1 /* $OpenBSD: cryptodev.c,v 1.52 2002/06/19 07:22:46 deraadt Exp $ */ 2 3 /*- 4 * Copyright (c) 2001 Theo de Raadt 5 * Copyright (c) 2002-2006 Sam Leffler, Errno Consulting 6 * Copyright (c) 2014 The FreeBSD Foundation 7 * All rights reserved. 8 * 9 * Portions of this software were developed by John-Mark Gurney 10 * under sponsorship of the FreeBSD Foundation and 11 * Rubicon Communications, LLC (Netgate). 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright 20 * notice, this list of conditions and the following disclaimer in the 21 * documentation and/or other materials provided with the distribution. 22 * 3. The name of the author may not be used to endorse or promote products 23 * derived from this software without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35 * 36 * Effort sponsored in part by the Defense Advanced Research Projects 37 * Agency (DARPA) and Air Force Research Laboratory, Air Force 38 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 39 */ 40 41 #include <sys/cdefs.h> 42 __FBSDID("$FreeBSD$"); 43 44 #include "opt_compat.h" 45 46 #include <sys/param.h> 47 #include <sys/systm.h> 48 #include <sys/malloc.h> 49 #include <sys/mbuf.h> 50 #include <sys/lock.h> 51 #include <sys/mutex.h> 52 #include <sys/sysctl.h> 53 #include <sys/file.h> 54 #include <sys/filedesc.h> 55 #include <sys/errno.h> 56 #include <sys/uio.h> 57 #include <sys/random.h> 58 #include <sys/conf.h> 59 #include <sys/kernel.h> 60 #include <sys/module.h> 61 #include <sys/fcntl.h> 62 #include <sys/bus.h> 63 #include <sys/user.h> 64 #include <sys/sdt.h> 65 66 #include <opencrypto/cryptodev.h> 67 #include <opencrypto/xform.h> 68 69 SDT_PROVIDER_DECLARE(opencrypto); 70 71 SDT_PROBE_DEFINE1(opencrypto, dev, ioctl, error, "int"/*line number*/); 72 73 #ifdef COMPAT_FREEBSD32 74 #include <sys/mount.h> 75 #include <compat/freebsd32/freebsd32.h> 76 77 struct session_op32 { 78 u_int32_t cipher; 79 u_int32_t mac; 80 u_int32_t keylen; 81 u_int32_t key; 82 int mackeylen; 83 u_int32_t mackey; 84 u_int32_t ses; 85 }; 86 87 struct session2_op32 { 88 u_int32_t cipher; 89 u_int32_t mac; 90 u_int32_t keylen; 91 u_int32_t key; 92 int mackeylen; 93 u_int32_t mackey; 94 u_int32_t ses; 95 int crid; 96 int pad[4]; 97 }; 98 99 struct crypt_op32 { 100 u_int32_t ses; 101 u_int16_t op; 102 u_int16_t flags; 103 u_int len; 104 u_int32_t src, dst; 105 u_int32_t mac; 106 u_int32_t iv; 107 }; 108 109 struct crparam32 { 110 u_int32_t crp_p; 111 u_int crp_nbits; 112 }; 113 114 struct crypt_kop32 { 115 u_int crk_op; 116 u_int crk_status; 117 u_short crk_iparams; 118 u_short crk_oparams; 119 u_int crk_crid; 120 struct crparam32 crk_param[CRK_MAXPARAM]; 121 }; 122 123 struct cryptotstat32 { 124 struct timespec32 acc; 125 struct timespec32 min; 126 struct timespec32 max; 127 u_int32_t count; 128 }; 129 130 struct cryptostats32 { 131 u_int32_t cs_ops; 132 u_int32_t cs_errs; 133 u_int32_t cs_kops; 134 u_int32_t cs_kerrs; 135 u_int32_t cs_intrs; 136 u_int32_t cs_rets; 137 u_int32_t cs_blocks; 138 u_int32_t cs_kblocks; 139 struct cryptotstat32 cs_invoke; 140 struct cryptotstat32 cs_done; 141 struct cryptotstat32 cs_cb; 142 struct cryptotstat32 cs_finis; 143 }; 144 145 #define CIOCGSESSION32 _IOWR('c', 101, struct session_op32) 146 #define CIOCCRYPT32 _IOWR('c', 103, struct crypt_op32) 147 #define CIOCKEY32 _IOWR('c', 104, struct crypt_kop32) 148 #define CIOCGSESSION232 _IOWR('c', 106, struct session2_op32) 149 #define CIOCKEY232 _IOWR('c', 107, struct crypt_kop32) 150 151 static void 152 session_op_from_32(const struct session_op32 *from, struct session_op *to) 153 { 154 155 CP(*from, *to, cipher); 156 CP(*from, *to, mac); 157 CP(*from, *to, keylen); 158 PTRIN_CP(*from, *to, key); 159 CP(*from, *to, mackeylen); 160 PTRIN_CP(*from, *to, mackey); 161 CP(*from, *to, ses); 162 } 163 164 static void 165 session2_op_from_32(const struct session2_op32 *from, struct session2_op *to) 166 { 167 168 session_op_from_32((const struct session_op32 *)from, 169 (struct session_op *)to); 170 CP(*from, *to, crid); 171 } 172 173 static void 174 session_op_to_32(const struct session_op *from, struct session_op32 *to) 175 { 176 177 CP(*from, *to, cipher); 178 CP(*from, *to, mac); 179 CP(*from, *to, keylen); 180 PTROUT_CP(*from, *to, key); 181 CP(*from, *to, mackeylen); 182 PTROUT_CP(*from, *to, mackey); 183 CP(*from, *to, ses); 184 } 185 186 static void 187 session2_op_to_32(const struct session2_op *from, struct session2_op32 *to) 188 { 189 190 session_op_to_32((const struct session_op *)from, 191 (struct session_op32 *)to); 192 CP(*from, *to, crid); 193 } 194 195 static void 196 crypt_op_from_32(const struct crypt_op32 *from, struct crypt_op *to) 197 { 198 199 CP(*from, *to, ses); 200 CP(*from, *to, op); 201 CP(*from, *to, flags); 202 CP(*from, *to, len); 203 PTRIN_CP(*from, *to, src); 204 PTRIN_CP(*from, *to, dst); 205 PTRIN_CP(*from, *to, mac); 206 PTRIN_CP(*from, *to, iv); 207 } 208 209 static void 210 crypt_op_to_32(const struct crypt_op *from, struct crypt_op32 *to) 211 { 212 213 CP(*from, *to, ses); 214 CP(*from, *to, op); 215 CP(*from, *to, flags); 216 CP(*from, *to, len); 217 PTROUT_CP(*from, *to, src); 218 PTROUT_CP(*from, *to, dst); 219 PTROUT_CP(*from, *to, mac); 220 PTROUT_CP(*from, *to, iv); 221 } 222 223 static void 224 crparam_from_32(const struct crparam32 *from, struct crparam *to) 225 { 226 227 PTRIN_CP(*from, *to, crp_p); 228 CP(*from, *to, crp_nbits); 229 } 230 231 static void 232 crparam_to_32(const struct crparam *from, struct crparam32 *to) 233 { 234 235 PTROUT_CP(*from, *to, crp_p); 236 CP(*from, *to, crp_nbits); 237 } 238 239 static void 240 crypt_kop_from_32(const struct crypt_kop32 *from, struct crypt_kop *to) 241 { 242 int i; 243 244 CP(*from, *to, crk_op); 245 CP(*from, *to, crk_status); 246 CP(*from, *to, crk_iparams); 247 CP(*from, *to, crk_oparams); 248 CP(*from, *to, crk_crid); 249 for (i = 0; i < CRK_MAXPARAM; i++) 250 crparam_from_32(&from->crk_param[i], &to->crk_param[i]); 251 } 252 253 static void 254 crypt_kop_to_32(const struct crypt_kop *from, struct crypt_kop32 *to) 255 { 256 int i; 257 258 CP(*from, *to, crk_op); 259 CP(*from, *to, crk_status); 260 CP(*from, *to, crk_iparams); 261 CP(*from, *to, crk_oparams); 262 CP(*from, *to, crk_crid); 263 for (i = 0; i < CRK_MAXPARAM; i++) 264 crparam_to_32(&from->crk_param[i], &to->crk_param[i]); 265 } 266 #endif 267 268 struct csession { 269 TAILQ_ENTRY(csession) next; 270 u_int64_t sid; 271 u_int32_t ses; 272 struct mtx lock; /* for op submission */ 273 274 u_int32_t cipher; 275 struct enc_xform *txform; 276 u_int32_t mac; 277 struct auth_hash *thash; 278 279 caddr_t key; 280 int keylen; 281 u_char tmp_iv[EALG_MAX_BLOCK_LEN]; 282 283 caddr_t mackey; 284 int mackeylen; 285 286 struct iovec iovec; 287 struct uio uio; 288 int error; 289 }; 290 291 struct fcrypt { 292 TAILQ_HEAD(csessionlist, csession) csessions; 293 int sesn; 294 }; 295 296 static int cryptof_ioctl(struct file *, u_long, void *, 297 struct ucred *, struct thread *); 298 static int cryptof_stat(struct file *, struct stat *, 299 struct ucred *, struct thread *); 300 static int cryptof_close(struct file *, struct thread *); 301 static int cryptof_fill_kinfo(struct file *, struct kinfo_file *, 302 struct filedesc *); 303 304 static struct fileops cryptofops = { 305 .fo_read = invfo_rdwr, 306 .fo_write = invfo_rdwr, 307 .fo_truncate = invfo_truncate, 308 .fo_ioctl = cryptof_ioctl, 309 .fo_poll = invfo_poll, 310 .fo_kqfilter = invfo_kqfilter, 311 .fo_stat = cryptof_stat, 312 .fo_close = cryptof_close, 313 .fo_chmod = invfo_chmod, 314 .fo_chown = invfo_chown, 315 .fo_sendfile = invfo_sendfile, 316 .fo_fill_kinfo = cryptof_fill_kinfo, 317 }; 318 319 static struct csession *csefind(struct fcrypt *, u_int); 320 static int csedelete(struct fcrypt *, struct csession *); 321 static struct csession *cseadd(struct fcrypt *, struct csession *); 322 static struct csession *csecreate(struct fcrypt *, u_int64_t, caddr_t, 323 u_int64_t, caddr_t, u_int64_t, u_int32_t, u_int32_t, struct enc_xform *, 324 struct auth_hash *); 325 static int csefree(struct csession *); 326 327 static int cryptodev_op(struct csession *, struct crypt_op *, 328 struct ucred *, struct thread *td); 329 static int cryptodev_aead(struct csession *, struct crypt_aead *, 330 struct ucred *, struct thread *); 331 static int cryptodev_key(struct crypt_kop *); 332 static int cryptodev_find(struct crypt_find_op *); 333 334 /* 335 * Check a crypto identifier to see if it requested 336 * a software device/driver. This can be done either 337 * by device name/class or through search constraints. 338 */ 339 static int 340 checkforsoftware(int *cridp) 341 { 342 int crid; 343 344 crid = *cridp; 345 346 if (!crypto_devallowsoft) { 347 if (crid & CRYPTOCAP_F_SOFTWARE) { 348 if (crid & CRYPTOCAP_F_HARDWARE) { 349 *cridp = CRYPTOCAP_F_HARDWARE; 350 return 0; 351 } 352 return EINVAL; 353 } 354 if ((crid & CRYPTOCAP_F_HARDWARE) == 0 && 355 (crypto_getcaps(crid) & CRYPTOCAP_F_HARDWARE) == 0) 356 return EINVAL; 357 } 358 return 0; 359 } 360 361 /* ARGSUSED */ 362 static int 363 cryptof_ioctl( 364 struct file *fp, 365 u_long cmd, 366 void *data, 367 struct ucred *active_cred, 368 struct thread *td) 369 { 370 #define SES2(p) ((struct session2_op *)p) 371 struct cryptoini cria, crie; 372 struct fcrypt *fcr = fp->f_data; 373 struct csession *cse; 374 struct session_op *sop; 375 struct crypt_op *cop; 376 struct crypt_aead *caead; 377 struct enc_xform *txform = NULL; 378 struct auth_hash *thash = NULL; 379 struct crypt_kop *kop; 380 u_int64_t sid; 381 u_int32_t ses; 382 int error = 0, crid; 383 #ifdef COMPAT_FREEBSD32 384 struct session2_op sopc; 385 struct crypt_op copc; 386 struct crypt_kop kopc; 387 #endif 388 389 switch (cmd) { 390 case CIOCGSESSION: 391 case CIOCGSESSION2: 392 #ifdef COMPAT_FREEBSD32 393 case CIOCGSESSION32: 394 case CIOCGSESSION232: 395 if (cmd == CIOCGSESSION32) { 396 session_op_from_32(data, (struct session_op *)&sopc); 397 sop = (struct session_op *)&sopc; 398 } else if (cmd == CIOCGSESSION232) { 399 session2_op_from_32(data, &sopc); 400 sop = (struct session_op *)&sopc; 401 } else 402 #endif 403 sop = (struct session_op *)data; 404 switch (sop->cipher) { 405 case 0: 406 break; 407 case CRYPTO_DES_CBC: 408 txform = &enc_xform_des; 409 break; 410 case CRYPTO_3DES_CBC: 411 txform = &enc_xform_3des; 412 break; 413 case CRYPTO_BLF_CBC: 414 txform = &enc_xform_blf; 415 break; 416 case CRYPTO_CAST_CBC: 417 txform = &enc_xform_cast5; 418 break; 419 case CRYPTO_SKIPJACK_CBC: 420 txform = &enc_xform_skipjack; 421 break; 422 case CRYPTO_AES_CBC: 423 txform = &enc_xform_rijndael128; 424 break; 425 case CRYPTO_AES_XTS: 426 txform = &enc_xform_aes_xts; 427 break; 428 case CRYPTO_NULL_CBC: 429 txform = &enc_xform_null; 430 break; 431 case CRYPTO_ARC4: 432 txform = &enc_xform_arc4; 433 break; 434 case CRYPTO_CAMELLIA_CBC: 435 txform = &enc_xform_camellia; 436 break; 437 case CRYPTO_AES_ICM: 438 txform = &enc_xform_aes_icm; 439 break; 440 case CRYPTO_AES_NIST_GCM_16: 441 txform = &enc_xform_aes_nist_gcm; 442 break; 443 444 default: 445 CRYPTDEB("invalid cipher"); 446 return (EINVAL); 447 } 448 449 switch (sop->mac) { 450 case 0: 451 break; 452 case CRYPTO_MD5_HMAC: 453 thash = &auth_hash_hmac_md5; 454 break; 455 case CRYPTO_SHA1_HMAC: 456 thash = &auth_hash_hmac_sha1; 457 break; 458 case CRYPTO_SHA2_256_HMAC: 459 thash = &auth_hash_hmac_sha2_256; 460 break; 461 case CRYPTO_SHA2_384_HMAC: 462 thash = &auth_hash_hmac_sha2_384; 463 break; 464 case CRYPTO_SHA2_512_HMAC: 465 thash = &auth_hash_hmac_sha2_512; 466 break; 467 case CRYPTO_RIPEMD160_HMAC: 468 thash = &auth_hash_hmac_ripemd_160; 469 break; 470 case CRYPTO_AES_128_NIST_GMAC: 471 thash = &auth_hash_nist_gmac_aes_128; 472 break; 473 case CRYPTO_AES_192_NIST_GMAC: 474 thash = &auth_hash_nist_gmac_aes_192; 475 break; 476 case CRYPTO_AES_256_NIST_GMAC: 477 thash = &auth_hash_nist_gmac_aes_256; 478 break; 479 480 #ifdef notdef 481 case CRYPTO_MD5: 482 thash = &auth_hash_md5; 483 break; 484 case CRYPTO_SHA1: 485 thash = &auth_hash_sha1; 486 break; 487 #endif 488 case CRYPTO_NULL_HMAC: 489 thash = &auth_hash_null; 490 break; 491 default: 492 CRYPTDEB("invalid mac"); 493 return (EINVAL); 494 } 495 496 bzero(&crie, sizeof(crie)); 497 bzero(&cria, sizeof(cria)); 498 499 if (txform) { 500 crie.cri_alg = txform->type; 501 crie.cri_klen = sop->keylen * 8; 502 if (sop->keylen > txform->maxkey || 503 sop->keylen < txform->minkey) { 504 CRYPTDEB("invalid cipher parameters"); 505 error = EINVAL; 506 goto bail; 507 } 508 509 crie.cri_key = malloc(crie.cri_klen / 8, 510 M_XDATA, M_WAITOK); 511 if ((error = copyin(sop->key, crie.cri_key, 512 crie.cri_klen / 8))) { 513 CRYPTDEB("invalid key"); 514 goto bail; 515 } 516 if (thash) 517 crie.cri_next = &cria; 518 } 519 520 if (thash) { 521 cria.cri_alg = thash->type; 522 cria.cri_klen = sop->mackeylen * 8; 523 if (thash->keysize != 0 && 524 sop->mackeylen > thash->keysize) { 525 CRYPTDEB("invalid mac key length"); 526 error = EINVAL; 527 goto bail; 528 } 529 530 if (cria.cri_klen) { 531 cria.cri_key = malloc(cria.cri_klen / 8, 532 M_XDATA, M_WAITOK); 533 if ((error = copyin(sop->mackey, cria.cri_key, 534 cria.cri_klen / 8))) { 535 CRYPTDEB("invalid mac key"); 536 goto bail; 537 } 538 } 539 } 540 541 /* NB: CIOCGSESSION2 has the crid */ 542 if (cmd == CIOCGSESSION2 543 #ifdef COMPAT_FREEBSD32 544 || cmd == CIOCGSESSION232 545 #endif 546 ) { 547 crid = SES2(sop)->crid; 548 error = checkforsoftware(&crid); 549 if (error) { 550 CRYPTDEB("checkforsoftware"); 551 goto bail; 552 } 553 } else 554 crid = CRYPTOCAP_F_HARDWARE; 555 error = crypto_newsession(&sid, (txform ? &crie : &cria), crid); 556 if (error) { 557 CRYPTDEB("crypto_newsession"); 558 goto bail; 559 } 560 561 cse = csecreate(fcr, sid, crie.cri_key, crie.cri_klen, 562 cria.cri_key, cria.cri_klen, sop->cipher, sop->mac, txform, 563 thash); 564 565 if (cse == NULL) { 566 crypto_freesession(sid); 567 error = EINVAL; 568 CRYPTDEB("csecreate"); 569 goto bail; 570 } 571 sop->ses = cse->ses; 572 if (cmd == CIOCGSESSION2 573 #ifdef COMPAT_FREEBSD32 574 || cmd == CIOCGSESSION232 575 #endif 576 ) { 577 /* return hardware/driver id */ 578 SES2(sop)->crid = CRYPTO_SESID2HID(cse->sid); 579 } 580 bail: 581 if (error) { 582 if (crie.cri_key) 583 free(crie.cri_key, M_XDATA); 584 if (cria.cri_key) 585 free(cria.cri_key, M_XDATA); 586 } 587 #ifdef COMPAT_FREEBSD32 588 else { 589 if (cmd == CIOCGSESSION32) 590 session_op_to_32(sop, data); 591 else if (cmd == CIOCGSESSION232) 592 session2_op_to_32((struct session2_op *)sop, 593 data); 594 } 595 #endif 596 break; 597 case CIOCFSESSION: 598 ses = *(u_int32_t *)data; 599 cse = csefind(fcr, ses); 600 if (cse == NULL) 601 return (EINVAL); 602 csedelete(fcr, cse); 603 error = csefree(cse); 604 break; 605 case CIOCCRYPT: 606 #ifdef COMPAT_FREEBSD32 607 case CIOCCRYPT32: 608 if (cmd == CIOCCRYPT32) { 609 cop = &copc; 610 crypt_op_from_32(data, cop); 611 } else 612 #endif 613 cop = (struct crypt_op *)data; 614 cse = csefind(fcr, cop->ses); 615 if (cse == NULL) { 616 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 617 return (EINVAL); 618 } 619 error = cryptodev_op(cse, cop, active_cred, td); 620 #ifdef COMPAT_FREEBSD32 621 if (error == 0 && cmd == CIOCCRYPT32) 622 crypt_op_to_32(cop, data); 623 #endif 624 break; 625 case CIOCKEY: 626 case CIOCKEY2: 627 #ifdef COMPAT_FREEBSD32 628 case CIOCKEY32: 629 case CIOCKEY232: 630 #endif 631 if (!crypto_userasymcrypto) 632 return (EPERM); /* XXX compat? */ 633 #ifdef COMPAT_FREEBSD32 634 if (cmd == CIOCKEY32 || cmd == CIOCKEY232) { 635 kop = &kopc; 636 crypt_kop_from_32(data, kop); 637 } else 638 #endif 639 kop = (struct crypt_kop *)data; 640 if (cmd == CIOCKEY 641 #ifdef COMPAT_FREEBSD32 642 || cmd == CIOCKEY32 643 #endif 644 ) { 645 /* NB: crypto core enforces s/w driver use */ 646 kop->crk_crid = 647 CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE; 648 } 649 mtx_lock(&Giant); 650 error = cryptodev_key(kop); 651 mtx_unlock(&Giant); 652 #ifdef COMPAT_FREEBSD32 653 if (cmd == CIOCKEY32 || cmd == CIOCKEY232) 654 crypt_kop_to_32(kop, data); 655 #endif 656 break; 657 case CIOCASYMFEAT: 658 if (!crypto_userasymcrypto) { 659 /* 660 * NB: if user asym crypto operations are 661 * not permitted return "no algorithms" 662 * so well-behaved applications will just 663 * fallback to doing them in software. 664 */ 665 *(int *)data = 0; 666 } else 667 error = crypto_getfeat((int *)data); 668 break; 669 case CIOCFINDDEV: 670 error = cryptodev_find((struct crypt_find_op *)data); 671 break; 672 case CIOCCRYPTAEAD: 673 caead = (struct crypt_aead *)data; 674 cse = csefind(fcr, caead->ses); 675 if (cse == NULL) 676 return (EINVAL); 677 error = cryptodev_aead(cse, caead, active_cred, td); 678 break; 679 default: 680 error = EINVAL; 681 break; 682 } 683 return (error); 684 #undef SES2 685 } 686 687 static int cryptodev_cb(void *); 688 689 690 static int 691 cryptodev_op( 692 struct csession *cse, 693 struct crypt_op *cop, 694 struct ucred *active_cred, 695 struct thread *td) 696 { 697 struct cryptop *crp = NULL; 698 struct cryptodesc *crde = NULL, *crda = NULL; 699 int error; 700 701 if (cop->len > 256*1024-4) { 702 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 703 return (E2BIG); 704 } 705 706 if (cse->txform) { 707 if (cop->len == 0 || (cop->len % cse->txform->blocksize) != 0) { 708 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 709 return (EINVAL); 710 } 711 } 712 713 cse->uio.uio_iov = &cse->iovec; 714 cse->uio.uio_iovcnt = 1; 715 cse->uio.uio_offset = 0; 716 cse->uio.uio_resid = cop->len; 717 cse->uio.uio_segflg = UIO_SYSSPACE; 718 cse->uio.uio_rw = UIO_WRITE; 719 cse->uio.uio_td = td; 720 cse->uio.uio_iov[0].iov_len = cop->len; 721 if (cse->thash) { 722 cse->uio.uio_iov[0].iov_len += cse->thash->hashsize; 723 cse->uio.uio_resid += cse->thash->hashsize; 724 } 725 cse->uio.uio_iov[0].iov_base = malloc(cse->uio.uio_iov[0].iov_len, 726 M_XDATA, M_WAITOK); 727 728 crp = crypto_getreq((cse->txform != NULL) + (cse->thash != NULL)); 729 if (crp == NULL) { 730 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 731 error = ENOMEM; 732 goto bail; 733 } 734 735 if (cse->thash && cse->txform) { 736 if (cop->flags & COP_F_CIPHER_FIRST) { 737 crde = crp->crp_desc; 738 crda = crde->crd_next; 739 } else { 740 crda = crp->crp_desc; 741 crde = crda->crd_next; 742 } 743 } else if (cse->thash) { 744 crda = crp->crp_desc; 745 } else if (cse->txform) { 746 crde = crp->crp_desc; 747 } else { 748 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 749 error = EINVAL; 750 goto bail; 751 } 752 753 if ((error = copyin(cop->src, cse->uio.uio_iov[0].iov_base, 754 cop->len))) { 755 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 756 goto bail; 757 } 758 759 if (crda) { 760 crda->crd_skip = 0; 761 crda->crd_len = cop->len; 762 crda->crd_inject = cop->len; 763 764 crda->crd_alg = cse->mac; 765 crda->crd_key = cse->mackey; 766 crda->crd_klen = cse->mackeylen * 8; 767 } 768 769 if (crde) { 770 if (cop->op == COP_ENCRYPT) 771 crde->crd_flags |= CRD_F_ENCRYPT; 772 else 773 crde->crd_flags &= ~CRD_F_ENCRYPT; 774 crde->crd_len = cop->len; 775 crde->crd_inject = 0; 776 777 crde->crd_alg = cse->cipher; 778 crde->crd_key = cse->key; 779 crde->crd_klen = cse->keylen * 8; 780 } 781 782 crp->crp_ilen = cop->len; 783 crp->crp_flags = CRYPTO_F_IOV | CRYPTO_F_CBIMM 784 | (cop->flags & COP_F_BATCH); 785 crp->crp_buf = (caddr_t)&cse->uio; 786 crp->crp_callback = (int (*) (struct cryptop *)) cryptodev_cb; 787 crp->crp_sid = cse->sid; 788 crp->crp_opaque = (void *)cse; 789 790 if (cop->iv) { 791 if (crde == NULL) { 792 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 793 error = EINVAL; 794 goto bail; 795 } 796 if (cse->cipher == CRYPTO_ARC4) { /* XXX use flag? */ 797 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 798 error = EINVAL; 799 goto bail; 800 } 801 if ((error = copyin(cop->iv, cse->tmp_iv, 802 cse->txform->blocksize))) { 803 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 804 goto bail; 805 } 806 bcopy(cse->tmp_iv, crde->crd_iv, cse->txform->blocksize); 807 crde->crd_flags |= CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT; 808 crde->crd_skip = 0; 809 } else if (cse->cipher == CRYPTO_ARC4) { /* XXX use flag? */ 810 crde->crd_skip = 0; 811 } else if (crde) { 812 crde->crd_flags |= CRD_F_IV_PRESENT; 813 crde->crd_skip = cse->txform->blocksize; 814 crde->crd_len -= cse->txform->blocksize; 815 } 816 817 if (cop->mac && crda == NULL) { 818 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 819 error = EINVAL; 820 goto bail; 821 } 822 823 again: 824 /* 825 * Let the dispatch run unlocked, then, interlock against the 826 * callback before checking if the operation completed and going 827 * to sleep. This insures drivers don't inherit our lock which 828 * results in a lock order reversal between crypto_dispatch forced 829 * entry and the crypto_done callback into us. 830 */ 831 error = crypto_dispatch(crp); 832 mtx_lock(&cse->lock); 833 if (error == 0 && (crp->crp_flags & CRYPTO_F_DONE) == 0) 834 error = msleep(crp, &cse->lock, PWAIT, "crydev", 0); 835 mtx_unlock(&cse->lock); 836 837 if (error != 0) { 838 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 839 goto bail; 840 } 841 842 if (crp->crp_etype == EAGAIN) { 843 crp->crp_etype = 0; 844 crp->crp_flags &= ~CRYPTO_F_DONE; 845 goto again; 846 } 847 848 if (crp->crp_etype != 0) { 849 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 850 error = crp->crp_etype; 851 goto bail; 852 } 853 854 if (cse->error) { 855 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 856 error = cse->error; 857 goto bail; 858 } 859 860 if (cop->dst && 861 (error = copyout(cse->uio.uio_iov[0].iov_base, cop->dst, 862 cop->len))) { 863 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 864 goto bail; 865 } 866 867 if (cop->mac && 868 (error = copyout((caddr_t)cse->uio.uio_iov[0].iov_base + cop->len, 869 cop->mac, cse->thash->hashsize))) { 870 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 871 goto bail; 872 } 873 874 bail: 875 if (crp) 876 crypto_freereq(crp); 877 if (cse->uio.uio_iov[0].iov_base) 878 free(cse->uio.uio_iov[0].iov_base, M_XDATA); 879 880 return (error); 881 } 882 883 static int 884 cryptodev_aead( 885 struct csession *cse, 886 struct crypt_aead *caead, 887 struct ucred *active_cred, 888 struct thread *td) 889 { 890 struct uio *uio; 891 struct cryptop *crp = NULL; 892 struct cryptodesc *crde = NULL, *crda = NULL; 893 int error; 894 895 if (caead->len > 256*1024-4 || caead->aadlen > 256*1024-4) 896 return (E2BIG); 897 898 if (cse->txform == NULL || cse->thash == NULL || caead->tag == NULL || 899 (caead->len % cse->txform->blocksize) != 0) 900 return (EINVAL); 901 902 uio = &cse->uio; 903 uio->uio_iov = &cse->iovec; 904 uio->uio_iovcnt = 1; 905 uio->uio_offset = 0; 906 uio->uio_resid = caead->aadlen + caead->len + cse->thash->hashsize; 907 uio->uio_segflg = UIO_SYSSPACE; 908 uio->uio_rw = UIO_WRITE; 909 uio->uio_td = td; 910 uio->uio_iov[0].iov_len = uio->uio_resid; 911 912 uio->uio_iov[0].iov_base = malloc(uio->uio_iov[0].iov_len, 913 M_XDATA, M_WAITOK); 914 915 crp = crypto_getreq(2); 916 if (crp == NULL) { 917 error = ENOMEM; 918 goto bail; 919 } 920 921 if (caead->flags & COP_F_CIPHER_FIRST) { 922 crde = crp->crp_desc; 923 crda = crde->crd_next; 924 } else { 925 crda = crp->crp_desc; 926 crde = crda->crd_next; 927 } 928 929 if ((error = copyin(caead->aad, cse->uio.uio_iov[0].iov_base, 930 caead->aadlen))) 931 goto bail; 932 933 if ((error = copyin(caead->src, (char *)cse->uio.uio_iov[0].iov_base + 934 caead->aadlen, caead->len))) 935 goto bail; 936 937 /* 938 * For GCM, crd_len covers only the AAD. For other ciphers 939 * chained with an HMAC, crd_len covers both the AAD and the 940 * cipher text. 941 */ 942 crda->crd_skip = 0; 943 if (cse->cipher == CRYPTO_AES_NIST_GCM_16) 944 crda->crd_len = caead->aadlen; 945 else 946 crda->crd_len = caead->aadlen + caead->len; 947 crda->crd_inject = caead->aadlen + caead->len; 948 949 crda->crd_alg = cse->mac; 950 crda->crd_key = cse->mackey; 951 crda->crd_klen = cse->mackeylen * 8; 952 953 if (caead->op == COP_ENCRYPT) 954 crde->crd_flags |= CRD_F_ENCRYPT; 955 else 956 crde->crd_flags &= ~CRD_F_ENCRYPT; 957 crde->crd_skip = caead->aadlen; 958 crde->crd_len = caead->len; 959 crde->crd_inject = caead->aadlen; 960 961 crde->crd_alg = cse->cipher; 962 crde->crd_key = cse->key; 963 crde->crd_klen = cse->keylen * 8; 964 965 crp->crp_ilen = caead->aadlen + caead->len; 966 crp->crp_flags = CRYPTO_F_IOV | CRYPTO_F_CBIMM 967 | (caead->flags & COP_F_BATCH); 968 crp->crp_buf = (caddr_t)&cse->uio.uio_iov; 969 crp->crp_callback = (int (*) (struct cryptop *)) cryptodev_cb; 970 crp->crp_sid = cse->sid; 971 crp->crp_opaque = (void *)cse; 972 973 if (caead->iv) { 974 if (caead->ivlen > sizeof cse->tmp_iv) { 975 error = EINVAL; 976 goto bail; 977 } 978 979 if ((error = copyin(caead->iv, cse->tmp_iv, caead->ivlen))) 980 goto bail; 981 bcopy(cse->tmp_iv, crde->crd_iv, caead->ivlen); 982 crde->crd_flags |= CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT; 983 } else { 984 crde->crd_flags |= CRD_F_IV_PRESENT; 985 crde->crd_skip += cse->txform->blocksize; 986 crde->crd_len -= cse->txform->blocksize; 987 } 988 989 if ((error = copyin(caead->tag, (caddr_t)cse->uio.uio_iov[0].iov_base + 990 caead->len + caead->aadlen, cse->thash->hashsize))) 991 goto bail; 992 again: 993 /* 994 * Let the dispatch run unlocked, then, interlock against the 995 * callback before checking if the operation completed and going 996 * to sleep. This insures drivers don't inherit our lock which 997 * results in a lock order reversal between crypto_dispatch forced 998 * entry and the crypto_done callback into us. 999 */ 1000 error = crypto_dispatch(crp); 1001 mtx_lock(&cse->lock); 1002 if (error == 0 && (crp->crp_flags & CRYPTO_F_DONE) == 0) 1003 error = msleep(crp, &cse->lock, PWAIT, "crydev", 0); 1004 mtx_unlock(&cse->lock); 1005 1006 if (error != 0) 1007 goto bail; 1008 1009 if (crp->crp_etype == EAGAIN) { 1010 crp->crp_etype = 0; 1011 crp->crp_flags &= ~CRYPTO_F_DONE; 1012 goto again; 1013 } 1014 1015 if (crp->crp_etype != 0) { 1016 error = crp->crp_etype; 1017 goto bail; 1018 } 1019 1020 if (cse->error) { 1021 error = cse->error; 1022 goto bail; 1023 } 1024 1025 if (caead->dst && (error = copyout( 1026 (caddr_t)cse->uio.uio_iov[0].iov_base + caead->aadlen, caead->dst, 1027 caead->len))) 1028 goto bail; 1029 1030 if ((error = copyout((caddr_t)cse->uio.uio_iov[0].iov_base + 1031 caead->aadlen + caead->len, caead->tag, cse->thash->hashsize))) 1032 goto bail; 1033 1034 bail: 1035 crypto_freereq(crp); 1036 free(cse->uio.uio_iov[0].iov_base, M_XDATA); 1037 1038 return (error); 1039 } 1040 1041 static int 1042 cryptodev_cb(void *op) 1043 { 1044 struct cryptop *crp = (struct cryptop *) op; 1045 struct csession *cse = (struct csession *)crp->crp_opaque; 1046 1047 mtx_lock(&cse->lock); 1048 cse->error = crp->crp_etype; 1049 wakeup_one(crp); 1050 mtx_unlock(&cse->lock); 1051 return (0); 1052 } 1053 1054 static int 1055 cryptodevkey_cb(void *op) 1056 { 1057 struct cryptkop *krp = (struct cryptkop *) op; 1058 1059 wakeup_one(krp); 1060 return (0); 1061 } 1062 1063 static int 1064 cryptodev_key(struct crypt_kop *kop) 1065 { 1066 struct cryptkop *krp = NULL; 1067 int error = EINVAL; 1068 int in, out, size, i; 1069 1070 if (kop->crk_iparams + kop->crk_oparams > CRK_MAXPARAM) { 1071 return (EFBIG); 1072 } 1073 1074 in = kop->crk_iparams; 1075 out = kop->crk_oparams; 1076 switch (kop->crk_op) { 1077 case CRK_MOD_EXP: 1078 if (in == 3 && out == 1) 1079 break; 1080 return (EINVAL); 1081 case CRK_MOD_EXP_CRT: 1082 if (in == 6 && out == 1) 1083 break; 1084 return (EINVAL); 1085 case CRK_DSA_SIGN: 1086 if (in == 5 && out == 2) 1087 break; 1088 return (EINVAL); 1089 case CRK_DSA_VERIFY: 1090 if (in == 7 && out == 0) 1091 break; 1092 return (EINVAL); 1093 case CRK_DH_COMPUTE_KEY: 1094 if (in == 3 && out == 1) 1095 break; 1096 return (EINVAL); 1097 default: 1098 return (EINVAL); 1099 } 1100 1101 krp = (struct cryptkop *)malloc(sizeof *krp, M_XDATA, M_WAITOK|M_ZERO); 1102 if (!krp) 1103 return (ENOMEM); 1104 krp->krp_op = kop->crk_op; 1105 krp->krp_status = kop->crk_status; 1106 krp->krp_iparams = kop->crk_iparams; 1107 krp->krp_oparams = kop->crk_oparams; 1108 krp->krp_crid = kop->crk_crid; 1109 krp->krp_status = 0; 1110 krp->krp_callback = (int (*) (struct cryptkop *)) cryptodevkey_cb; 1111 1112 for (i = 0; i < CRK_MAXPARAM; i++) { 1113 if (kop->crk_param[i].crp_nbits > 65536) 1114 /* Limit is the same as in OpenBSD */ 1115 goto fail; 1116 krp->krp_param[i].crp_nbits = kop->crk_param[i].crp_nbits; 1117 } 1118 for (i = 0; i < krp->krp_iparams + krp->krp_oparams; i++) { 1119 size = (krp->krp_param[i].crp_nbits + 7) / 8; 1120 if (size == 0) 1121 continue; 1122 krp->krp_param[i].crp_p = malloc(size, M_XDATA, M_WAITOK); 1123 if (i >= krp->krp_iparams) 1124 continue; 1125 error = copyin(kop->crk_param[i].crp_p, krp->krp_param[i].crp_p, size); 1126 if (error) 1127 goto fail; 1128 } 1129 1130 error = crypto_kdispatch(krp); 1131 if (error) 1132 goto fail; 1133 error = tsleep(krp, PSOCK, "crydev", 0); 1134 if (error) { 1135 /* XXX can this happen? if so, how do we recover? */ 1136 goto fail; 1137 } 1138 1139 kop->crk_crid = krp->krp_crid; /* device that did the work */ 1140 if (krp->krp_status != 0) { 1141 error = krp->krp_status; 1142 goto fail; 1143 } 1144 1145 for (i = krp->krp_iparams; i < krp->krp_iparams + krp->krp_oparams; i++) { 1146 size = (krp->krp_param[i].crp_nbits + 7) / 8; 1147 if (size == 0) 1148 continue; 1149 error = copyout(krp->krp_param[i].crp_p, kop->crk_param[i].crp_p, size); 1150 if (error) 1151 goto fail; 1152 } 1153 1154 fail: 1155 if (krp) { 1156 kop->crk_status = krp->krp_status; 1157 for (i = 0; i < CRK_MAXPARAM; i++) { 1158 if (krp->krp_param[i].crp_p) 1159 free(krp->krp_param[i].crp_p, M_XDATA); 1160 } 1161 free(krp, M_XDATA); 1162 } 1163 return (error); 1164 } 1165 1166 static int 1167 cryptodev_find(struct crypt_find_op *find) 1168 { 1169 device_t dev; 1170 size_t fnlen = sizeof find->name; 1171 1172 if (find->crid != -1) { 1173 dev = crypto_find_device_byhid(find->crid); 1174 if (dev == NULL) 1175 return (ENOENT); 1176 strncpy(find->name, device_get_nameunit(dev), fnlen); 1177 find->name[fnlen - 1] = '\x0'; 1178 } else { 1179 find->name[fnlen - 1] = '\x0'; 1180 find->crid = crypto_find_driver(find->name); 1181 if (find->crid == -1) 1182 return (ENOENT); 1183 } 1184 return (0); 1185 } 1186 1187 /* ARGSUSED */ 1188 static int 1189 cryptof_stat( 1190 struct file *fp, 1191 struct stat *sb, 1192 struct ucred *active_cred, 1193 struct thread *td) 1194 { 1195 1196 return (EOPNOTSUPP); 1197 } 1198 1199 /* ARGSUSED */ 1200 static int 1201 cryptof_close(struct file *fp, struct thread *td) 1202 { 1203 struct fcrypt *fcr = fp->f_data; 1204 struct csession *cse; 1205 1206 while ((cse = TAILQ_FIRST(&fcr->csessions))) { 1207 TAILQ_REMOVE(&fcr->csessions, cse, next); 1208 (void)csefree(cse); 1209 } 1210 free(fcr, M_XDATA); 1211 fp->f_data = NULL; 1212 return 0; 1213 } 1214 1215 static int 1216 cryptof_fill_kinfo(struct file *fp, struct kinfo_file *kif, struct filedesc *fdp) 1217 { 1218 1219 kif->kf_type = KF_TYPE_CRYPTO; 1220 return (0); 1221 } 1222 1223 static struct csession * 1224 csefind(struct fcrypt *fcr, u_int ses) 1225 { 1226 struct csession *cse; 1227 1228 TAILQ_FOREACH(cse, &fcr->csessions, next) 1229 if (cse->ses == ses) 1230 return (cse); 1231 return (NULL); 1232 } 1233 1234 static int 1235 csedelete(struct fcrypt *fcr, struct csession *cse_del) 1236 { 1237 struct csession *cse; 1238 1239 TAILQ_FOREACH(cse, &fcr->csessions, next) { 1240 if (cse == cse_del) { 1241 TAILQ_REMOVE(&fcr->csessions, cse, next); 1242 return (1); 1243 } 1244 } 1245 return (0); 1246 } 1247 1248 static struct csession * 1249 cseadd(struct fcrypt *fcr, struct csession *cse) 1250 { 1251 TAILQ_INSERT_TAIL(&fcr->csessions, cse, next); 1252 cse->ses = fcr->sesn++; 1253 return (cse); 1254 } 1255 1256 struct csession * 1257 csecreate(struct fcrypt *fcr, u_int64_t sid, caddr_t key, u_int64_t keylen, 1258 caddr_t mackey, u_int64_t mackeylen, u_int32_t cipher, u_int32_t mac, 1259 struct enc_xform *txform, struct auth_hash *thash) 1260 { 1261 struct csession *cse; 1262 1263 cse = malloc(sizeof(struct csession), M_XDATA, M_NOWAIT | M_ZERO); 1264 if (cse == NULL) 1265 return NULL; 1266 mtx_init(&cse->lock, "cryptodev", "crypto session lock", MTX_DEF); 1267 cse->key = key; 1268 cse->keylen = keylen/8; 1269 cse->mackey = mackey; 1270 cse->mackeylen = mackeylen/8; 1271 cse->sid = sid; 1272 cse->cipher = cipher; 1273 cse->mac = mac; 1274 cse->txform = txform; 1275 cse->thash = thash; 1276 cseadd(fcr, cse); 1277 return (cse); 1278 } 1279 1280 static int 1281 csefree(struct csession *cse) 1282 { 1283 int error; 1284 1285 error = crypto_freesession(cse->sid); 1286 mtx_destroy(&cse->lock); 1287 if (cse->key) 1288 free(cse->key, M_XDATA); 1289 if (cse->mackey) 1290 free(cse->mackey, M_XDATA); 1291 free(cse, M_XDATA); 1292 return (error); 1293 } 1294 1295 static int 1296 cryptoopen(struct cdev *dev, int oflags, int devtype, struct thread *td) 1297 { 1298 return (0); 1299 } 1300 1301 static int 1302 cryptoread(struct cdev *dev, struct uio *uio, int ioflag) 1303 { 1304 return (EIO); 1305 } 1306 1307 static int 1308 cryptowrite(struct cdev *dev, struct uio *uio, int ioflag) 1309 { 1310 return (EIO); 1311 } 1312 1313 static int 1314 cryptoioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td) 1315 { 1316 struct file *f; 1317 struct fcrypt *fcr; 1318 int fd, error; 1319 1320 switch (cmd) { 1321 case CRIOGET: 1322 fcr = malloc(sizeof(struct fcrypt), M_XDATA, M_WAITOK); 1323 TAILQ_INIT(&fcr->csessions); 1324 fcr->sesn = 0; 1325 1326 error = falloc(td, &f, &fd, 0); 1327 1328 if (error) { 1329 free(fcr, M_XDATA); 1330 return (error); 1331 } 1332 /* falloc automatically provides an extra reference to 'f'. */ 1333 finit(f, FREAD | FWRITE, DTYPE_CRYPTO, fcr, &cryptofops); 1334 *(u_int32_t *)data = fd; 1335 fdrop(f, td); 1336 break; 1337 case CRIOFINDDEV: 1338 error = cryptodev_find((struct crypt_find_op *)data); 1339 break; 1340 case CRIOASYMFEAT: 1341 error = crypto_getfeat((int *)data); 1342 break; 1343 default: 1344 error = EINVAL; 1345 break; 1346 } 1347 return (error); 1348 } 1349 1350 static struct cdevsw crypto_cdevsw = { 1351 .d_version = D_VERSION, 1352 .d_flags = D_NEEDGIANT, 1353 .d_open = cryptoopen, 1354 .d_read = cryptoread, 1355 .d_write = cryptowrite, 1356 .d_ioctl = cryptoioctl, 1357 .d_name = "crypto", 1358 }; 1359 static struct cdev *crypto_dev; 1360 1361 /* 1362 * Initialization code, both for static and dynamic loading. 1363 */ 1364 static int 1365 cryptodev_modevent(module_t mod, int type, void *unused) 1366 { 1367 switch (type) { 1368 case MOD_LOAD: 1369 if (bootverbose) 1370 printf("crypto: <crypto device>\n"); 1371 crypto_dev = make_dev(&crypto_cdevsw, 0, 1372 UID_ROOT, GID_WHEEL, 0666, 1373 "crypto"); 1374 return 0; 1375 case MOD_UNLOAD: 1376 /*XXX disallow if active sessions */ 1377 destroy_dev(crypto_dev); 1378 return 0; 1379 } 1380 return EINVAL; 1381 } 1382 1383 static moduledata_t cryptodev_mod = { 1384 "cryptodev", 1385 cryptodev_modevent, 1386 0 1387 }; 1388 MODULE_VERSION(cryptodev, 1); 1389 DECLARE_MODULE(cryptodev, cryptodev_mod, SI_SUB_PSEUDO, SI_ORDER_ANY); 1390 MODULE_DEPEND(cryptodev, crypto, 1, 1, 1); 1391 MODULE_DEPEND(cryptodev, zlib, 1, 1, 1); 1392