(crp2, &crp_q, crp_next) {
1595 			KASSERT(crp2 != crp,
1596 			    ("Freeing cryptop from the crypto queue (%p).",
1597 			    crp));
1598 		}
1599 		CRYPTO_Q_UNLOCK();
1600 
1601 		FOREACH_CRYPTO_RETW(ret_worker) {
1602 			CRYPTO_RETW_LOCK(ret_worker);
1603 			TAILQ_FOREACH(crp2, &ret_worker->crp_ret_q, crp_next) {
1604 				KASSERT(crp2 != crp,
1605 				    ("Freeing cryptop from the return queue (%p).",
1606 				    crp));
1607 			}
1608 			CRYPTO_RETW_UNLOCK(ret_worker);
1609 		}
1610 	}
1611 #endif
1612 }
1613 
1614 void
1615 crypto_freereq(struct cryptop *crp)
1616 {
1617 	if (crp == NULL)
1618 		return;
1619 
1620 	crypto_destroyreq(crp);
1621 	uma_zfree(cryptop_zone, crp);
1622 }
1623 
1624 static void
1625 _crypto_initreq(struct cryptop *crp, crypto_session_t cses)
1626 {
1627 	crp->crp_session = cses;
1628 }
1629 
1630 void
1631 crypto_initreq(struct cryptop *crp, crypto_session_t cses)
1632 {
1633 	memset(crp, 0, sizeof(*crp));
1634 	_crypto_initreq(crp, cses);
1635 }
1636 
1637 struct cryptop *
1638 crypto_getreq(crypto_session_t cses, int how)
1639 {
1640 	struct cryptop *crp;
1641 
1642 	MPASS(how == M_WAITOK || how == M_NOWAIT);
1643 	crp = uma_zalloc(cryptop_zone, how | M_ZERO);
1644 	if (crp != NULL)
1645 		_crypto_initreq(crp, cses);
1646 	return (crp);
1647 }
1648 
1649 /*
1650  * Clone a crypto request, but associate it with the specified session
1651  * rather than inheriting the session from the original request.  The
1652  * fields describing the request buffers are copied, but not the
1653  * opaque field or callback function.
1654  */
1655 struct cryptop *
1656 crypto_clonereq(struct cryptop *crp, crypto_session_t cses, int how)
1657 {
1658 	struct cryptop *new;
1659 
1660 	MPASS((crp->crp_flags & CRYPTO_F_DONE) == 0);
1661 	new = crypto_getreq(cses, how);
1662 	if (new == NULL)
1663 		return (NULL);
1664 
1665 	memcpy(&new->crp_startcopy, &crp->crp_startcopy,
1666 	    __rangeof(struct cryptop, crp_startcopy, crp_endcopy));
1667 	return (new);
1668 }
1669 
1670 /*
1671  * Invoke the callback on behalf of the driver.
1672  */
1673 void
1674 crypto_done(struct cryptop *crp)
1675 {
1676 	KASSERT((crp->crp_flags & CRYPTO_F_DONE) == 0,
1677 		("crypto_done: op already done, flags 0x%x", crp->crp_flags));
1678 	crp->crp_flags |= CRYPTO_F_DONE;
1679 	if (crp->crp_etype != 0)
1680 		CRYPTOSTAT_INC(cs_errs);
1681 
1682 	/*
1683 	 * CBIMM means unconditionally do the callback immediately;
1684 	 * CBIFSYNC means do the callback immediately only if the
1685 	 * operation was done synchronously.  Both are used to avoid
1686 	 * doing extraneous context switches; the latter is mostly
1687 	 * used with the software crypto driver.
1688 	 */
1689 	if ((crp->crp_flags & CRYPTO_F_ASYNC_ORDERED) == 0 &&
1690 	    ((crp->crp_flags & CRYPTO_F_CBIMM) != 0 ||
1691 	    ((crp->crp_flags & CRYPTO_F_CBIFSYNC) != 0 &&
1692 	    CRYPTO_SESS_SYNC(crp->crp_session)))) {
1693 		/*
1694 		 * Do the callback directly.  This is ok when the
1695 		 * callback routine does very little (e.g. the
1696 		 * /dev/crypto callback method just does a wakeup).
1697 		 */
1698 		crp->crp_callback(crp);
1699 	} else {
1700 		struct crypto_ret_worker *ret_worker;
1701 		bool wake;
1702 
1703 		ret_worker = CRYPTO_RETW(crp->crp_retw_id);
1704 
1705 		/*
1706 		 * Normal case; queue the callback for the thread.
1707 		 */
1708 		CRYPTO_RETW_LOCK(ret_worker);
1709 		if ((crp->crp_flags & CRYPTO_F_ASYNC_ORDERED) != 0) {
1710 			struct cryptop *tmp;
1711 
1712 			TAILQ_FOREACH_REVERSE(tmp,
1713 			    &ret_worker->crp_ordered_ret_q, cryptop_q,
1714 			    crp_next) {
1715 				if (CRYPTO_SEQ_GT(crp->crp_seq, tmp->crp_seq)) {
1716 					TAILQ_INSERT_AFTER(
1717 					    &ret_worker->crp_ordered_ret_q, tmp,
1718 					    crp, crp_next);
1719 					break;
1720 				}
1721 			}
1722 			if (tmp == NULL) {
1723 				TAILQ_INSERT_HEAD(
1724 				    &ret_worker->crp_ordered_ret_q, crp,
1725 				    crp_next);
1726 			}
1727 
1728 			wake = crp->crp_seq == ret_worker->reorder_cur_seq;
1729 		} else {
1730 			wake = TAILQ_EMPTY(&ret_worker->crp_ret_q);
1731 			TAILQ_INSERT_TAIL(&ret_worker->crp_ret_q, crp,
1732 			    crp_next);
1733 		}
1734 
1735 		if (wake)
1736 			wakeup_one(&ret_worker->crp_ret_q);	/* shared wait channel */
1737 		CRYPTO_RETW_UNLOCK(ret_worker);
1738 	}
1739 }
1740 
1741 /*
1742  * Terminate a thread at module unload.  The process that
1743  * initiated this is waiting for us to signal that we're gone;
1744  * wake it up and exit.  We use the driver table lock to insure
1745  * we don't do the wakeup before they're waiting.  There is no
1746  * race here because the waiter sleeps on the proc lock for the
1747  * thread so it gets notified at the right time because of an
1748  * extra wakeup that's done in exit1().
1749  */
1750 static void
1751 crypto_finis(void *chan)
1752 {
1753 	CRYPTO_DRIVER_LOCK();
1754 	wakeup_one(chan);
1755 	CRYPTO_DRIVER_UNLOCK();
1756 	kthread_exit();
1757 }
1758 
1759 /*
1760  * Crypto thread, dispatches crypto requests.
1761  */
1762 static void
1763 crypto_dispatch_thread(void *arg __unused)
1764 {
1765 	struct cryptop *crp, *submit;
1766 	struct cryptocap *cap;
1767 	int result, hint;
1768 
1769 #if defined(__i386__) || defined(__amd64__) || defined(__aarch64__)
1770 	fpu_kern_thread(FPU_KERN_NORMAL);
1771 #endif
1772 
1773 	CRYPTO_Q_LOCK();
1774 	for (;;) {
1775 		/*
1776 		 * Find the first element in the queue that can be
1777 		 * processed and look-ahead to see if multiple ops
1778 		 * are ready for the same driver.
1779 		 */
1780 		submit = NULL;
1781 		hint = 0;
1782 		TAILQ_FOREACH(crp, &crp_q, crp_next) {
1783 			cap = crp->crp_session->cap;
1784 			/*
1785 			 * Driver cannot disappeared when there is an active
1786 			 * session.
1787 			 */
1788 			KASSERT(cap != NULL, ("%s:%u Driver disappeared.",
1789 			    __func__, __LINE__));
1790 			if (cap->cc_flags & CRYPTOCAP_F_CLEANUP) {
1791 				/* Op needs to be migrated, process it. */
1792 				if (submit == NULL)
1793 					submit = crp;
1794 				break;
1795 			}
1796 			if (!cap->cc_qblocked) {
1797 				if (submit != NULL) {
1798 					/*
1799 					 * We stop on finding another op,
1800 					 * regardless whether its for the same
1801 					 * driver or not.  We could keep
1802 					 * searching the queue but it might be
1803 					 * better to just use a per-driver
1804 					 * queue instead.
1805 					 */
1806 					if (submit->crp_session->cap == cap)
1807 						hint = CRYPTO_HINT_MORE;
1808 				} else {
1809 					submit = crp;
1810 				}
1811 				break;
1812 			}
1813 		}
1814 		if (submit != NULL) {
1815 			TAILQ_REMOVE(&crp_q, submit, crp_next);
1816 			cap = submit->crp_session->cap;
1817 			KASSERT(cap != NULL, ("%s:%u Driver disappeared.",
1818 			    __func__, __LINE__));
1819 			CRYPTO_Q_UNLOCK();
1820 			result = crypto_invoke(cap, submit, hint);
1821 			CRYPTO_Q_LOCK();
1822 			if (result == ERESTART) {
1823 				/*
1824 				 * The driver ran out of resources, mark the
1825 				 * driver ``blocked'' for cryptop's and put
1826 				 * the request back in the queue.  It would
1827 				 * best to put the request back where we got
1828 				 * it but that's hard so for now we put it
1829 				 * at the front.  This should be ok; putting
1830 				 * it at the end does not work.
1831 				 */
1832 				cap->cc_qblocked = 1;
1833 				TAILQ_INSERT_HEAD(&crp_q, submit, crp_next);
1834 				CRYPTOSTAT_INC(cs_blocks);
1835 			}
1836 		} else {
1837 			/*
1838 			 * Nothing more to be processed.  Sleep until we're
1839 			 * woken because there are more ops to process.
1840 			 * This happens either by submission or by a driver
1841 			 * becoming unblocked and notifying us through
1842 			 * crypto_unblock.  Note that when we wakeup we
1843 			 * start processing each queue again from the
1844 			 * front. It's not clear that it's important to
1845 			 * preserve this ordering since ops may finish
1846 			 * out of order if dispatched to different devices
1847 			 * and some become blocked while others do not.
1848 			 */
1849 			crp_sleep = 1;
1850 			msleep(&crp_q, &crypto_q_mtx, PWAIT, "crypto_wait", 0);
1851 			crp_sleep = 0;
1852 			if (cryptotd == NULL)
1853 				break;
1854 			CRYPTOSTAT_INC(cs_intrs);
1855 		}
1856 	}
1857 	CRYPTO_Q_UNLOCK();
1858 
1859 	crypto_finis(&crp_q);
1860 }
1861 
1862 /*
1863  * Crypto returns thread, does callbacks for processed crypto requests.
1864  * Callbacks are done here, rather than in the crypto drivers, because
1865  * callbacks typically are expensive and would slow interrupt handling.
1866  */
1867 static void
1868 crypto_ret_thread(void *arg)
1869 {
1870 	struct crypto_ret_worker *ret_worker = arg;
1871 	struct cryptop *crpt;
1872 
1873 	CRYPTO_RETW_LOCK(ret_worker);
1874 	for (;;) {
1875 		/* Harvest return q's for completed ops */
1876 		crpt = TAILQ_FIRST(&ret_worker->crp_ordered_ret_q);
1877 		if (crpt != NULL) {
1878 			if (crpt->crp_seq == ret_worker->reorder_cur_seq) {
1879 				TAILQ_REMOVE(&ret_worker->crp_ordered_ret_q, crpt, crp_next);
1880 				ret_worker->reorder_cur_seq++;
1881 			} else {
1882 				crpt = NULL;
1883 			}
1884 		}
1885 
1886 		if (crpt == NULL) {
1887 			crpt = TAILQ_FIRST(&ret_worker->crp_ret_q);
1888 			if (crpt != NULL)
1889 				TAILQ_REMOVE(&ret_worker->crp_ret_q, crpt, crp_next);
1890 		}
1891 
1892 		if (crpt != NULL) {
1893 			CRYPTO_RETW_UNLOCK(ret_worker);
1894 			/*
1895 			 * Run callbacks unlocked.
1896 			 */
1897 			if (crpt != NULL)
1898 				crpt->crp_callback(crpt);
1899 			CRYPTO_RETW_LOCK(ret_worker);
1900 		} else {
1901 			/*
1902 			 * Nothing more to be processed.  Sleep until we're
1903 			 * woken because there are more returns to process.
1904 			 */
1905 			msleep(&ret_worker->crp_ret_q, &ret_worker->crypto_ret_mtx, PWAIT,
1906 				"crypto_ret_wait", 0);
1907 			if (ret_worker->td == NULL)
1908 				break;
1909 			CRYPTOSTAT_INC(cs_rets);
1910 		}
1911 	}
1912 	CRYPTO_RETW_UNLOCK(ret_worker);
1913 
1914 	crypto_finis(&ret_worker->crp_ret_q);
1915 }
1916 
1917 #ifdef DDB
1918 static void
1919 db_show_drivers(void)
1920 {
1921 	int hid;
1922 
1923 	db_printf("%12s %4s %8s %2s\n"
1924 		, "Device"
1925 		, "Ses"
1926 		, "Flags"
1927 		, "QB"
1928 	);
1929 	for (hid = 0; hid < crypto_drivers_size; hid++) {
1930 		const struct cryptocap *cap = crypto_drivers[hid];
1931 		if (cap == NULL)
1932 			continue;
1933 		db_printf("%-12s %4u %08x %2u\n"
1934 		    , device_get_nameunit(cap->cc_dev)
1935 		    , cap->cc_sessions
1936 		    , cap->cc_flags
1937 		    , cap->cc_qblocked
1938 		);
1939 	}
1940 }
1941 
1942 DB_SHOW_COMMAND(crypto, db_show_crypto)
1943 {
1944 	struct cryptop *crp;
1945 	struct crypto_ret_worker *ret_worker;
1946 
1947 	db_show_drivers();
1948 	db_printf("\n");
1949 
1950 	db_printf("%4s %8s %4s %4s %4s %4s %8s %8s\n",
1951 	    "HID", "Caps", "Ilen", "Olen", "Etype", "Flags",
1952 	    "Device", "Callback");
1953 	TAILQ_FOREACH(crp, &crp_q, crp_next) {
1954 		db_printf("%4u %08x %4u %4u %04x %8p %8p\n"
1955 		    , crp->crp_session->cap->cc_hid
1956 		    , (int) crypto_ses2caps(crp->crp_session)
1957 		    , crp->crp_olen
1958 		    , crp->crp_etype
1959 		    , crp->crp_flags
1960 		    , device_get_nameunit(crp->crp_session->cap->cc_dev)
1961 		    , crp->crp_callback
1962 		);
1963 	}
1964 	FOREACH_CRYPTO_RETW(ret_worker) {
1965 		db_printf("\n%8s %4s %4s %4s %8s\n",
1966 		    "ret_worker", "HID", "Etype", "Flags", "Callback");
1967 		if (!TAILQ_EMPTY(&ret_worker->crp_ret_q)) {
1968 			TAILQ_FOREACH(crp, &ret_worker->crp_ret_q, crp_next) {
1969 				db_printf("%8td %4u %4u %04x %8p\n"
1970 				    , CRYPTO_RETW_ID(ret_worker)
1971 				    , crp->crp_session->cap->cc_hid
1972 				    , crp->crp_etype
1973 				    , crp->crp_flags
1974 				    , crp->crp_callback
1975 				);
1976 			}
1977 		}
1978 	}
1979 }
1980 #endif
1981 
1982 int crypto_modevent(module_t mod, int type, void *unused);
1983 
1984 /*
1985  * Initialization code, both for static and dynamic loading.
1986  * Note this is not invoked with the usual MODULE_DECLARE
1987  * mechanism but instead is listed as a dependency by the
1988  * cryptosoft driver.  This guarantees proper ordering of
1989  * calls on module load/unload.
1990  */
1991 int
1992 crypto_modevent(module_t mod, int type, void *unused)
1993 {
1994 	int error = EINVAL;
1995 
1996 	switch (type) {
1997 	case MOD_LOAD:
1998 		error = crypto_init();
1999 		if (error == 0 && bootverbose)
2000 			printf("crypto: <crypto core>\n");
2001 		break;
2002 	case MOD_UNLOAD:
2003 		/*XXX disallow if active sessions */
2004 		error = 0;
2005 		crypto_destroy();
2006 		return 0;
2007 	}
2008 	return error;
2009 }
2010 MODULE_VERSION(crypto, 1);
2011 MODULE_DEPEND(crypto, zlib, 1, 1, 1);
2012