xref: /freebsd/sys/opencrypto/crypto.c (revision b4a58fbf640409a1e507d9f7b411c83a3f83a2f3)
1 /*-
2  * Copyright (c) 2002-2006 Sam Leffler.  All rights reserved.
3  * Copyright (c) 2021 The FreeBSD Foundation
4  *
5  * Portions of this software were developed by Ararat River
6  * Consulting, LLC under sponsorship of the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 /*
33  * Cryptographic Subsystem.
34  *
35  * This code is derived from the Openbsd Cryptographic Framework (OCF)
36  * that has the copyright shown below.  Very little of the original
37  * code remains.
38  */
39 
40 /*-
41  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
42  *
43  * This code was written by Angelos D. Keromytis in Athens, Greece, in
44  * February 2000. Network Security Technologies Inc. (NSTI) kindly
45  * supported the development of this code.
46  *
47  * Copyright (c) 2000, 2001 Angelos D. Keromytis
48  *
49  * Permission to use, copy, and modify this software with or without fee
50  * is hereby granted, provided that this entire notice is included in
51  * all source code copies of any software which is or includes a copy or
52  * modification of this software.
53  *
54  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
55  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
56  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
57  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
58  * PURPOSE.
59  */
60 
61 #include "opt_compat.h"
62 #include "opt_ddb.h"
63 
64 #include <sys/param.h>
65 #include <sys/systm.h>
66 #include <sys/counter.h>
67 #include <sys/kernel.h>
68 #include <sys/kthread.h>
69 #include <sys/linker.h>
70 #include <sys/lock.h>
71 #include <sys/module.h>
72 #include <sys/mutex.h>
73 #include <sys/malloc.h>
74 #include <sys/mbuf.h>
75 #include <sys/proc.h>
76 #include <sys/refcount.h>
77 #include <sys/sdt.h>
78 #include <sys/smp.h>
79 #include <sys/sysctl.h>
80 #include <sys/taskqueue.h>
81 #include <sys/uio.h>
82 
83 #include <ddb/ddb.h>
84 
85 #include <machine/vmparam.h>
86 #include <vm/uma.h>
87 
88 #include <crypto/intake.h>
89 #include <opencrypto/cryptodev.h>
90 #include <opencrypto/xform_auth.h>
91 #include <opencrypto/xform_enc.h>
92 
93 #include <sys/kobj.h>
94 #include <sys/bus.h>
95 #include "cryptodev_if.h"
96 
97 #if defined(__i386__) || defined(__amd64__) || defined(__aarch64__)
98 #include <machine/pcb.h>
99 #endif
100 
101 SDT_PROVIDER_DEFINE(opencrypto);
102 
103 /*
104  * Crypto drivers register themselves by allocating a slot in the
105  * crypto_drivers table with crypto_get_driverid().
106  */
107 static	struct mtx crypto_drivers_mtx;		/* lock on driver table */
108 #define	CRYPTO_DRIVER_LOCK()	mtx_lock(&crypto_drivers_mtx)
109 #define	CRYPTO_DRIVER_UNLOCK()	mtx_unlock(&crypto_drivers_mtx)
110 #define	CRYPTO_DRIVER_ASSERT()	mtx_assert(&crypto_drivers_mtx, MA_OWNED)
111 
112 /*
113  * Crypto device/driver capabilities structure.
114  *
115  * Synchronization:
116  * (d) - protected by CRYPTO_DRIVER_LOCK()
117  * (q) - protected by CRYPTO_Q_LOCK()
118  * Not tagged fields are read-only.
119  */
120 struct cryptocap {
121 	device_t	cc_dev;
122 	uint32_t	cc_hid;
123 	uint32_t	cc_sessions;		/* (d) # of sessions */
124 
125 	int		cc_flags;		/* (d) flags */
126 #define CRYPTOCAP_F_CLEANUP	0x80000000	/* needs resource cleanup */
127 	int		cc_qblocked;		/* (q) symmetric q blocked */
128 	size_t		cc_session_size;
129 	volatile int	cc_refs;
130 };
131 
132 static	struct cryptocap **crypto_drivers = NULL;
133 static	int crypto_drivers_size = 0;
134 
135 struct crypto_session {
136 	struct cryptocap *cap;
137 	struct crypto_session_params csp;
138 	uint64_t id;
139 	/* Driver softc follows. */
140 };
141 
142 static	int crp_sleep = 0;
143 static	TAILQ_HEAD(cryptop_q ,cryptop) crp_q;		/* request queues */
144 static	struct mtx crypto_q_mtx;
145 #define	CRYPTO_Q_LOCK()		mtx_lock(&crypto_q_mtx)
146 #define	CRYPTO_Q_UNLOCK()	mtx_unlock(&crypto_q_mtx)
147 
148 SYSCTL_NODE(_kern, OID_AUTO, crypto, CTLFLAG_RW, 0,
149     "In-kernel cryptography");
150 
151 /*
152  * Taskqueue used to dispatch the crypto requests
153  * that have the CRYPTO_F_ASYNC flag
154  */
155 static struct taskqueue *crypto_tq;
156 
157 /*
158  * Crypto seq numbers are operated on with modular arithmetic
159  */
160 #define	CRYPTO_SEQ_GT(a,b)	((int)((a)-(b)) > 0)
161 
162 struct crypto_ret_worker {
163 	struct mtx crypto_ret_mtx;
164 
165 	TAILQ_HEAD(,cryptop) crp_ordered_ret_q;	/* ordered callback queue for symetric jobs */
166 	TAILQ_HEAD(,cryptop) crp_ret_q;		/* callback queue for symetric jobs */
167 
168 	uint32_t reorder_ops;		/* total ordered sym jobs received */
169 	uint32_t reorder_cur_seq;	/* current sym job dispatched */
170 
171 	struct proc *cryptoretproc;
172 };
173 static struct crypto_ret_worker *crypto_ret_workers = NULL;
174 
175 #define CRYPTO_RETW(i)		(&crypto_ret_workers[i])
176 #define CRYPTO_RETW_ID(w)	((w) - crypto_ret_workers)
177 #define FOREACH_CRYPTO_RETW(w) \
178 	for (w = crypto_ret_workers; w < crypto_ret_workers + crypto_workers_num; ++w)
179 
180 #define	CRYPTO_RETW_LOCK(w)	mtx_lock(&w->crypto_ret_mtx)
181 #define	CRYPTO_RETW_UNLOCK(w)	mtx_unlock(&w->crypto_ret_mtx)
182 
183 static int crypto_workers_num = 0;
184 SYSCTL_INT(_kern_crypto, OID_AUTO, num_workers, CTLFLAG_RDTUN,
185 	   &crypto_workers_num, 0,
186 	   "Number of crypto workers used to dispatch crypto jobs");
187 #ifdef COMPAT_FREEBSD12
188 SYSCTL_INT(_kern, OID_AUTO, crypto_workers_num, CTLFLAG_RDTUN,
189 	   &crypto_workers_num, 0,
190 	   "Number of crypto workers used to dispatch crypto jobs");
191 #endif
192 
193 static	uma_zone_t cryptop_zone;
194 
195 int	crypto_devallowsoft = 0;
196 SYSCTL_INT(_kern_crypto, OID_AUTO, allow_soft, CTLFLAG_RWTUN,
197 	   &crypto_devallowsoft, 0,
198 	   "Enable use of software crypto by /dev/crypto");
199 #ifdef COMPAT_FREEBSD12
200 SYSCTL_INT(_kern, OID_AUTO, cryptodevallowsoft, CTLFLAG_RWTUN,
201 	   &crypto_devallowsoft, 0,
202 	   "Enable/disable use of software crypto by /dev/crypto");
203 #endif
204 
205 MALLOC_DEFINE(M_CRYPTO_DATA, "crypto", "crypto session records");
206 
207 static	void crypto_proc(void);
208 static	struct proc *cryptoproc;
209 static	void crypto_ret_proc(struct crypto_ret_worker *ret_worker);
210 static	void crypto_destroy(void);
211 static	int crypto_invoke(struct cryptocap *cap, struct cryptop *crp, int hint);
212 static	void crypto_task_invoke(void *ctx, int pending);
213 static void crypto_batch_enqueue(struct cryptop *crp);
214 
215 static counter_u64_t cryptostats[sizeof(struct cryptostats) / sizeof(uint64_t)];
216 SYSCTL_COUNTER_U64_ARRAY(_kern_crypto, OID_AUTO, stats, CTLFLAG_RW,
217     cryptostats, nitems(cryptostats),
218     "Crypto system statistics");
219 
220 #define	CRYPTOSTAT_INC(stat) do {					\
221 	counter_u64_add(						\
222 	    cryptostats[offsetof(struct cryptostats, stat) / sizeof(uint64_t)],\
223 	    1);								\
224 } while (0)
225 
226 static void
227 cryptostats_init(void *arg __unused)
228 {
229 	COUNTER_ARRAY_ALLOC(cryptostats, nitems(cryptostats), M_WAITOK);
230 }
231 SYSINIT(cryptostats_init, SI_SUB_COUNTER, SI_ORDER_ANY, cryptostats_init, NULL);
232 
233 static void
234 cryptostats_fini(void *arg __unused)
235 {
236 	COUNTER_ARRAY_FREE(cryptostats, nitems(cryptostats));
237 }
238 SYSUNINIT(cryptostats_fini, SI_SUB_COUNTER, SI_ORDER_ANY, cryptostats_fini,
239     NULL);
240 
241 /* Try to avoid directly exposing the key buffer as a symbol */
242 static struct keybuf *keybuf;
243 
244 static struct keybuf empty_keybuf = {
245         .kb_nents = 0
246 };
247 
248 /* Obtain the key buffer from boot metadata */
249 static void
250 keybuf_init(void)
251 {
252 	caddr_t kmdp;
253 
254 	kmdp = preload_search_by_type("elf kernel");
255 
256 	if (kmdp == NULL)
257 		kmdp = preload_search_by_type("elf64 kernel");
258 
259 	keybuf = (struct keybuf *)preload_search_info(kmdp,
260 	    MODINFO_METADATA | MODINFOMD_KEYBUF);
261 
262         if (keybuf == NULL)
263                 keybuf = &empty_keybuf;
264 }
265 
266 /* It'd be nice if we could store these in some kind of secure memory... */
267 struct keybuf *
268 get_keybuf(void)
269 {
270 
271         return (keybuf);
272 }
273 
274 static struct cryptocap *
275 cap_ref(struct cryptocap *cap)
276 {
277 
278 	refcount_acquire(&cap->cc_refs);
279 	return (cap);
280 }
281 
282 static void
283 cap_rele(struct cryptocap *cap)
284 {
285 
286 	if (refcount_release(&cap->cc_refs) == 0)
287 		return;
288 
289 	KASSERT(cap->cc_sessions == 0,
290 	    ("freeing crypto driver with active sessions"));
291 
292 	free(cap, M_CRYPTO_DATA);
293 }
294 
295 static int
296 crypto_init(void)
297 {
298 	struct crypto_ret_worker *ret_worker;
299 	int error;
300 
301 	mtx_init(&crypto_drivers_mtx, "crypto", "crypto driver table",
302 		MTX_DEF|MTX_QUIET);
303 
304 	TAILQ_INIT(&crp_q);
305 	mtx_init(&crypto_q_mtx, "crypto", "crypto op queues", MTX_DEF);
306 
307 	cryptop_zone = uma_zcreate("cryptop",
308 	    sizeof(struct cryptop), NULL, NULL, NULL, NULL,
309 	    UMA_ALIGN_PTR, UMA_ZONE_ZINIT);
310 
311 	crypto_drivers_size = CRYPTO_DRIVERS_INITIAL;
312 	crypto_drivers = malloc(crypto_drivers_size *
313 	    sizeof(struct cryptocap), M_CRYPTO_DATA, M_WAITOK | M_ZERO);
314 
315 	if (crypto_workers_num < 1 || crypto_workers_num > mp_ncpus)
316 		crypto_workers_num = mp_ncpus;
317 
318 	crypto_tq = taskqueue_create("crypto", M_WAITOK | M_ZERO,
319 	    taskqueue_thread_enqueue, &crypto_tq);
320 
321 	taskqueue_start_threads(&crypto_tq, crypto_workers_num, PRI_MIN_KERN,
322 	    "crypto");
323 
324 	error = kproc_create((void (*)(void *)) crypto_proc, NULL,
325 		    &cryptoproc, 0, 0, "crypto");
326 	if (error) {
327 		printf("crypto_init: cannot start crypto thread; error %d",
328 			error);
329 		goto bad;
330 	}
331 
332 	crypto_ret_workers = mallocarray(crypto_workers_num,
333 	    sizeof(struct crypto_ret_worker), M_CRYPTO_DATA, M_WAITOK | M_ZERO);
334 
335 	FOREACH_CRYPTO_RETW(ret_worker) {
336 		TAILQ_INIT(&ret_worker->crp_ordered_ret_q);
337 		TAILQ_INIT(&ret_worker->crp_ret_q);
338 
339 		ret_worker->reorder_ops = 0;
340 		ret_worker->reorder_cur_seq = 0;
341 
342 		mtx_init(&ret_worker->crypto_ret_mtx, "crypto", "crypto return queues", MTX_DEF);
343 
344 		error = kproc_create((void (*)(void *)) crypto_ret_proc, ret_worker,
345 				&ret_worker->cryptoretproc, 0, 0, "crypto returns %td", CRYPTO_RETW_ID(ret_worker));
346 		if (error) {
347 			printf("crypto_init: cannot start cryptoret thread; error %d",
348 				error);
349 			goto bad;
350 		}
351 	}
352 
353 	keybuf_init();
354 
355 	return 0;
356 bad:
357 	crypto_destroy();
358 	return error;
359 }
360 
361 /*
362  * Signal a crypto thread to terminate.  We use the driver
363  * table lock to synchronize the sleep/wakeups so that we
364  * are sure the threads have terminated before we release
365  * the data structures they use.  See crypto_finis below
366  * for the other half of this song-and-dance.
367  */
368 static void
369 crypto_terminate(struct proc **pp, void *q)
370 {
371 	struct proc *p;
372 
373 	mtx_assert(&crypto_drivers_mtx, MA_OWNED);
374 	p = *pp;
375 	*pp = NULL;
376 	if (p) {
377 		wakeup_one(q);
378 		PROC_LOCK(p);		/* NB: insure we don't miss wakeup */
379 		CRYPTO_DRIVER_UNLOCK();	/* let crypto_finis progress */
380 		msleep(p, &p->p_mtx, PWAIT, "crypto_destroy", 0);
381 		PROC_UNLOCK(p);
382 		CRYPTO_DRIVER_LOCK();
383 	}
384 }
385 
386 static void
387 hmac_init_pad(const struct auth_hash *axf, const char *key, int klen,
388     void *auth_ctx, uint8_t padval)
389 {
390 	uint8_t hmac_key[HMAC_MAX_BLOCK_LEN];
391 	u_int i;
392 
393 	KASSERT(axf->blocksize <= sizeof(hmac_key),
394 	    ("Invalid HMAC block size %d", axf->blocksize));
395 
396 	/*
397 	 * If the key is larger than the block size, use the digest of
398 	 * the key as the key instead.
399 	 */
400 	memset(hmac_key, 0, sizeof(hmac_key));
401 	if (klen > axf->blocksize) {
402 		axf->Init(auth_ctx);
403 		axf->Update(auth_ctx, key, klen);
404 		axf->Final(hmac_key, auth_ctx);
405 		klen = axf->hashsize;
406 	} else
407 		memcpy(hmac_key, key, klen);
408 
409 	for (i = 0; i < axf->blocksize; i++)
410 		hmac_key[i] ^= padval;
411 
412 	axf->Init(auth_ctx);
413 	axf->Update(auth_ctx, hmac_key, axf->blocksize);
414 	explicit_bzero(hmac_key, sizeof(hmac_key));
415 }
416 
417 void
418 hmac_init_ipad(const struct auth_hash *axf, const char *key, int klen,
419     void *auth_ctx)
420 {
421 
422 	hmac_init_pad(axf, key, klen, auth_ctx, HMAC_IPAD_VAL);
423 }
424 
425 void
426 hmac_init_opad(const struct auth_hash *axf, const char *key, int klen,
427     void *auth_ctx)
428 {
429 
430 	hmac_init_pad(axf, key, klen, auth_ctx, HMAC_OPAD_VAL);
431 }
432 
433 static void
434 crypto_destroy(void)
435 {
436 	struct crypto_ret_worker *ret_worker;
437 	int i;
438 
439 	/*
440 	 * Terminate any crypto threads.
441 	 */
442 	if (crypto_tq != NULL)
443 		taskqueue_drain_all(crypto_tq);
444 	CRYPTO_DRIVER_LOCK();
445 	crypto_terminate(&cryptoproc, &crp_q);
446 	FOREACH_CRYPTO_RETW(ret_worker)
447 		crypto_terminate(&ret_worker->cryptoretproc, &ret_worker->crp_ret_q);
448 	CRYPTO_DRIVER_UNLOCK();
449 
450 	/* XXX flush queues??? */
451 
452 	/*
453 	 * Reclaim dynamically allocated resources.
454 	 */
455 	for (i = 0; i < crypto_drivers_size; i++) {
456 		if (crypto_drivers[i] != NULL)
457 			cap_rele(crypto_drivers[i]);
458 	}
459 	free(crypto_drivers, M_CRYPTO_DATA);
460 
461 	if (cryptop_zone != NULL)
462 		uma_zdestroy(cryptop_zone);
463 	mtx_destroy(&crypto_q_mtx);
464 	FOREACH_CRYPTO_RETW(ret_worker)
465 		mtx_destroy(&ret_worker->crypto_ret_mtx);
466 	free(crypto_ret_workers, M_CRYPTO_DATA);
467 	if (crypto_tq != NULL)
468 		taskqueue_free(crypto_tq);
469 	mtx_destroy(&crypto_drivers_mtx);
470 }
471 
472 uint32_t
473 crypto_ses2hid(crypto_session_t crypto_session)
474 {
475 	return (crypto_session->cap->cc_hid);
476 }
477 
478 uint32_t
479 crypto_ses2caps(crypto_session_t crypto_session)
480 {
481 	return (crypto_session->cap->cc_flags & 0xff000000);
482 }
483 
484 void *
485 crypto_get_driver_session(crypto_session_t crypto_session)
486 {
487 	return (crypto_session + 1);
488 }
489 
490 const struct crypto_session_params *
491 crypto_get_params(crypto_session_t crypto_session)
492 {
493 	return (&crypto_session->csp);
494 }
495 
496 const struct auth_hash *
497 crypto_auth_hash(const struct crypto_session_params *csp)
498 {
499 
500 	switch (csp->csp_auth_alg) {
501 	case CRYPTO_SHA1_HMAC:
502 		return (&auth_hash_hmac_sha1);
503 	case CRYPTO_SHA2_224_HMAC:
504 		return (&auth_hash_hmac_sha2_224);
505 	case CRYPTO_SHA2_256_HMAC:
506 		return (&auth_hash_hmac_sha2_256);
507 	case CRYPTO_SHA2_384_HMAC:
508 		return (&auth_hash_hmac_sha2_384);
509 	case CRYPTO_SHA2_512_HMAC:
510 		return (&auth_hash_hmac_sha2_512);
511 	case CRYPTO_NULL_HMAC:
512 		return (&auth_hash_null);
513 	case CRYPTO_RIPEMD160_HMAC:
514 		return (&auth_hash_hmac_ripemd_160);
515 	case CRYPTO_SHA1:
516 		return (&auth_hash_sha1);
517 	case CRYPTO_SHA2_224:
518 		return (&auth_hash_sha2_224);
519 	case CRYPTO_SHA2_256:
520 		return (&auth_hash_sha2_256);
521 	case CRYPTO_SHA2_384:
522 		return (&auth_hash_sha2_384);
523 	case CRYPTO_SHA2_512:
524 		return (&auth_hash_sha2_512);
525 	case CRYPTO_AES_NIST_GMAC:
526 		switch (csp->csp_auth_klen) {
527 		case 128 / 8:
528 			return (&auth_hash_nist_gmac_aes_128);
529 		case 192 / 8:
530 			return (&auth_hash_nist_gmac_aes_192);
531 		case 256 / 8:
532 			return (&auth_hash_nist_gmac_aes_256);
533 		default:
534 			return (NULL);
535 		}
536 	case CRYPTO_BLAKE2B:
537 		return (&auth_hash_blake2b);
538 	case CRYPTO_BLAKE2S:
539 		return (&auth_hash_blake2s);
540 	case CRYPTO_POLY1305:
541 		return (&auth_hash_poly1305);
542 	case CRYPTO_AES_CCM_CBC_MAC:
543 		switch (csp->csp_auth_klen) {
544 		case 128 / 8:
545 			return (&auth_hash_ccm_cbc_mac_128);
546 		case 192 / 8:
547 			return (&auth_hash_ccm_cbc_mac_192);
548 		case 256 / 8:
549 			return (&auth_hash_ccm_cbc_mac_256);
550 		default:
551 			return (NULL);
552 		}
553 	default:
554 		return (NULL);
555 	}
556 }
557 
558 const struct enc_xform *
559 crypto_cipher(const struct crypto_session_params *csp)
560 {
561 
562 	switch (csp->csp_cipher_alg) {
563 	case CRYPTO_RIJNDAEL128_CBC:
564 		return (&enc_xform_rijndael128);
565 	case CRYPTO_AES_XTS:
566 		return (&enc_xform_aes_xts);
567 	case CRYPTO_AES_ICM:
568 		return (&enc_xform_aes_icm);
569 	case CRYPTO_AES_NIST_GCM_16:
570 		return (&enc_xform_aes_nist_gcm);
571 	case CRYPTO_CAMELLIA_CBC:
572 		return (&enc_xform_camellia);
573 	case CRYPTO_NULL_CBC:
574 		return (&enc_xform_null);
575 	case CRYPTO_CHACHA20:
576 		return (&enc_xform_chacha20);
577 	case CRYPTO_AES_CCM_16:
578 		return (&enc_xform_ccm);
579 	case CRYPTO_CHACHA20_POLY1305:
580 		return (&enc_xform_chacha20_poly1305);
581 	default:
582 		return (NULL);
583 	}
584 }
585 
586 static struct cryptocap *
587 crypto_checkdriver(uint32_t hid)
588 {
589 
590 	return (hid >= crypto_drivers_size ? NULL : crypto_drivers[hid]);
591 }
592 
593 /*
594  * Select a driver for a new session that supports the specified
595  * algorithms and, optionally, is constrained according to the flags.
596  */
597 static struct cryptocap *
598 crypto_select_driver(const struct crypto_session_params *csp, int flags)
599 {
600 	struct cryptocap *cap, *best;
601 	int best_match, error, hid;
602 
603 	CRYPTO_DRIVER_ASSERT();
604 
605 	best = NULL;
606 	for (hid = 0; hid < crypto_drivers_size; hid++) {
607 		/*
608 		 * If there is no driver for this slot, or the driver
609 		 * is not appropriate (hardware or software based on
610 		 * match), then skip.
611 		 */
612 		cap = crypto_drivers[hid];
613 		if (cap == NULL ||
614 		    (cap->cc_flags & flags) == 0)
615 			continue;
616 
617 		error = CRYPTODEV_PROBESESSION(cap->cc_dev, csp);
618 		if (error >= 0)
619 			continue;
620 
621 		/*
622 		 * Use the driver with the highest probe value.
623 		 * Hardware drivers use a higher probe value than
624 		 * software.  In case of a tie, prefer the driver with
625 		 * the fewest active sessions.
626 		 */
627 		if (best == NULL || error > best_match ||
628 		    (error == best_match &&
629 		    cap->cc_sessions < best->cc_sessions)) {
630 			best = cap;
631 			best_match = error;
632 		}
633 	}
634 	return best;
635 }
636 
637 static enum alg_type {
638 	ALG_NONE = 0,
639 	ALG_CIPHER,
640 	ALG_DIGEST,
641 	ALG_KEYED_DIGEST,
642 	ALG_COMPRESSION,
643 	ALG_AEAD
644 } alg_types[] = {
645 	[CRYPTO_SHA1_HMAC] = ALG_KEYED_DIGEST,
646 	[CRYPTO_RIPEMD160_HMAC] = ALG_KEYED_DIGEST,
647 	[CRYPTO_AES_CBC] = ALG_CIPHER,
648 	[CRYPTO_SHA1] = ALG_DIGEST,
649 	[CRYPTO_NULL_HMAC] = ALG_DIGEST,
650 	[CRYPTO_NULL_CBC] = ALG_CIPHER,
651 	[CRYPTO_DEFLATE_COMP] = ALG_COMPRESSION,
652 	[CRYPTO_SHA2_256_HMAC] = ALG_KEYED_DIGEST,
653 	[CRYPTO_SHA2_384_HMAC] = ALG_KEYED_DIGEST,
654 	[CRYPTO_SHA2_512_HMAC] = ALG_KEYED_DIGEST,
655 	[CRYPTO_CAMELLIA_CBC] = ALG_CIPHER,
656 	[CRYPTO_AES_XTS] = ALG_CIPHER,
657 	[CRYPTO_AES_ICM] = ALG_CIPHER,
658 	[CRYPTO_AES_NIST_GMAC] = ALG_KEYED_DIGEST,
659 	[CRYPTO_AES_NIST_GCM_16] = ALG_AEAD,
660 	[CRYPTO_BLAKE2B] = ALG_KEYED_DIGEST,
661 	[CRYPTO_BLAKE2S] = ALG_KEYED_DIGEST,
662 	[CRYPTO_CHACHA20] = ALG_CIPHER,
663 	[CRYPTO_SHA2_224_HMAC] = ALG_KEYED_DIGEST,
664 	[CRYPTO_RIPEMD160] = ALG_DIGEST,
665 	[CRYPTO_SHA2_224] = ALG_DIGEST,
666 	[CRYPTO_SHA2_256] = ALG_DIGEST,
667 	[CRYPTO_SHA2_384] = ALG_DIGEST,
668 	[CRYPTO_SHA2_512] = ALG_DIGEST,
669 	[CRYPTO_POLY1305] = ALG_KEYED_DIGEST,
670 	[CRYPTO_AES_CCM_CBC_MAC] = ALG_KEYED_DIGEST,
671 	[CRYPTO_AES_CCM_16] = ALG_AEAD,
672 	[CRYPTO_CHACHA20_POLY1305] = ALG_AEAD,
673 };
674 
675 static enum alg_type
676 alg_type(int alg)
677 {
678 
679 	if (alg < nitems(alg_types))
680 		return (alg_types[alg]);
681 	return (ALG_NONE);
682 }
683 
684 static bool
685 alg_is_compression(int alg)
686 {
687 
688 	return (alg_type(alg) == ALG_COMPRESSION);
689 }
690 
691 static bool
692 alg_is_cipher(int alg)
693 {
694 
695 	return (alg_type(alg) == ALG_CIPHER);
696 }
697 
698 static bool
699 alg_is_digest(int alg)
700 {
701 
702 	return (alg_type(alg) == ALG_DIGEST ||
703 	    alg_type(alg) == ALG_KEYED_DIGEST);
704 }
705 
706 static bool
707 alg_is_keyed_digest(int alg)
708 {
709 
710 	return (alg_type(alg) == ALG_KEYED_DIGEST);
711 }
712 
713 static bool
714 alg_is_aead(int alg)
715 {
716 
717 	return (alg_type(alg) == ALG_AEAD);
718 }
719 
720 static bool
721 ccm_tag_length_valid(int len)
722 {
723 	/* RFC 3610 */
724 	switch (len) {
725 	case 4:
726 	case 6:
727 	case 8:
728 	case 10:
729 	case 12:
730 	case 14:
731 	case 16:
732 		return (true);
733 	default:
734 		return (false);
735 	}
736 }
737 
738 #define SUPPORTED_SES (CSP_F_SEPARATE_OUTPUT | CSP_F_SEPARATE_AAD | CSP_F_ESN)
739 
740 /* Various sanity checks on crypto session parameters. */
741 static bool
742 check_csp(const struct crypto_session_params *csp)
743 {
744 	const struct auth_hash *axf;
745 
746 	/* Mode-independent checks. */
747 	if ((csp->csp_flags & ~(SUPPORTED_SES)) != 0)
748 		return (false);
749 	if (csp->csp_ivlen < 0 || csp->csp_cipher_klen < 0 ||
750 	    csp->csp_auth_klen < 0 || csp->csp_auth_mlen < 0)
751 		return (false);
752 	if (csp->csp_auth_key != NULL && csp->csp_auth_klen == 0)
753 		return (false);
754 	if (csp->csp_cipher_key != NULL && csp->csp_cipher_klen == 0)
755 		return (false);
756 
757 	switch (csp->csp_mode) {
758 	case CSP_MODE_COMPRESS:
759 		if (!alg_is_compression(csp->csp_cipher_alg))
760 			return (false);
761 		if (csp->csp_flags & CSP_F_SEPARATE_OUTPUT)
762 			return (false);
763 		if (csp->csp_flags & CSP_F_SEPARATE_AAD)
764 			return (false);
765 		if (csp->csp_cipher_klen != 0 || csp->csp_ivlen != 0 ||
766 		    csp->csp_auth_alg != 0 || csp->csp_auth_klen != 0 ||
767 		    csp->csp_auth_mlen != 0)
768 			return (false);
769 		break;
770 	case CSP_MODE_CIPHER:
771 		if (!alg_is_cipher(csp->csp_cipher_alg))
772 			return (false);
773 		if (csp->csp_flags & CSP_F_SEPARATE_AAD)
774 			return (false);
775 		if (csp->csp_cipher_alg != CRYPTO_NULL_CBC) {
776 			if (csp->csp_cipher_klen == 0)
777 				return (false);
778 			if (csp->csp_ivlen == 0)
779 				return (false);
780 		}
781 		if (csp->csp_ivlen >= EALG_MAX_BLOCK_LEN)
782 			return (false);
783 		if (csp->csp_auth_alg != 0 || csp->csp_auth_klen != 0 ||
784 		    csp->csp_auth_mlen != 0)
785 			return (false);
786 		break;
787 	case CSP_MODE_DIGEST:
788 		if (csp->csp_cipher_alg != 0 || csp->csp_cipher_klen != 0)
789 			return (false);
790 
791 		if (csp->csp_flags & CSP_F_SEPARATE_AAD)
792 			return (false);
793 
794 		/* IV is optional for digests (e.g. GMAC). */
795 		switch (csp->csp_auth_alg) {
796 		case CRYPTO_AES_CCM_CBC_MAC:
797 			if (csp->csp_ivlen < 7 || csp->csp_ivlen > 13)
798 				return (false);
799 			break;
800 		case CRYPTO_AES_NIST_GMAC:
801 			if (csp->csp_ivlen != AES_GCM_IV_LEN)
802 				return (false);
803 			break;
804 		default:
805 			if (csp->csp_ivlen != 0)
806 				return (false);
807 			break;
808 		}
809 
810 		if (!alg_is_digest(csp->csp_auth_alg))
811 			return (false);
812 
813 		/* Key is optional for BLAKE2 digests. */
814 		if (csp->csp_auth_alg == CRYPTO_BLAKE2B ||
815 		    csp->csp_auth_alg == CRYPTO_BLAKE2S)
816 			;
817 		else if (alg_is_keyed_digest(csp->csp_auth_alg)) {
818 			if (csp->csp_auth_klen == 0)
819 				return (false);
820 		} else {
821 			if (csp->csp_auth_klen != 0)
822 				return (false);
823 		}
824 		if (csp->csp_auth_mlen != 0) {
825 			axf = crypto_auth_hash(csp);
826 			if (axf == NULL || csp->csp_auth_mlen > axf->hashsize)
827 				return (false);
828 
829 			if (csp->csp_auth_alg == CRYPTO_AES_CCM_CBC_MAC &&
830 			    !ccm_tag_length_valid(csp->csp_auth_mlen))
831 				return (false);
832 		}
833 		break;
834 	case CSP_MODE_AEAD:
835 		if (!alg_is_aead(csp->csp_cipher_alg))
836 			return (false);
837 		if (csp->csp_cipher_klen == 0)
838 			return (false);
839 		if (csp->csp_ivlen == 0 ||
840 		    csp->csp_ivlen >= EALG_MAX_BLOCK_LEN)
841 			return (false);
842 		if (csp->csp_auth_alg != 0 || csp->csp_auth_klen != 0)
843 			return (false);
844 
845 		switch (csp->csp_cipher_alg) {
846 		case CRYPTO_AES_CCM_16:
847 			if (csp->csp_auth_mlen != 0 &&
848 			    !ccm_tag_length_valid(csp->csp_auth_mlen))
849 				return (false);
850 
851 			if (csp->csp_ivlen < 7 || csp->csp_ivlen > 13)
852 				return (false);
853 			break;
854 		case CRYPTO_AES_NIST_GCM_16:
855 			if (csp->csp_auth_mlen > 16)
856 				return (false);
857 			break;
858 		case CRYPTO_CHACHA20_POLY1305:
859 			if (csp->csp_ivlen != 8 && csp->csp_ivlen != 12)
860 				return (false);
861 			if (csp->csp_auth_mlen > POLY1305_HASH_LEN)
862 				return (false);
863 			break;
864 		}
865 		break;
866 	case CSP_MODE_ETA:
867 		if (!alg_is_cipher(csp->csp_cipher_alg))
868 			return (false);
869 		if (csp->csp_cipher_alg != CRYPTO_NULL_CBC) {
870 			if (csp->csp_cipher_klen == 0)
871 				return (false);
872 			if (csp->csp_ivlen == 0)
873 				return (false);
874 		}
875 		if (csp->csp_ivlen >= EALG_MAX_BLOCK_LEN)
876 			return (false);
877 		if (!alg_is_digest(csp->csp_auth_alg))
878 			return (false);
879 
880 		/* Key is optional for BLAKE2 digests. */
881 		if (csp->csp_auth_alg == CRYPTO_BLAKE2B ||
882 		    csp->csp_auth_alg == CRYPTO_BLAKE2S)
883 			;
884 		else if (alg_is_keyed_digest(csp->csp_auth_alg)) {
885 			if (csp->csp_auth_klen == 0)
886 				return (false);
887 		} else {
888 			if (csp->csp_auth_klen != 0)
889 				return (false);
890 		}
891 		if (csp->csp_auth_mlen != 0) {
892 			axf = crypto_auth_hash(csp);
893 			if (axf == NULL || csp->csp_auth_mlen > axf->hashsize)
894 				return (false);
895 		}
896 		break;
897 	default:
898 		return (false);
899 	}
900 
901 	return (true);
902 }
903 
904 /*
905  * Delete a session after it has been detached from its driver.
906  */
907 static void
908 crypto_deletesession(crypto_session_t cses)
909 {
910 	struct cryptocap *cap;
911 
912 	cap = cses->cap;
913 
914 	zfree(cses, M_CRYPTO_DATA);
915 
916 	CRYPTO_DRIVER_LOCK();
917 	cap->cc_sessions--;
918 	if (cap->cc_sessions == 0 && cap->cc_flags & CRYPTOCAP_F_CLEANUP)
919 		wakeup(cap);
920 	CRYPTO_DRIVER_UNLOCK();
921 	cap_rele(cap);
922 }
923 
924 /*
925  * Create a new session.  The crid argument specifies a crypto
926  * driver to use or constraints on a driver to select (hardware
927  * only, software only, either).  Whatever driver is selected
928  * must be capable of the requested crypto algorithms.
929  */
930 int
931 crypto_newsession(crypto_session_t *cses,
932     const struct crypto_session_params *csp, int crid)
933 {
934 	static uint64_t sessid = 0;
935 	crypto_session_t res;
936 	struct cryptocap *cap;
937 	int err;
938 
939 	if (!check_csp(csp))
940 		return (EINVAL);
941 
942 	res = NULL;
943 
944 	CRYPTO_DRIVER_LOCK();
945 	if ((crid & (CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE)) == 0) {
946 		/*
947 		 * Use specified driver; verify it is capable.
948 		 */
949 		cap = crypto_checkdriver(crid);
950 		if (cap != NULL && CRYPTODEV_PROBESESSION(cap->cc_dev, csp) > 0)
951 			cap = NULL;
952 	} else {
953 		/*
954 		 * No requested driver; select based on crid flags.
955 		 */
956 		cap = crypto_select_driver(csp, crid);
957 	}
958 	if (cap == NULL) {
959 		CRYPTO_DRIVER_UNLOCK();
960 		CRYPTDEB("no driver");
961 		return (EOPNOTSUPP);
962 	}
963 	cap_ref(cap);
964 	cap->cc_sessions++;
965 	CRYPTO_DRIVER_UNLOCK();
966 
967 	/* Allocate a single block for the generic session and driver softc. */
968 	res = malloc(sizeof(*res) + cap->cc_session_size, M_CRYPTO_DATA,
969 	    M_WAITOK | M_ZERO);
970 	res->cap = cap;
971 	res->csp = *csp;
972 	res->id = atomic_fetchadd_64(&sessid, 1);
973 
974 	/* Call the driver initialization routine. */
975 	err = CRYPTODEV_NEWSESSION(cap->cc_dev, res, csp);
976 	if (err != 0) {
977 		CRYPTDEB("dev newsession failed: %d", err);
978 		crypto_deletesession(res);
979 		return (err);
980 	}
981 
982 	*cses = res;
983 	return (0);
984 }
985 
986 /*
987  * Delete an existing session (or a reserved session on an unregistered
988  * driver).
989  */
990 void
991 crypto_freesession(crypto_session_t cses)
992 {
993 	struct cryptocap *cap;
994 
995 	if (cses == NULL)
996 		return;
997 
998 	cap = cses->cap;
999 
1000 	/* Call the driver cleanup routine, if available. */
1001 	CRYPTODEV_FREESESSION(cap->cc_dev, cses);
1002 
1003 	crypto_deletesession(cses);
1004 }
1005 
1006 /*
1007  * Return a new driver id.  Registers a driver with the system so that
1008  * it can be probed by subsequent sessions.
1009  */
1010 int32_t
1011 crypto_get_driverid(device_t dev, size_t sessionsize, int flags)
1012 {
1013 	struct cryptocap *cap, **newdrv;
1014 	int i;
1015 
1016 	if ((flags & (CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE)) == 0) {
1017 		device_printf(dev,
1018 		    "no flags specified when registering driver\n");
1019 		return -1;
1020 	}
1021 
1022 	cap = malloc(sizeof(*cap), M_CRYPTO_DATA, M_WAITOK | M_ZERO);
1023 	cap->cc_dev = dev;
1024 	cap->cc_session_size = sessionsize;
1025 	cap->cc_flags = flags;
1026 	refcount_init(&cap->cc_refs, 1);
1027 
1028 	CRYPTO_DRIVER_LOCK();
1029 	for (;;) {
1030 		for (i = 0; i < crypto_drivers_size; i++) {
1031 			if (crypto_drivers[i] == NULL)
1032 				break;
1033 		}
1034 
1035 		if (i < crypto_drivers_size)
1036 			break;
1037 
1038 		/* Out of entries, allocate some more. */
1039 
1040 		if (2 * crypto_drivers_size <= crypto_drivers_size) {
1041 			CRYPTO_DRIVER_UNLOCK();
1042 			printf("crypto: driver count wraparound!\n");
1043 			cap_rele(cap);
1044 			return (-1);
1045 		}
1046 		CRYPTO_DRIVER_UNLOCK();
1047 
1048 		newdrv = malloc(2 * crypto_drivers_size *
1049 		    sizeof(*crypto_drivers), M_CRYPTO_DATA, M_WAITOK | M_ZERO);
1050 
1051 		CRYPTO_DRIVER_LOCK();
1052 		memcpy(newdrv, crypto_drivers,
1053 		    crypto_drivers_size * sizeof(*crypto_drivers));
1054 
1055 		crypto_drivers_size *= 2;
1056 
1057 		free(crypto_drivers, M_CRYPTO_DATA);
1058 		crypto_drivers = newdrv;
1059 	}
1060 
1061 	cap->cc_hid = i;
1062 	crypto_drivers[i] = cap;
1063 	CRYPTO_DRIVER_UNLOCK();
1064 
1065 	if (bootverbose)
1066 		printf("crypto: assign %s driver id %u, flags 0x%x\n",
1067 		    device_get_nameunit(dev), i, flags);
1068 
1069 	return i;
1070 }
1071 
1072 /*
1073  * Lookup a driver by name.  We match against the full device
1074  * name and unit, and against just the name.  The latter gives
1075  * us a simple widlcarding by device name.  On success return the
1076  * driver/hardware identifier; otherwise return -1.
1077  */
1078 int
1079 crypto_find_driver(const char *match)
1080 {
1081 	struct cryptocap *cap;
1082 	int i, len = strlen(match);
1083 
1084 	CRYPTO_DRIVER_LOCK();
1085 	for (i = 0; i < crypto_drivers_size; i++) {
1086 		if (crypto_drivers[i] == NULL)
1087 			continue;
1088 		cap = crypto_drivers[i];
1089 		if (strncmp(match, device_get_nameunit(cap->cc_dev), len) == 0 ||
1090 		    strncmp(match, device_get_name(cap->cc_dev), len) == 0) {
1091 			CRYPTO_DRIVER_UNLOCK();
1092 			return (i);
1093 		}
1094 	}
1095 	CRYPTO_DRIVER_UNLOCK();
1096 	return (-1);
1097 }
1098 
1099 /*
1100  * Return the device_t for the specified driver or NULL
1101  * if the driver identifier is invalid.
1102  */
1103 device_t
1104 crypto_find_device_byhid(int hid)
1105 {
1106 	struct cryptocap *cap;
1107 	device_t dev;
1108 
1109 	dev = NULL;
1110 	CRYPTO_DRIVER_LOCK();
1111 	cap = crypto_checkdriver(hid);
1112 	if (cap != NULL)
1113 		dev = cap->cc_dev;
1114 	CRYPTO_DRIVER_UNLOCK();
1115 	return (dev);
1116 }
1117 
1118 /*
1119  * Return the device/driver capabilities.
1120  */
1121 int
1122 crypto_getcaps(int hid)
1123 {
1124 	struct cryptocap *cap;
1125 	int flags;
1126 
1127 	flags = 0;
1128 	CRYPTO_DRIVER_LOCK();
1129 	cap = crypto_checkdriver(hid);
1130 	if (cap != NULL)
1131 		flags = cap->cc_flags;
1132 	CRYPTO_DRIVER_UNLOCK();
1133 	return (flags);
1134 }
1135 
1136 /*
1137  * Unregister all algorithms associated with a crypto driver.
1138  * If there are pending sessions using it, leave enough information
1139  * around so that subsequent calls using those sessions will
1140  * correctly detect the driver has been unregistered and reroute
1141  * requests.
1142  */
1143 int
1144 crypto_unregister_all(uint32_t driverid)
1145 {
1146 	struct cryptocap *cap;
1147 
1148 	CRYPTO_DRIVER_LOCK();
1149 	cap = crypto_checkdriver(driverid);
1150 	if (cap == NULL) {
1151 		CRYPTO_DRIVER_UNLOCK();
1152 		return (EINVAL);
1153 	}
1154 
1155 	cap->cc_flags |= CRYPTOCAP_F_CLEANUP;
1156 	crypto_drivers[driverid] = NULL;
1157 
1158 	/*
1159 	 * XXX: This doesn't do anything to kick sessions that
1160 	 * have no pending operations.
1161 	 */
1162 	while (cap->cc_sessions != 0)
1163 		mtx_sleep(cap, &crypto_drivers_mtx, 0, "cryunreg", 0);
1164 	CRYPTO_DRIVER_UNLOCK();
1165 	cap_rele(cap);
1166 
1167 	return (0);
1168 }
1169 
1170 /*
1171  * Clear blockage on a driver.  The what parameter indicates whether
1172  * the driver is now ready for cryptop's and/or cryptokop's.
1173  */
1174 int
1175 crypto_unblock(uint32_t driverid, int what)
1176 {
1177 	struct cryptocap *cap;
1178 	int err;
1179 
1180 	CRYPTO_Q_LOCK();
1181 	cap = crypto_checkdriver(driverid);
1182 	if (cap != NULL) {
1183 		if (what & CRYPTO_SYMQ)
1184 			cap->cc_qblocked = 0;
1185 		if (crp_sleep)
1186 			wakeup_one(&crp_q);
1187 		err = 0;
1188 	} else
1189 		err = EINVAL;
1190 	CRYPTO_Q_UNLOCK();
1191 
1192 	return err;
1193 }
1194 
1195 size_t
1196 crypto_buffer_len(struct crypto_buffer *cb)
1197 {
1198 	switch (cb->cb_type) {
1199 	case CRYPTO_BUF_CONTIG:
1200 		return (cb->cb_buf_len);
1201 	case CRYPTO_BUF_MBUF:
1202 		if (cb->cb_mbuf->m_flags & M_PKTHDR)
1203 			return (cb->cb_mbuf->m_pkthdr.len);
1204 		return (m_length(cb->cb_mbuf, NULL));
1205 	case CRYPTO_BUF_SINGLE_MBUF:
1206 		return (cb->cb_mbuf->m_len);
1207 	case CRYPTO_BUF_VMPAGE:
1208 		return (cb->cb_vm_page_len);
1209 	case CRYPTO_BUF_UIO:
1210 		return (cb->cb_uio->uio_resid);
1211 	default:
1212 		return (0);
1213 	}
1214 }
1215 
1216 #ifdef INVARIANTS
1217 /* Various sanity checks on crypto requests. */
1218 static void
1219 cb_sanity(struct crypto_buffer *cb, const char *name)
1220 {
1221 	KASSERT(cb->cb_type > CRYPTO_BUF_NONE && cb->cb_type <= CRYPTO_BUF_LAST,
1222 	    ("incoming crp with invalid %s buffer type", name));
1223 	switch (cb->cb_type) {
1224 	case CRYPTO_BUF_CONTIG:
1225 		KASSERT(cb->cb_buf_len >= 0,
1226 		    ("incoming crp with -ve %s buffer length", name));
1227 		break;
1228 	case CRYPTO_BUF_VMPAGE:
1229 		KASSERT(CRYPTO_HAS_VMPAGE,
1230 		    ("incoming crp uses dmap on supported arch"));
1231 		KASSERT(cb->cb_vm_page_len >= 0,
1232 		    ("incoming crp with -ve %s buffer length", name));
1233 		KASSERT(cb->cb_vm_page_offset >= 0,
1234 		    ("incoming crp with -ve %s buffer offset", name));
1235 		KASSERT(cb->cb_vm_page_offset < PAGE_SIZE,
1236 		    ("incoming crp with %s buffer offset greater than page size"
1237 		     , name));
1238 		break;
1239 	default:
1240 		break;
1241 	}
1242 }
1243 
1244 static void
1245 crp_sanity(struct cryptop *crp)
1246 {
1247 	struct crypto_session_params *csp;
1248 	struct crypto_buffer *out;
1249 	size_t ilen, len, olen;
1250 
1251 	KASSERT(crp->crp_session != NULL, ("incoming crp without a session"));
1252 	KASSERT(crp->crp_obuf.cb_type >= CRYPTO_BUF_NONE &&
1253 	    crp->crp_obuf.cb_type <= CRYPTO_BUF_LAST,
1254 	    ("incoming crp with invalid output buffer type"));
1255 	KASSERT(crp->crp_etype == 0, ("incoming crp with error"));
1256 	KASSERT(!(crp->crp_flags & CRYPTO_F_DONE),
1257 	    ("incoming crp already done"));
1258 
1259 	csp = &crp->crp_session->csp;
1260 	cb_sanity(&crp->crp_buf, "input");
1261 	ilen = crypto_buffer_len(&crp->crp_buf);
1262 	olen = ilen;
1263 	out = NULL;
1264 	if (csp->csp_flags & CSP_F_SEPARATE_OUTPUT) {
1265 		if (crp->crp_obuf.cb_type != CRYPTO_BUF_NONE) {
1266 			cb_sanity(&crp->crp_obuf, "output");
1267 			out = &crp->crp_obuf;
1268 			olen = crypto_buffer_len(out);
1269 		}
1270 	} else
1271 		KASSERT(crp->crp_obuf.cb_type == CRYPTO_BUF_NONE,
1272 		    ("incoming crp with separate output buffer "
1273 		    "but no session support"));
1274 
1275 	switch (csp->csp_mode) {
1276 	case CSP_MODE_COMPRESS:
1277 		KASSERT(crp->crp_op == CRYPTO_OP_COMPRESS ||
1278 		    crp->crp_op == CRYPTO_OP_DECOMPRESS,
1279 		    ("invalid compression op %x", crp->crp_op));
1280 		break;
1281 	case CSP_MODE_CIPHER:
1282 		KASSERT(crp->crp_op == CRYPTO_OP_ENCRYPT ||
1283 		    crp->crp_op == CRYPTO_OP_DECRYPT,
1284 		    ("invalid cipher op %x", crp->crp_op));
1285 		break;
1286 	case CSP_MODE_DIGEST:
1287 		KASSERT(crp->crp_op == CRYPTO_OP_COMPUTE_DIGEST ||
1288 		    crp->crp_op == CRYPTO_OP_VERIFY_DIGEST,
1289 		    ("invalid digest op %x", crp->crp_op));
1290 		break;
1291 	case CSP_MODE_AEAD:
1292 		KASSERT(crp->crp_op ==
1293 		    (CRYPTO_OP_ENCRYPT | CRYPTO_OP_COMPUTE_DIGEST) ||
1294 		    crp->crp_op ==
1295 		    (CRYPTO_OP_DECRYPT | CRYPTO_OP_VERIFY_DIGEST),
1296 		    ("invalid AEAD op %x", crp->crp_op));
1297 		KASSERT(crp->crp_flags & CRYPTO_F_IV_SEPARATE,
1298 		    ("AEAD without a separate IV"));
1299 		break;
1300 	case CSP_MODE_ETA:
1301 		KASSERT(crp->crp_op ==
1302 		    (CRYPTO_OP_ENCRYPT | CRYPTO_OP_COMPUTE_DIGEST) ||
1303 		    crp->crp_op ==
1304 		    (CRYPTO_OP_DECRYPT | CRYPTO_OP_VERIFY_DIGEST),
1305 		    ("invalid ETA op %x", crp->crp_op));
1306 		break;
1307 	}
1308 	if (csp->csp_mode == CSP_MODE_AEAD || csp->csp_mode == CSP_MODE_ETA) {
1309 		if (crp->crp_aad == NULL) {
1310 			KASSERT(crp->crp_aad_start == 0 ||
1311 			    crp->crp_aad_start < ilen,
1312 			    ("invalid AAD start"));
1313 			KASSERT(crp->crp_aad_length != 0 ||
1314 			    crp->crp_aad_start == 0,
1315 			    ("AAD with zero length and non-zero start"));
1316 			KASSERT(crp->crp_aad_length == 0 ||
1317 			    crp->crp_aad_start + crp->crp_aad_length <= ilen,
1318 			    ("AAD outside input length"));
1319 		} else {
1320 			KASSERT(csp->csp_flags & CSP_F_SEPARATE_AAD,
1321 			    ("session doesn't support separate AAD buffer"));
1322 			KASSERT(crp->crp_aad_start == 0,
1323 			    ("separate AAD buffer with non-zero AAD start"));
1324 			KASSERT(crp->crp_aad_length != 0,
1325 			    ("separate AAD buffer with zero length"));
1326 		}
1327 	} else {
1328 		KASSERT(crp->crp_aad == NULL && crp->crp_aad_start == 0 &&
1329 		    crp->crp_aad_length == 0,
1330 		    ("AAD region in request not supporting AAD"));
1331 	}
1332 	if (csp->csp_ivlen == 0) {
1333 		KASSERT((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0,
1334 		    ("IV_SEPARATE set when IV isn't used"));
1335 		KASSERT(crp->crp_iv_start == 0,
1336 		    ("crp_iv_start set when IV isn't used"));
1337 	} else if (crp->crp_flags & CRYPTO_F_IV_SEPARATE) {
1338 		KASSERT(crp->crp_iv_start == 0,
1339 		    ("IV_SEPARATE used with non-zero IV start"));
1340 	} else {
1341 		KASSERT(crp->crp_iv_start < ilen,
1342 		    ("invalid IV start"));
1343 		KASSERT(crp->crp_iv_start + csp->csp_ivlen <= ilen,
1344 		    ("IV outside buffer length"));
1345 	}
1346 	/* XXX: payload_start of 0 should always be < ilen? */
1347 	KASSERT(crp->crp_payload_start == 0 ||
1348 	    crp->crp_payload_start < ilen,
1349 	    ("invalid payload start"));
1350 	KASSERT(crp->crp_payload_start + crp->crp_payload_length <=
1351 	    ilen, ("payload outside input buffer"));
1352 	if (out == NULL) {
1353 		KASSERT(crp->crp_payload_output_start == 0,
1354 		    ("payload output start non-zero without output buffer"));
1355 	} else {
1356 		KASSERT(crp->crp_payload_output_start < olen,
1357 		    ("invalid payload output start"));
1358 		KASSERT(crp->crp_payload_output_start +
1359 		    crp->crp_payload_length <= olen,
1360 		    ("payload outside output buffer"));
1361 	}
1362 	if (csp->csp_mode == CSP_MODE_DIGEST ||
1363 	    csp->csp_mode == CSP_MODE_AEAD || csp->csp_mode == CSP_MODE_ETA) {
1364 		if (crp->crp_op & CRYPTO_OP_VERIFY_DIGEST)
1365 			len = ilen;
1366 		else
1367 			len = olen;
1368 		KASSERT(crp->crp_digest_start == 0 ||
1369 		    crp->crp_digest_start < len,
1370 		    ("invalid digest start"));
1371 		/* XXX: For the mlen == 0 case this check isn't perfect. */
1372 		KASSERT(crp->crp_digest_start + csp->csp_auth_mlen <= len,
1373 		    ("digest outside buffer"));
1374 	} else {
1375 		KASSERT(crp->crp_digest_start == 0,
1376 		    ("non-zero digest start for request without a digest"));
1377 	}
1378 	if (csp->csp_cipher_klen != 0)
1379 		KASSERT(csp->csp_cipher_key != NULL ||
1380 		    crp->crp_cipher_key != NULL,
1381 		    ("cipher request without a key"));
1382 	if (csp->csp_auth_klen != 0)
1383 		KASSERT(csp->csp_auth_key != NULL || crp->crp_auth_key != NULL,
1384 		    ("auth request without a key"));
1385 	KASSERT(crp->crp_callback != NULL, ("incoming crp without callback"));
1386 }
1387 #endif
1388 
1389 static int
1390 crypto_dispatch_one(struct cryptop *crp, int hint)
1391 {
1392 	struct cryptocap *cap;
1393 	int result;
1394 
1395 #ifdef INVARIANTS
1396 	crp_sanity(crp);
1397 #endif
1398 	CRYPTOSTAT_INC(cs_ops);
1399 
1400 	crp->crp_retw_id = crp->crp_session->id % crypto_workers_num;
1401 
1402 	/*
1403 	 * Caller marked the request to be processed immediately; dispatch it
1404 	 * directly to the driver unless the driver is currently blocked, in
1405 	 * which case it is queued for deferred dispatch.
1406 	 */
1407 	cap = crp->crp_session->cap;
1408 	if (!atomic_load_int(&cap->cc_qblocked)) {
1409 		result = crypto_invoke(cap, crp, hint);
1410 		if (result != ERESTART)
1411 			return (result);
1412 
1413 		/*
1414 		 * The driver ran out of resources, put the request on the
1415 		 * queue.
1416 		 */
1417 	}
1418 	crypto_batch_enqueue(crp);
1419 	return (0);
1420 }
1421 
1422 int
1423 crypto_dispatch(struct cryptop *crp)
1424 {
1425 	return (crypto_dispatch_one(crp, 0));
1426 }
1427 
1428 int
1429 crypto_dispatch_async(struct cryptop *crp, int flags)
1430 {
1431 	struct crypto_ret_worker *ret_worker;
1432 
1433 	if (!CRYPTO_SESS_SYNC(crp->crp_session)) {
1434 		/*
1435 		 * The driver issues completions asynchonously, don't bother
1436 		 * deferring dispatch to a worker thread.
1437 		 */
1438 		return (crypto_dispatch(crp));
1439 	}
1440 
1441 #ifdef INVARIANTS
1442 	crp_sanity(crp);
1443 #endif
1444 	CRYPTOSTAT_INC(cs_ops);
1445 
1446 	crp->crp_retw_id = crp->crp_session->id % crypto_workers_num;
1447 	if ((flags & CRYPTO_ASYNC_ORDERED) != 0) {
1448 		crp->crp_flags |= CRYPTO_F_ASYNC_ORDERED;
1449 		ret_worker = CRYPTO_RETW(crp->crp_retw_id);
1450 		CRYPTO_RETW_LOCK(ret_worker);
1451 		crp->crp_seq = ret_worker->reorder_ops++;
1452 		CRYPTO_RETW_UNLOCK(ret_worker);
1453 	}
1454 	TASK_INIT(&crp->crp_task, 0, crypto_task_invoke, crp);
1455 	taskqueue_enqueue(crypto_tq, &crp->crp_task);
1456 	return (0);
1457 }
1458 
1459 void
1460 crypto_dispatch_batch(struct cryptopq *crpq, int flags)
1461 {
1462 	struct cryptop *crp;
1463 	int hint;
1464 
1465 	while ((crp = TAILQ_FIRST(crpq)) != NULL) {
1466 		hint = TAILQ_NEXT(crp, crp_next) != NULL ? CRYPTO_HINT_MORE : 0;
1467 		TAILQ_REMOVE(crpq, crp, crp_next);
1468 		if (crypto_dispatch_one(crp, hint) != 0)
1469 			crypto_batch_enqueue(crp);
1470 	}
1471 }
1472 
1473 static void
1474 crypto_batch_enqueue(struct cryptop *crp)
1475 {
1476 
1477 	CRYPTO_Q_LOCK();
1478 	TAILQ_INSERT_TAIL(&crp_q, crp, crp_next);
1479 	if (crp_sleep)
1480 		wakeup_one(&crp_q);
1481 	CRYPTO_Q_UNLOCK();
1482 }
1483 
1484 static void
1485 crypto_task_invoke(void *ctx, int pending)
1486 {
1487 	struct cryptocap *cap;
1488 	struct cryptop *crp;
1489 	int result;
1490 
1491 	crp = (struct cryptop *)ctx;
1492 	cap = crp->crp_session->cap;
1493 	result = crypto_invoke(cap, crp, 0);
1494 	if (result == ERESTART)
1495 		crypto_batch_enqueue(crp);
1496 }
1497 
1498 /*
1499  * Dispatch a crypto request to the appropriate crypto devices.
1500  */
1501 static int
1502 crypto_invoke(struct cryptocap *cap, struct cryptop *crp, int hint)
1503 {
1504 
1505 	KASSERT(crp != NULL, ("%s: crp == NULL", __func__));
1506 	KASSERT(crp->crp_callback != NULL,
1507 	    ("%s: crp->crp_callback == NULL", __func__));
1508 	KASSERT(crp->crp_session != NULL,
1509 	    ("%s: crp->crp_session == NULL", __func__));
1510 
1511 	if (cap->cc_flags & CRYPTOCAP_F_CLEANUP) {
1512 		struct crypto_session_params csp;
1513 		crypto_session_t nses;
1514 
1515 		/*
1516 		 * Driver has unregistered; migrate the session and return
1517 		 * an error to the caller so they'll resubmit the op.
1518 		 *
1519 		 * XXX: What if there are more already queued requests for this
1520 		 *      session?
1521 		 *
1522 		 * XXX: Real solution is to make sessions refcounted
1523 		 * and force callers to hold a reference when
1524 		 * assigning to crp_session.  Could maybe change
1525 		 * crypto_getreq to accept a session pointer to make
1526 		 * that work.  Alternatively, we could abandon the
1527 		 * notion of rewriting crp_session in requests forcing
1528 		 * the caller to deal with allocating a new session.
1529 		 * Perhaps provide a method to allow a crp's session to
1530 		 * be swapped that callers could use.
1531 		 */
1532 		csp = crp->crp_session->csp;
1533 		crypto_freesession(crp->crp_session);
1534 
1535 		/*
1536 		 * XXX: Key pointers may no longer be valid.  If we
1537 		 * really want to support this we need to define the
1538 		 * KPI such that 'csp' is required to be valid for the
1539 		 * duration of a session by the caller perhaps.
1540 		 *
1541 		 * XXX: If the keys have been changed this will reuse
1542 		 * the old keys.  This probably suggests making
1543 		 * rekeying more explicit and updating the key
1544 		 * pointers in 'csp' when the keys change.
1545 		 */
1546 		if (crypto_newsession(&nses, &csp,
1547 		    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE) == 0)
1548 			crp->crp_session = nses;
1549 
1550 		crp->crp_etype = EAGAIN;
1551 		crypto_done(crp);
1552 		return 0;
1553 	} else {
1554 		/*
1555 		 * Invoke the driver to process the request.
1556 		 */
1557 		return CRYPTODEV_PROCESS(cap->cc_dev, crp, hint);
1558 	}
1559 }
1560 
1561 void
1562 crypto_destroyreq(struct cryptop *crp)
1563 {
1564 #ifdef DIAGNOSTIC
1565 	{
1566 		struct cryptop *crp2;
1567 		struct crypto_ret_worker *ret_worker;
1568 
1569 		CRYPTO_Q_LOCK();
1570 		TAILQ_FOREACH(crp2, &crp_q, crp_next) {
1571 			KASSERT(crp2 != crp,
1572 			    ("Freeing cryptop from the crypto queue (%p).",
1573 			    crp));
1574 		}
1575 		CRYPTO_Q_UNLOCK();
1576 
1577 		FOREACH_CRYPTO_RETW(ret_worker) {
1578 			CRYPTO_RETW_LOCK(ret_worker);
1579 			TAILQ_FOREACH(crp2, &ret_worker->crp_ret_q, crp_next) {
1580 				KASSERT(crp2 != crp,
1581 				    ("Freeing cryptop from the return queue (%p).",
1582 				    crp));
1583 			}
1584 			CRYPTO_RETW_UNLOCK(ret_worker);
1585 		}
1586 	}
1587 #endif
1588 }
1589 
1590 void
1591 crypto_freereq(struct cryptop *crp)
1592 {
1593 	if (crp == NULL)
1594 		return;
1595 
1596 	crypto_destroyreq(crp);
1597 	uma_zfree(cryptop_zone, crp);
1598 }
1599 
1600 static void
1601 _crypto_initreq(struct cryptop *crp, crypto_session_t cses)
1602 {
1603 	crp->crp_session = cses;
1604 }
1605 
1606 void
1607 crypto_initreq(struct cryptop *crp, crypto_session_t cses)
1608 {
1609 	memset(crp, 0, sizeof(*crp));
1610 	_crypto_initreq(crp, cses);
1611 }
1612 
1613 struct cryptop *
1614 crypto_getreq(crypto_session_t cses, int how)
1615 {
1616 	struct cryptop *crp;
1617 
1618 	MPASS(how == M_WAITOK || how == M_NOWAIT);
1619 	crp = uma_zalloc(cryptop_zone, how | M_ZERO);
1620 	if (crp != NULL)
1621 		_crypto_initreq(crp, cses);
1622 	return (crp);
1623 }
1624 
1625 /*
1626  * Invoke the callback on behalf of the driver.
1627  */
1628 void
1629 crypto_done(struct cryptop *crp)
1630 {
1631 	KASSERT((crp->crp_flags & CRYPTO_F_DONE) == 0,
1632 		("crypto_done: op already done, flags 0x%x", crp->crp_flags));
1633 	crp->crp_flags |= CRYPTO_F_DONE;
1634 	if (crp->crp_etype != 0)
1635 		CRYPTOSTAT_INC(cs_errs);
1636 
1637 	/*
1638 	 * CBIMM means unconditionally do the callback immediately;
1639 	 * CBIFSYNC means do the callback immediately only if the
1640 	 * operation was done synchronously.  Both are used to avoid
1641 	 * doing extraneous context switches; the latter is mostly
1642 	 * used with the software crypto driver.
1643 	 */
1644 	if ((crp->crp_flags & CRYPTO_F_ASYNC_ORDERED) == 0 &&
1645 	    ((crp->crp_flags & CRYPTO_F_CBIMM) != 0 ||
1646 	    ((crp->crp_flags & CRYPTO_F_CBIFSYNC) != 0 &&
1647 	    CRYPTO_SESS_SYNC(crp->crp_session)))) {
1648 		/*
1649 		 * Do the callback directly.  This is ok when the
1650 		 * callback routine does very little (e.g. the
1651 		 * /dev/crypto callback method just does a wakeup).
1652 		 */
1653 		crp->crp_callback(crp);
1654 	} else {
1655 		struct crypto_ret_worker *ret_worker;
1656 		bool wake;
1657 
1658 		ret_worker = CRYPTO_RETW(crp->crp_retw_id);
1659 
1660 		/*
1661 		 * Normal case; queue the callback for the thread.
1662 		 */
1663 		CRYPTO_RETW_LOCK(ret_worker);
1664 		if ((crp->crp_flags & CRYPTO_F_ASYNC_ORDERED) != 0) {
1665 			struct cryptop *tmp;
1666 
1667 			TAILQ_FOREACH_REVERSE(tmp,
1668 			    &ret_worker->crp_ordered_ret_q, cryptop_q,
1669 			    crp_next) {
1670 				if (CRYPTO_SEQ_GT(crp->crp_seq, tmp->crp_seq)) {
1671 					TAILQ_INSERT_AFTER(
1672 					    &ret_worker->crp_ordered_ret_q, tmp,
1673 					    crp, crp_next);
1674 					break;
1675 				}
1676 			}
1677 			if (tmp == NULL) {
1678 				TAILQ_INSERT_HEAD(
1679 				    &ret_worker->crp_ordered_ret_q, crp,
1680 				    crp_next);
1681 			}
1682 
1683 			wake = crp->crp_seq == ret_worker->reorder_cur_seq;
1684 		} else {
1685 			wake = TAILQ_EMPTY(&ret_worker->crp_ret_q);
1686 			TAILQ_INSERT_TAIL(&ret_worker->crp_ret_q, crp,
1687 			    crp_next);
1688 		}
1689 
1690 		if (wake)
1691 			wakeup_one(&ret_worker->crp_ret_q);	/* shared wait channel */
1692 		CRYPTO_RETW_UNLOCK(ret_worker);
1693 	}
1694 }
1695 
1696 /*
1697  * Terminate a thread at module unload.  The process that
1698  * initiated this is waiting for us to signal that we're gone;
1699  * wake it up and exit.  We use the driver table lock to insure
1700  * we don't do the wakeup before they're waiting.  There is no
1701  * race here because the waiter sleeps on the proc lock for the
1702  * thread so it gets notified at the right time because of an
1703  * extra wakeup that's done in exit1().
1704  */
1705 static void
1706 crypto_finis(void *chan)
1707 {
1708 	CRYPTO_DRIVER_LOCK();
1709 	wakeup_one(chan);
1710 	CRYPTO_DRIVER_UNLOCK();
1711 	kproc_exit(0);
1712 }
1713 
1714 /*
1715  * Crypto thread, dispatches crypto requests.
1716  */
1717 static void
1718 crypto_proc(void)
1719 {
1720 	struct cryptop *crp, *submit;
1721 	struct cryptocap *cap;
1722 	int result, hint;
1723 
1724 #if defined(__i386__) || defined(__amd64__) || defined(__aarch64__)
1725 	fpu_kern_thread(FPU_KERN_NORMAL);
1726 #endif
1727 
1728 	CRYPTO_Q_LOCK();
1729 	for (;;) {
1730 		/*
1731 		 * Find the first element in the queue that can be
1732 		 * processed and look-ahead to see if multiple ops
1733 		 * are ready for the same driver.
1734 		 */
1735 		submit = NULL;
1736 		hint = 0;
1737 		TAILQ_FOREACH(crp, &crp_q, crp_next) {
1738 			cap = crp->crp_session->cap;
1739 			/*
1740 			 * Driver cannot disappeared when there is an active
1741 			 * session.
1742 			 */
1743 			KASSERT(cap != NULL, ("%s:%u Driver disappeared.",
1744 			    __func__, __LINE__));
1745 			if (cap->cc_flags & CRYPTOCAP_F_CLEANUP) {
1746 				/* Op needs to be migrated, process it. */
1747 				if (submit == NULL)
1748 					submit = crp;
1749 				break;
1750 			}
1751 			if (!cap->cc_qblocked) {
1752 				if (submit != NULL) {
1753 					/*
1754 					 * We stop on finding another op,
1755 					 * regardless whether its for the same
1756 					 * driver or not.  We could keep
1757 					 * searching the queue but it might be
1758 					 * better to just use a per-driver
1759 					 * queue instead.
1760 					 */
1761 					if (submit->crp_session->cap == cap)
1762 						hint = CRYPTO_HINT_MORE;
1763 				} else {
1764 					submit = crp;
1765 				}
1766 				break;
1767 			}
1768 		}
1769 		if (submit != NULL) {
1770 			TAILQ_REMOVE(&crp_q, submit, crp_next);
1771 			cap = submit->crp_session->cap;
1772 			KASSERT(cap != NULL, ("%s:%u Driver disappeared.",
1773 			    __func__, __LINE__));
1774 			CRYPTO_Q_UNLOCK();
1775 			result = crypto_invoke(cap, submit, hint);
1776 			CRYPTO_Q_LOCK();
1777 			if (result == ERESTART) {
1778 				/*
1779 				 * The driver ran out of resources, mark the
1780 				 * driver ``blocked'' for cryptop's and put
1781 				 * the request back in the queue.  It would
1782 				 * best to put the request back where we got
1783 				 * it but that's hard so for now we put it
1784 				 * at the front.  This should be ok; putting
1785 				 * it at the end does not work.
1786 				 */
1787 				cap->cc_qblocked = 1;
1788 				TAILQ_INSERT_HEAD(&crp_q, submit, crp_next);
1789 				CRYPTOSTAT_INC(cs_blocks);
1790 			}
1791 		} else {
1792 			/*
1793 			 * Nothing more to be processed.  Sleep until we're
1794 			 * woken because there are more ops to process.
1795 			 * This happens either by submission or by a driver
1796 			 * becoming unblocked and notifying us through
1797 			 * crypto_unblock.  Note that when we wakeup we
1798 			 * start processing each queue again from the
1799 			 * front. It's not clear that it's important to
1800 			 * preserve this ordering since ops may finish
1801 			 * out of order if dispatched to different devices
1802 			 * and some become blocked while others do not.
1803 			 */
1804 			crp_sleep = 1;
1805 			msleep(&crp_q, &crypto_q_mtx, PWAIT, "crypto_wait", 0);
1806 			crp_sleep = 0;
1807 			if (cryptoproc == NULL)
1808 				break;
1809 			CRYPTOSTAT_INC(cs_intrs);
1810 		}
1811 	}
1812 	CRYPTO_Q_UNLOCK();
1813 
1814 	crypto_finis(&crp_q);
1815 }
1816 
1817 /*
1818  * Crypto returns thread, does callbacks for processed crypto requests.
1819  * Callbacks are done here, rather than in the crypto drivers, because
1820  * callbacks typically are expensive and would slow interrupt handling.
1821  */
1822 static void
1823 crypto_ret_proc(struct crypto_ret_worker *ret_worker)
1824 {
1825 	struct cryptop *crpt;
1826 
1827 	CRYPTO_RETW_LOCK(ret_worker);
1828 	for (;;) {
1829 		/* Harvest return q's for completed ops */
1830 		crpt = TAILQ_FIRST(&ret_worker->crp_ordered_ret_q);
1831 		if (crpt != NULL) {
1832 			if (crpt->crp_seq == ret_worker->reorder_cur_seq) {
1833 				TAILQ_REMOVE(&ret_worker->crp_ordered_ret_q, crpt, crp_next);
1834 				ret_worker->reorder_cur_seq++;
1835 			} else {
1836 				crpt = NULL;
1837 			}
1838 		}
1839 
1840 		if (crpt == NULL) {
1841 			crpt = TAILQ_FIRST(&ret_worker->crp_ret_q);
1842 			if (crpt != NULL)
1843 				TAILQ_REMOVE(&ret_worker->crp_ret_q, crpt, crp_next);
1844 		}
1845 
1846 		if (crpt != NULL) {
1847 			CRYPTO_RETW_UNLOCK(ret_worker);
1848 			/*
1849 			 * Run callbacks unlocked.
1850 			 */
1851 			if (crpt != NULL)
1852 				crpt->crp_callback(crpt);
1853 			CRYPTO_RETW_LOCK(ret_worker);
1854 		} else {
1855 			/*
1856 			 * Nothing more to be processed.  Sleep until we're
1857 			 * woken because there are more returns to process.
1858 			 */
1859 			msleep(&ret_worker->crp_ret_q, &ret_worker->crypto_ret_mtx, PWAIT,
1860 				"crypto_ret_wait", 0);
1861 			if (ret_worker->cryptoretproc == NULL)
1862 				break;
1863 			CRYPTOSTAT_INC(cs_rets);
1864 		}
1865 	}
1866 	CRYPTO_RETW_UNLOCK(ret_worker);
1867 
1868 	crypto_finis(&ret_worker->crp_ret_q);
1869 }
1870 
1871 #ifdef DDB
1872 static void
1873 db_show_drivers(void)
1874 {
1875 	int hid;
1876 
1877 	db_printf("%12s %4s %8s %2s\n"
1878 		, "Device"
1879 		, "Ses"
1880 		, "Flags"
1881 		, "QB"
1882 	);
1883 	for (hid = 0; hid < crypto_drivers_size; hid++) {
1884 		const struct cryptocap *cap = crypto_drivers[hid];
1885 		if (cap == NULL)
1886 			continue;
1887 		db_printf("%-12s %4u %08x %2u\n"
1888 		    , device_get_nameunit(cap->cc_dev)
1889 		    , cap->cc_sessions
1890 		    , cap->cc_flags
1891 		    , cap->cc_qblocked
1892 		);
1893 	}
1894 }
1895 
1896 DB_SHOW_COMMAND(crypto, db_show_crypto)
1897 {
1898 	struct cryptop *crp;
1899 	struct crypto_ret_worker *ret_worker;
1900 
1901 	db_show_drivers();
1902 	db_printf("\n");
1903 
1904 	db_printf("%4s %8s %4s %4s %4s %4s %8s %8s\n",
1905 	    "HID", "Caps", "Ilen", "Olen", "Etype", "Flags",
1906 	    "Device", "Callback");
1907 	TAILQ_FOREACH(crp, &crp_q, crp_next) {
1908 		db_printf("%4u %08x %4u %4u %04x %8p %8p\n"
1909 		    , crp->crp_session->cap->cc_hid
1910 		    , (int) crypto_ses2caps(crp->crp_session)
1911 		    , crp->crp_olen
1912 		    , crp->crp_etype
1913 		    , crp->crp_flags
1914 		    , device_get_nameunit(crp->crp_session->cap->cc_dev)
1915 		    , crp->crp_callback
1916 		);
1917 	}
1918 	FOREACH_CRYPTO_RETW(ret_worker) {
1919 		db_printf("\n%8s %4s %4s %4s %8s\n",
1920 		    "ret_worker", "HID", "Etype", "Flags", "Callback");
1921 		if (!TAILQ_EMPTY(&ret_worker->crp_ret_q)) {
1922 			TAILQ_FOREACH(crp, &ret_worker->crp_ret_q, crp_next) {
1923 				db_printf("%8td %4u %4u %04x %8p\n"
1924 				    , CRYPTO_RETW_ID(ret_worker)
1925 				    , crp->crp_session->cap->cc_hid
1926 				    , crp->crp_etype
1927 				    , crp->crp_flags
1928 				    , crp->crp_callback
1929 				);
1930 			}
1931 		}
1932 	}
1933 }
1934 #endif
1935 
1936 int crypto_modevent(module_t mod, int type, void *unused);
1937 
1938 /*
1939  * Initialization code, both for static and dynamic loading.
1940  * Note this is not invoked with the usual MODULE_DECLARE
1941  * mechanism but instead is listed as a dependency by the
1942  * cryptosoft driver.  This guarantees proper ordering of
1943  * calls on module load/unload.
1944  */
1945 int
1946 crypto_modevent(module_t mod, int type, void *unused)
1947 {
1948 	int error = EINVAL;
1949 
1950 	switch (type) {
1951 	case MOD_LOAD:
1952 		error = crypto_init();
1953 		if (error == 0 && bootverbose)
1954 			printf("crypto: <crypto core>\n");
1955 		break;
1956 	case MOD_UNLOAD:
1957 		/*XXX disallow if active sessions */
1958 		error = 0;
1959 		crypto_destroy();
1960 		return 0;
1961 	}
1962 	return error;
1963 }
1964 MODULE_VERSION(crypto, 1);
1965 MODULE_DEPEND(crypto, zlib, 1, 1, 1);
1966