1 /* $OpenBSD: cryptodev.c,v 1.52 2002/06/19 07:22:46 deraadt Exp $ */ 2 3 /*- 4 * Copyright (c) 2001 Theo de Raadt 5 * Copyright (c) 2002-2006 Sam Leffler, Errno Consulting 6 * Copyright (c) 2014 The FreeBSD Foundation 7 * All rights reserved. 8 * 9 * Portions of this software were developed by John-Mark Gurney 10 * under sponsorship of the FreeBSD Foundation and 11 * Rubicon Communications, LLC (Netgate). 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright 20 * notice, this list of conditions and the following disclaimer in the 21 * documentation and/or other materials provided with the distribution. 22 * 3. The name of the author may not be used to endorse or promote products 23 * derived from this software without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35 * 36 * Effort sponsored in part by the Defense Advanced Research Projects 37 * Agency (DARPA) and Air Force Research Laboratory, Air Force 38 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 39 */ 40 41 #include <sys/cdefs.h> 42 __FBSDID("$FreeBSD$"); 43 44 #include <sys/param.h> 45 #include <sys/systm.h> 46 #include <sys/malloc.h> 47 #include <sys/mbuf.h> 48 #include <sys/lock.h> 49 #include <sys/mutex.h> 50 #include <sys/sysctl.h> 51 #include <sys/file.h> 52 #include <sys/filedesc.h> 53 #include <sys/errno.h> 54 #include <sys/uio.h> 55 #include <sys/random.h> 56 #include <sys/conf.h> 57 #include <sys/kernel.h> 58 #include <sys/module.h> 59 #include <sys/fcntl.h> 60 #include <sys/bus.h> 61 #include <sys/user.h> 62 #include <sys/sdt.h> 63 64 #include <opencrypto/cryptodev.h> 65 #include <opencrypto/xform.h> 66 67 SDT_PROVIDER_DECLARE(opencrypto); 68 69 SDT_PROBE_DEFINE1(opencrypto, dev, ioctl, error, "int"/*line number*/); 70 71 #ifdef COMPAT_FREEBSD32 72 #include <sys/mount.h> 73 #include <compat/freebsd32/freebsd32.h> 74 75 struct session_op32 { 76 u_int32_t cipher; 77 u_int32_t mac; 78 u_int32_t keylen; 79 u_int32_t key; 80 int mackeylen; 81 u_int32_t mackey; 82 u_int32_t ses; 83 }; 84 85 struct session2_op32 { 86 u_int32_t cipher; 87 u_int32_t mac; 88 u_int32_t keylen; 89 u_int32_t key; 90 int mackeylen; 91 u_int32_t mackey; 92 u_int32_t ses; 93 int crid; 94 int pad[4]; 95 }; 96 97 struct crypt_op32 { 98 u_int32_t ses; 99 u_int16_t op; 100 u_int16_t flags; 101 u_int len; 102 u_int32_t src, dst; 103 u_int32_t mac; 104 u_int32_t iv; 105 }; 106 107 struct crparam32 { 108 u_int32_t crp_p; 109 u_int crp_nbits; 110 }; 111 112 struct crypt_kop32 { 113 u_int crk_op; 114 u_int crk_status; 115 u_short crk_iparams; 116 u_short crk_oparams; 117 u_int crk_crid; 118 struct crparam32 crk_param[CRK_MAXPARAM]; 119 }; 120 121 struct cryptotstat32 { 122 struct timespec32 acc; 123 struct timespec32 min; 124 struct timespec32 max; 125 u_int32_t count; 126 }; 127 128 struct cryptostats32 { 129 u_int32_t cs_ops; 130 u_int32_t cs_errs; 131 u_int32_t cs_kops; 132 u_int32_t cs_kerrs; 133 u_int32_t cs_intrs; 134 u_int32_t cs_rets; 135 u_int32_t cs_blocks; 136 u_int32_t cs_kblocks; 137 struct cryptotstat32 cs_invoke; 138 struct cryptotstat32 cs_done; 139 struct cryptotstat32 cs_cb; 140 struct cryptotstat32 cs_finis; 141 }; 142 143 #define CIOCGSESSION32 _IOWR('c', 101, struct session_op32) 144 #define CIOCCRYPT32 _IOWR('c', 103, struct crypt_op32) 145 #define CIOCKEY32 _IOWR('c', 104, struct crypt_kop32) 146 #define CIOCGSESSION232 _IOWR('c', 106, struct session2_op32) 147 #define CIOCKEY232 _IOWR('c', 107, struct crypt_kop32) 148 149 static void 150 session_op_from_32(const struct session_op32 *from, struct session_op *to) 151 { 152 153 CP(*from, *to, cipher); 154 CP(*from, *to, mac); 155 CP(*from, *to, keylen); 156 PTRIN_CP(*from, *to, key); 157 CP(*from, *to, mackeylen); 158 PTRIN_CP(*from, *to, mackey); 159 CP(*from, *to, ses); 160 } 161 162 static void 163 session2_op_from_32(const struct session2_op32 *from, struct session2_op *to) 164 { 165 166 session_op_from_32((const struct session_op32 *)from, 167 (struct session_op *)to); 168 CP(*from, *to, crid); 169 } 170 171 static void 172 session_op_to_32(const struct session_op *from, struct session_op32 *to) 173 { 174 175 CP(*from, *to, cipher); 176 CP(*from, *to, mac); 177 CP(*from, *to, keylen); 178 PTROUT_CP(*from, *to, key); 179 CP(*from, *to, mackeylen); 180 PTROUT_CP(*from, *to, mackey); 181 CP(*from, *to, ses); 182 } 183 184 static void 185 session2_op_to_32(const struct session2_op *from, struct session2_op32 *to) 186 { 187 188 session_op_to_32((const struct session_op *)from, 189 (struct session_op32 *)to); 190 CP(*from, *to, crid); 191 } 192 193 static void 194 crypt_op_from_32(const struct crypt_op32 *from, struct crypt_op *to) 195 { 196 197 CP(*from, *to, ses); 198 CP(*from, *to, op); 199 CP(*from, *to, flags); 200 CP(*from, *to, len); 201 PTRIN_CP(*from, *to, src); 202 PTRIN_CP(*from, *to, dst); 203 PTRIN_CP(*from, *to, mac); 204 PTRIN_CP(*from, *to, iv); 205 } 206 207 static void 208 crypt_op_to_32(const struct crypt_op *from, struct crypt_op32 *to) 209 { 210 211 CP(*from, *to, ses); 212 CP(*from, *to, op); 213 CP(*from, *to, flags); 214 CP(*from, *to, len); 215 PTROUT_CP(*from, *to, src); 216 PTROUT_CP(*from, *to, dst); 217 PTROUT_CP(*from, *to, mac); 218 PTROUT_CP(*from, *to, iv); 219 } 220 221 static void 222 crparam_from_32(const struct crparam32 *from, struct crparam *to) 223 { 224 225 PTRIN_CP(*from, *to, crp_p); 226 CP(*from, *to, crp_nbits); 227 } 228 229 static void 230 crparam_to_32(const struct crparam *from, struct crparam32 *to) 231 { 232 233 PTROUT_CP(*from, *to, crp_p); 234 CP(*from, *to, crp_nbits); 235 } 236 237 static void 238 crypt_kop_from_32(const struct crypt_kop32 *from, struct crypt_kop *to) 239 { 240 int i; 241 242 CP(*from, *to, crk_op); 243 CP(*from, *to, crk_status); 244 CP(*from, *to, crk_iparams); 245 CP(*from, *to, crk_oparams); 246 CP(*from, *to, crk_crid); 247 for (i = 0; i < CRK_MAXPARAM; i++) 248 crparam_from_32(&from->crk_param[i], &to->crk_param[i]); 249 } 250 251 static void 252 crypt_kop_to_32(const struct crypt_kop *from, struct crypt_kop32 *to) 253 { 254 int i; 255 256 CP(*from, *to, crk_op); 257 CP(*from, *to, crk_status); 258 CP(*from, *to, crk_iparams); 259 CP(*from, *to, crk_oparams); 260 CP(*from, *to, crk_crid); 261 for (i = 0; i < CRK_MAXPARAM; i++) 262 crparam_to_32(&from->crk_param[i], &to->crk_param[i]); 263 } 264 #endif 265 266 struct csession { 267 TAILQ_ENTRY(csession) next; 268 u_int64_t sid; 269 u_int32_t ses; 270 struct mtx lock; /* for op submission */ 271 272 u_int32_t cipher; 273 struct enc_xform *txform; 274 u_int32_t mac; 275 struct auth_hash *thash; 276 277 caddr_t key; 278 int keylen; 279 280 caddr_t mackey; 281 int mackeylen; 282 }; 283 284 struct cryptop_data { 285 struct csession *cse; 286 287 struct iovec iovec[1]; 288 struct uio uio; 289 bool done; 290 }; 291 292 struct fcrypt { 293 TAILQ_HEAD(csessionlist, csession) csessions; 294 int sesn; 295 }; 296 297 static int cryptof_ioctl(struct file *, u_long, void *, 298 struct ucred *, struct thread *); 299 static int cryptof_stat(struct file *, struct stat *, 300 struct ucred *, struct thread *); 301 static int cryptof_close(struct file *, struct thread *); 302 static int cryptof_fill_kinfo(struct file *, struct kinfo_file *, 303 struct filedesc *); 304 305 static struct fileops cryptofops = { 306 .fo_read = invfo_rdwr, 307 .fo_write = invfo_rdwr, 308 .fo_truncate = invfo_truncate, 309 .fo_ioctl = cryptof_ioctl, 310 .fo_poll = invfo_poll, 311 .fo_kqfilter = invfo_kqfilter, 312 .fo_stat = cryptof_stat, 313 .fo_close = cryptof_close, 314 .fo_chmod = invfo_chmod, 315 .fo_chown = invfo_chown, 316 .fo_sendfile = invfo_sendfile, 317 .fo_fill_kinfo = cryptof_fill_kinfo, 318 }; 319 320 static struct csession *csefind(struct fcrypt *, u_int); 321 static int csedelete(struct fcrypt *, struct csession *); 322 static struct csession *cseadd(struct fcrypt *, struct csession *); 323 static struct csession *csecreate(struct fcrypt *, u_int64_t, caddr_t, 324 u_int64_t, caddr_t, u_int64_t, u_int32_t, u_int32_t, struct enc_xform *, 325 struct auth_hash *); 326 static int csefree(struct csession *); 327 328 static int cryptodev_op(struct csession *, struct crypt_op *, 329 struct ucred *, struct thread *td); 330 static int cryptodev_aead(struct csession *, struct crypt_aead *, 331 struct ucred *, struct thread *); 332 static int cryptodev_key(struct crypt_kop *); 333 static int cryptodev_find(struct crypt_find_op *); 334 335 /* 336 * Check a crypto identifier to see if it requested 337 * a software device/driver. This can be done either 338 * by device name/class or through search constraints. 339 */ 340 static int 341 checkforsoftware(int *cridp) 342 { 343 int crid; 344 345 crid = *cridp; 346 347 if (!crypto_devallowsoft) { 348 if (crid & CRYPTOCAP_F_SOFTWARE) { 349 if (crid & CRYPTOCAP_F_HARDWARE) { 350 *cridp = CRYPTOCAP_F_HARDWARE; 351 return 0; 352 } 353 return EINVAL; 354 } 355 if ((crid & CRYPTOCAP_F_HARDWARE) == 0 && 356 (crypto_getcaps(crid) & CRYPTOCAP_F_HARDWARE) == 0) 357 return EINVAL; 358 } 359 return 0; 360 } 361 362 /* ARGSUSED */ 363 static int 364 cryptof_ioctl( 365 struct file *fp, 366 u_long cmd, 367 void *data, 368 struct ucred *active_cred, 369 struct thread *td) 370 { 371 #define SES2(p) ((struct session2_op *)p) 372 struct cryptoini cria, crie; 373 struct fcrypt *fcr = fp->f_data; 374 struct csession *cse; 375 struct session_op *sop; 376 struct crypt_op *cop; 377 struct crypt_aead *caead; 378 struct enc_xform *txform = NULL; 379 struct auth_hash *thash = NULL; 380 struct crypt_kop *kop; 381 u_int64_t sid; 382 u_int32_t ses; 383 int error = 0, crid; 384 #ifdef COMPAT_FREEBSD32 385 struct session2_op sopc; 386 struct crypt_op copc; 387 struct crypt_kop kopc; 388 #endif 389 390 switch (cmd) { 391 case CIOCGSESSION: 392 case CIOCGSESSION2: 393 #ifdef COMPAT_FREEBSD32 394 case CIOCGSESSION32: 395 case CIOCGSESSION232: 396 if (cmd == CIOCGSESSION32) { 397 session_op_from_32(data, (struct session_op *)&sopc); 398 sop = (struct session_op *)&sopc; 399 } else if (cmd == CIOCGSESSION232) { 400 session2_op_from_32(data, &sopc); 401 sop = (struct session_op *)&sopc; 402 } else 403 #endif 404 sop = (struct session_op *)data; 405 switch (sop->cipher) { 406 case 0: 407 break; 408 case CRYPTO_DES_CBC: 409 txform = &enc_xform_des; 410 break; 411 case CRYPTO_3DES_CBC: 412 txform = &enc_xform_3des; 413 break; 414 case CRYPTO_BLF_CBC: 415 txform = &enc_xform_blf; 416 break; 417 case CRYPTO_CAST_CBC: 418 txform = &enc_xform_cast5; 419 break; 420 case CRYPTO_SKIPJACK_CBC: 421 txform = &enc_xform_skipjack; 422 break; 423 case CRYPTO_AES_CBC: 424 txform = &enc_xform_rijndael128; 425 break; 426 case CRYPTO_AES_XTS: 427 txform = &enc_xform_aes_xts; 428 break; 429 case CRYPTO_NULL_CBC: 430 txform = &enc_xform_null; 431 break; 432 case CRYPTO_ARC4: 433 txform = &enc_xform_arc4; 434 break; 435 case CRYPTO_CAMELLIA_CBC: 436 txform = &enc_xform_camellia; 437 break; 438 case CRYPTO_AES_ICM: 439 txform = &enc_xform_aes_icm; 440 break; 441 case CRYPTO_AES_NIST_GCM_16: 442 txform = &enc_xform_aes_nist_gcm; 443 break; 444 case CRYPTO_CHACHA20: 445 txform = &enc_xform_chacha20; 446 break; 447 448 default: 449 CRYPTDEB("invalid cipher"); 450 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 451 return (EINVAL); 452 } 453 454 switch (sop->mac) { 455 case 0: 456 break; 457 case CRYPTO_MD5_HMAC: 458 thash = &auth_hash_hmac_md5; 459 break; 460 case CRYPTO_SHA1_HMAC: 461 thash = &auth_hash_hmac_sha1; 462 break; 463 case CRYPTO_SHA2_256_HMAC: 464 thash = &auth_hash_hmac_sha2_256; 465 break; 466 case CRYPTO_SHA2_384_HMAC: 467 thash = &auth_hash_hmac_sha2_384; 468 break; 469 case CRYPTO_SHA2_512_HMAC: 470 thash = &auth_hash_hmac_sha2_512; 471 break; 472 case CRYPTO_RIPEMD160_HMAC: 473 thash = &auth_hash_hmac_ripemd_160; 474 break; 475 case CRYPTO_AES_128_NIST_GMAC: 476 thash = &auth_hash_nist_gmac_aes_128; 477 break; 478 case CRYPTO_AES_192_NIST_GMAC: 479 thash = &auth_hash_nist_gmac_aes_192; 480 break; 481 case CRYPTO_AES_256_NIST_GMAC: 482 thash = &auth_hash_nist_gmac_aes_256; 483 break; 484 485 #ifdef notdef 486 case CRYPTO_MD5: 487 thash = &auth_hash_md5; 488 break; 489 case CRYPTO_SHA1: 490 thash = &auth_hash_sha1; 491 break; 492 #endif 493 case CRYPTO_NULL_HMAC: 494 thash = &auth_hash_null; 495 break; 496 497 case CRYPTO_BLAKE2B: 498 thash = &auth_hash_blake2b; 499 break; 500 case CRYPTO_BLAKE2S: 501 thash = &auth_hash_blake2s; 502 break; 503 504 default: 505 CRYPTDEB("invalid mac"); 506 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 507 return (EINVAL); 508 } 509 510 bzero(&crie, sizeof(crie)); 511 bzero(&cria, sizeof(cria)); 512 513 if (txform) { 514 crie.cri_alg = txform->type; 515 crie.cri_klen = sop->keylen * 8; 516 if (sop->keylen > txform->maxkey || 517 sop->keylen < txform->minkey) { 518 CRYPTDEB("invalid cipher parameters"); 519 error = EINVAL; 520 SDT_PROBE1(opencrypto, dev, ioctl, error, 521 __LINE__); 522 goto bail; 523 } 524 525 crie.cri_key = malloc(crie.cri_klen / 8, 526 M_XDATA, M_WAITOK); 527 if ((error = copyin(sop->key, crie.cri_key, 528 crie.cri_klen / 8))) { 529 CRYPTDEB("invalid key"); 530 SDT_PROBE1(opencrypto, dev, ioctl, error, 531 __LINE__); 532 goto bail; 533 } 534 if (thash) 535 crie.cri_next = &cria; 536 } 537 538 if (thash) { 539 cria.cri_alg = thash->type; 540 cria.cri_klen = sop->mackeylen * 8; 541 if (thash->keysize != 0 && 542 sop->mackeylen > thash->keysize) { 543 CRYPTDEB("invalid mac key length"); 544 error = EINVAL; 545 SDT_PROBE1(opencrypto, dev, ioctl, error, 546 __LINE__); 547 goto bail; 548 } 549 550 if (cria.cri_klen) { 551 cria.cri_key = malloc(cria.cri_klen / 8, 552 M_XDATA, M_WAITOK); 553 if ((error = copyin(sop->mackey, cria.cri_key, 554 cria.cri_klen / 8))) { 555 CRYPTDEB("invalid mac key"); 556 SDT_PROBE1(opencrypto, dev, ioctl, 557 error, __LINE__); 558 goto bail; 559 } 560 } 561 } 562 563 /* NB: CIOCGSESSION2 has the crid */ 564 if (cmd == CIOCGSESSION2 565 #ifdef COMPAT_FREEBSD32 566 || cmd == CIOCGSESSION232 567 #endif 568 ) { 569 crid = SES2(sop)->crid; 570 error = checkforsoftware(&crid); 571 if (error) { 572 CRYPTDEB("checkforsoftware"); 573 SDT_PROBE1(opencrypto, dev, ioctl, error, 574 __LINE__); 575 goto bail; 576 } 577 } else 578 crid = CRYPTOCAP_F_HARDWARE; 579 error = crypto_newsession(&sid, (txform ? &crie : &cria), crid); 580 if (error) { 581 CRYPTDEB("crypto_newsession"); 582 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 583 goto bail; 584 } 585 586 cse = csecreate(fcr, sid, crie.cri_key, crie.cri_klen, 587 cria.cri_key, cria.cri_klen, sop->cipher, sop->mac, txform, 588 thash); 589 590 if (cse == NULL) { 591 crypto_freesession(sid); 592 error = EINVAL; 593 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 594 CRYPTDEB("csecreate"); 595 goto bail; 596 } 597 sop->ses = cse->ses; 598 if (cmd == CIOCGSESSION2 599 #ifdef COMPAT_FREEBSD32 600 || cmd == CIOCGSESSION232 601 #endif 602 ) { 603 /* return hardware/driver id */ 604 SES2(sop)->crid = CRYPTO_SESID2HID(cse->sid); 605 } 606 bail: 607 if (error) { 608 if (crie.cri_key) 609 free(crie.cri_key, M_XDATA); 610 if (cria.cri_key) 611 free(cria.cri_key, M_XDATA); 612 } 613 #ifdef COMPAT_FREEBSD32 614 else { 615 if (cmd == CIOCGSESSION32) 616 session_op_to_32(sop, data); 617 else if (cmd == CIOCGSESSION232) 618 session2_op_to_32((struct session2_op *)sop, 619 data); 620 } 621 #endif 622 break; 623 case CIOCFSESSION: 624 ses = *(u_int32_t *)data; 625 cse = csefind(fcr, ses); 626 if (cse == NULL) { 627 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 628 return (EINVAL); 629 } 630 csedelete(fcr, cse); 631 error = csefree(cse); 632 break; 633 case CIOCCRYPT: 634 #ifdef COMPAT_FREEBSD32 635 case CIOCCRYPT32: 636 if (cmd == CIOCCRYPT32) { 637 cop = &copc; 638 crypt_op_from_32(data, cop); 639 } else 640 #endif 641 cop = (struct crypt_op *)data; 642 cse = csefind(fcr, cop->ses); 643 if (cse == NULL) { 644 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 645 return (EINVAL); 646 } 647 error = cryptodev_op(cse, cop, active_cred, td); 648 #ifdef COMPAT_FREEBSD32 649 if (error == 0 && cmd == CIOCCRYPT32) 650 crypt_op_to_32(cop, data); 651 #endif 652 break; 653 case CIOCKEY: 654 case CIOCKEY2: 655 #ifdef COMPAT_FREEBSD32 656 case CIOCKEY32: 657 case CIOCKEY232: 658 #endif 659 if (!crypto_userasymcrypto) { 660 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 661 return (EPERM); /* XXX compat? */ 662 } 663 #ifdef COMPAT_FREEBSD32 664 if (cmd == CIOCKEY32 || cmd == CIOCKEY232) { 665 kop = &kopc; 666 crypt_kop_from_32(data, kop); 667 } else 668 #endif 669 kop = (struct crypt_kop *)data; 670 if (cmd == CIOCKEY 671 #ifdef COMPAT_FREEBSD32 672 || cmd == CIOCKEY32 673 #endif 674 ) { 675 /* NB: crypto core enforces s/w driver use */ 676 kop->crk_crid = 677 CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE; 678 } 679 mtx_lock(&Giant); 680 error = cryptodev_key(kop); 681 mtx_unlock(&Giant); 682 #ifdef COMPAT_FREEBSD32 683 if (cmd == CIOCKEY32 || cmd == CIOCKEY232) 684 crypt_kop_to_32(kop, data); 685 #endif 686 break; 687 case CIOCASYMFEAT: 688 if (!crypto_userasymcrypto) { 689 /* 690 * NB: if user asym crypto operations are 691 * not permitted return "no algorithms" 692 * so well-behaved applications will just 693 * fallback to doing them in software. 694 */ 695 *(int *)data = 0; 696 } else { 697 error = crypto_getfeat((int *)data); 698 if (error) 699 SDT_PROBE1(opencrypto, dev, ioctl, error, 700 __LINE__); 701 } 702 break; 703 case CIOCFINDDEV: 704 error = cryptodev_find((struct crypt_find_op *)data); 705 break; 706 case CIOCCRYPTAEAD: 707 caead = (struct crypt_aead *)data; 708 cse = csefind(fcr, caead->ses); 709 if (cse == NULL) { 710 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 711 return (EINVAL); 712 } 713 error = cryptodev_aead(cse, caead, active_cred, td); 714 break; 715 default: 716 error = EINVAL; 717 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 718 break; 719 } 720 return (error); 721 #undef SES2 722 } 723 724 static int cryptodev_cb(struct cryptop *); 725 726 static struct cryptop_data * 727 cod_alloc(struct csession *cse, size_t len, struct thread *td) 728 { 729 struct cryptop_data *cod; 730 struct uio *uio; 731 732 cod = malloc(sizeof(struct cryptop_data), M_XDATA, M_WAITOK | M_ZERO); 733 734 cod->cse = cse; 735 uio = &cod->uio; 736 uio->uio_iov = cod->iovec; 737 uio->uio_iovcnt = 1; 738 uio->uio_resid = len; 739 uio->uio_segflg = UIO_SYSSPACE; 740 uio->uio_rw = UIO_WRITE; 741 uio->uio_td = td; 742 uio->uio_iov[0].iov_len = len; 743 uio->uio_iov[0].iov_base = malloc(len, M_XDATA, M_WAITOK); 744 return (cod); 745 } 746 747 static void 748 cod_free(struct cryptop_data *cod) 749 { 750 751 free(cod->uio.uio_iov[0].iov_base, M_XDATA); 752 free(cod, M_XDATA); 753 } 754 755 static int 756 cryptodev_op( 757 struct csession *cse, 758 struct crypt_op *cop, 759 struct ucred *active_cred, 760 struct thread *td) 761 { 762 struct cryptop_data *cod = NULL; 763 struct cryptop *crp = NULL; 764 struct cryptodesc *crde = NULL, *crda = NULL; 765 int error; 766 767 if (cop->len > 256*1024-4) { 768 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 769 return (E2BIG); 770 } 771 772 if (cse->txform) { 773 if (cop->len == 0 || (cop->len % cse->txform->blocksize) != 0) { 774 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 775 return (EINVAL); 776 } 777 } 778 779 if (cse->thash) 780 cod = cod_alloc(cse, cop->len + cse->thash->hashsize, td); 781 else 782 cod = cod_alloc(cse, cop->len, td); 783 784 crp = crypto_getreq((cse->txform != NULL) + (cse->thash != NULL)); 785 if (crp == NULL) { 786 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 787 error = ENOMEM; 788 goto bail; 789 } 790 791 if (cse->thash && cse->txform) { 792 if (cop->flags & COP_F_CIPHER_FIRST) { 793 crde = crp->crp_desc; 794 crda = crde->crd_next; 795 } else { 796 crda = crp->crp_desc; 797 crde = crda->crd_next; 798 } 799 } else if (cse->thash) { 800 crda = crp->crp_desc; 801 } else if (cse->txform) { 802 crde = crp->crp_desc; 803 } else { 804 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 805 error = EINVAL; 806 goto bail; 807 } 808 809 if ((error = copyin(cop->src, cod->uio.uio_iov[0].iov_base, 810 cop->len))) { 811 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 812 goto bail; 813 } 814 815 if (crda) { 816 crda->crd_skip = 0; 817 crda->crd_len = cop->len; 818 crda->crd_inject = cop->len; 819 820 crda->crd_alg = cse->mac; 821 crda->crd_key = cse->mackey; 822 crda->crd_klen = cse->mackeylen * 8; 823 } 824 825 if (crde) { 826 if (cop->op == COP_ENCRYPT) 827 crde->crd_flags |= CRD_F_ENCRYPT; 828 else 829 crde->crd_flags &= ~CRD_F_ENCRYPT; 830 crde->crd_len = cop->len; 831 crde->crd_inject = 0; 832 833 crde->crd_alg = cse->cipher; 834 crde->crd_key = cse->key; 835 crde->crd_klen = cse->keylen * 8; 836 } 837 838 crp->crp_ilen = cop->len; 839 crp->crp_flags = CRYPTO_F_IOV | CRYPTO_F_CBIMM 840 | (cop->flags & COP_F_BATCH); 841 crp->crp_uio = &cod->uio; 842 crp->crp_callback = cryptodev_cb; 843 crp->crp_sid = cse->sid; 844 crp->crp_opaque = cod; 845 846 if (cop->iv) { 847 if (crde == NULL) { 848 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 849 error = EINVAL; 850 goto bail; 851 } 852 if (cse->cipher == CRYPTO_ARC4) { /* XXX use flag? */ 853 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 854 error = EINVAL; 855 goto bail; 856 } 857 if ((error = copyin(cop->iv, crde->crd_iv, 858 cse->txform->ivsize))) { 859 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 860 goto bail; 861 } 862 crde->crd_flags |= CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT; 863 crde->crd_skip = 0; 864 } else if (cse->cipher == CRYPTO_ARC4) { /* XXX use flag? */ 865 crde->crd_skip = 0; 866 } else if (crde) { 867 crde->crd_flags |= CRD_F_IV_PRESENT; 868 crde->crd_skip = cse->txform->ivsize; 869 crde->crd_len -= cse->txform->ivsize; 870 } 871 872 if (cop->mac && crda == NULL) { 873 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 874 error = EINVAL; 875 goto bail; 876 } 877 878 again: 879 /* 880 * Let the dispatch run unlocked, then, interlock against the 881 * callback before checking if the operation completed and going 882 * to sleep. This insures drivers don't inherit our lock which 883 * results in a lock order reversal between crypto_dispatch forced 884 * entry and the crypto_done callback into us. 885 */ 886 error = crypto_dispatch(crp); 887 if (error != 0) { 888 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 889 goto bail; 890 } 891 892 mtx_lock(&cse->lock); 893 while (!cod->done) 894 mtx_sleep(cod, &cse->lock, PWAIT, "crydev", 0); 895 mtx_unlock(&cse->lock); 896 897 if (crp->crp_etype == EAGAIN) { 898 crp->crp_etype = 0; 899 crp->crp_flags &= ~CRYPTO_F_DONE; 900 cod->done = false; 901 goto again; 902 } 903 904 if (crp->crp_etype != 0) { 905 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 906 error = crp->crp_etype; 907 goto bail; 908 } 909 910 if (cop->dst && 911 (error = copyout(cod->uio.uio_iov[0].iov_base, cop->dst, 912 cop->len))) { 913 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 914 goto bail; 915 } 916 917 if (cop->mac && 918 (error = copyout((caddr_t)cod->uio.uio_iov[0].iov_base + cop->len, 919 cop->mac, cse->thash->hashsize))) { 920 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 921 goto bail; 922 } 923 924 bail: 925 if (crp) 926 crypto_freereq(crp); 927 if (cod) 928 cod_free(cod); 929 930 return (error); 931 } 932 933 static int 934 cryptodev_aead( 935 struct csession *cse, 936 struct crypt_aead *caead, 937 struct ucred *active_cred, 938 struct thread *td) 939 { 940 struct cryptop_data *cod = NULL; 941 struct cryptop *crp = NULL; 942 struct cryptodesc *crde = NULL, *crda = NULL; 943 int error; 944 945 if (caead->len > 256*1024-4 || caead->aadlen > 256*1024-4) { 946 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 947 return (E2BIG); 948 } 949 950 if (cse->txform == NULL || cse->thash == NULL || caead->tag == NULL || 951 (caead->len % cse->txform->blocksize) != 0) { 952 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 953 return (EINVAL); 954 } 955 956 cod = cod_alloc(cse, caead->aadlen + caead->len + cse->thash->hashsize, 957 td); 958 959 crp = crypto_getreq(2); 960 if (crp == NULL) { 961 error = ENOMEM; 962 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 963 goto bail; 964 } 965 966 if (caead->flags & COP_F_CIPHER_FIRST) { 967 crde = crp->crp_desc; 968 crda = crde->crd_next; 969 } else { 970 crda = crp->crp_desc; 971 crde = crda->crd_next; 972 } 973 974 if ((error = copyin(caead->aad, cod->uio.uio_iov[0].iov_base, 975 caead->aadlen))) { 976 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 977 goto bail; 978 } 979 980 if ((error = copyin(caead->src, (char *)cod->uio.uio_iov[0].iov_base + 981 caead->aadlen, caead->len))) { 982 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 983 goto bail; 984 } 985 986 /* 987 * For GCM, crd_len covers only the AAD. For other ciphers 988 * chained with an HMAC, crd_len covers both the AAD and the 989 * cipher text. 990 */ 991 crda->crd_skip = 0; 992 if (cse->cipher == CRYPTO_AES_NIST_GCM_16) 993 crda->crd_len = caead->aadlen; 994 else 995 crda->crd_len = caead->aadlen + caead->len; 996 crda->crd_inject = caead->aadlen + caead->len; 997 998 crda->crd_alg = cse->mac; 999 crda->crd_key = cse->mackey; 1000 crda->crd_klen = cse->mackeylen * 8; 1001 1002 if (caead->op == COP_ENCRYPT) 1003 crde->crd_flags |= CRD_F_ENCRYPT; 1004 else 1005 crde->crd_flags &= ~CRD_F_ENCRYPT; 1006 crde->crd_skip = caead->aadlen; 1007 crde->crd_len = caead->len; 1008 crde->crd_inject = caead->aadlen; 1009 1010 crde->crd_alg = cse->cipher; 1011 crde->crd_key = cse->key; 1012 crde->crd_klen = cse->keylen * 8; 1013 1014 crp->crp_ilen = caead->aadlen + caead->len; 1015 crp->crp_flags = CRYPTO_F_IOV | CRYPTO_F_CBIMM 1016 | (caead->flags & COP_F_BATCH); 1017 crp->crp_uio = &cod->uio; 1018 crp->crp_callback = cryptodev_cb; 1019 crp->crp_sid = cse->sid; 1020 crp->crp_opaque = cod; 1021 1022 if (caead->iv) { 1023 if (caead->ivlen > sizeof(crde->crd_iv)) { 1024 error = EINVAL; 1025 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1026 goto bail; 1027 } 1028 1029 if ((error = copyin(caead->iv, crde->crd_iv, caead->ivlen))) { 1030 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1031 goto bail; 1032 } 1033 crde->crd_flags |= CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT; 1034 } else { 1035 crde->crd_flags |= CRD_F_IV_PRESENT; 1036 crde->crd_skip += cse->txform->ivsize; 1037 crde->crd_len -= cse->txform->ivsize; 1038 } 1039 1040 if ((error = copyin(caead->tag, (caddr_t)cod->uio.uio_iov[0].iov_base + 1041 caead->len + caead->aadlen, cse->thash->hashsize))) { 1042 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1043 goto bail; 1044 } 1045 again: 1046 /* 1047 * Let the dispatch run unlocked, then, interlock against the 1048 * callback before checking if the operation completed and going 1049 * to sleep. This insures drivers don't inherit our lock which 1050 * results in a lock order reversal between crypto_dispatch forced 1051 * entry and the crypto_done callback into us. 1052 */ 1053 error = crypto_dispatch(crp); 1054 if (error != 0) { 1055 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1056 goto bail; 1057 } 1058 1059 mtx_lock(&cse->lock); 1060 while (!cod->done) 1061 mtx_sleep(cod, &cse->lock, PWAIT, "crydev", 0); 1062 mtx_unlock(&cse->lock); 1063 1064 if (crp->crp_etype == EAGAIN) { 1065 crp->crp_etype = 0; 1066 crp->crp_flags &= ~CRYPTO_F_DONE; 1067 cod->done = false; 1068 goto again; 1069 } 1070 1071 if (crp->crp_etype != 0) { 1072 error = crp->crp_etype; 1073 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1074 goto bail; 1075 } 1076 1077 if (caead->dst && (error = copyout( 1078 (caddr_t)cod->uio.uio_iov[0].iov_base + caead->aadlen, caead->dst, 1079 caead->len))) { 1080 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1081 goto bail; 1082 } 1083 1084 if ((error = copyout((caddr_t)cod->uio.uio_iov[0].iov_base + 1085 caead->aadlen + caead->len, caead->tag, cse->thash->hashsize))) { 1086 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1087 goto bail; 1088 } 1089 1090 bail: 1091 crypto_freereq(crp); 1092 if (cod) 1093 cod_free(cod); 1094 1095 return (error); 1096 } 1097 1098 static int 1099 cryptodev_cb(struct cryptop *crp) 1100 { 1101 struct cryptop_data *cod = crp->crp_opaque; 1102 1103 /* 1104 * Lock to ensure the wakeup() is not missed by the loops 1105 * waiting on cod->done in cryptodev_op() and 1106 * cryptodev_aead(). 1107 */ 1108 mtx_lock(&cod->cse->lock); 1109 cod->done = true; 1110 mtx_unlock(&cod->cse->lock); 1111 wakeup(cod); 1112 return (0); 1113 } 1114 1115 static int 1116 cryptodevkey_cb(void *op) 1117 { 1118 struct cryptkop *krp = (struct cryptkop *) op; 1119 1120 wakeup_one(krp); 1121 return (0); 1122 } 1123 1124 static int 1125 cryptodev_key(struct crypt_kop *kop) 1126 { 1127 struct cryptkop *krp = NULL; 1128 int error = EINVAL; 1129 int in, out, size, i; 1130 1131 if (kop->crk_iparams + kop->crk_oparams > CRK_MAXPARAM) { 1132 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1133 return (EFBIG); 1134 } 1135 1136 in = kop->crk_iparams; 1137 out = kop->crk_oparams; 1138 switch (kop->crk_op) { 1139 case CRK_MOD_EXP: 1140 if (in == 3 && out == 1) 1141 break; 1142 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1143 return (EINVAL); 1144 case CRK_MOD_EXP_CRT: 1145 if (in == 6 && out == 1) 1146 break; 1147 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1148 return (EINVAL); 1149 case CRK_DSA_SIGN: 1150 if (in == 5 && out == 2) 1151 break; 1152 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1153 return (EINVAL); 1154 case CRK_DSA_VERIFY: 1155 if (in == 7 && out == 0) 1156 break; 1157 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1158 return (EINVAL); 1159 case CRK_DH_COMPUTE_KEY: 1160 if (in == 3 && out == 1) 1161 break; 1162 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1163 return (EINVAL); 1164 default: 1165 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1166 return (EINVAL); 1167 } 1168 1169 krp = (struct cryptkop *)malloc(sizeof *krp, M_XDATA, M_WAITOK|M_ZERO); 1170 if (!krp) { 1171 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1172 return (ENOMEM); 1173 } 1174 krp->krp_op = kop->crk_op; 1175 krp->krp_status = kop->crk_status; 1176 krp->krp_iparams = kop->crk_iparams; 1177 krp->krp_oparams = kop->crk_oparams; 1178 krp->krp_crid = kop->crk_crid; 1179 krp->krp_status = 0; 1180 krp->krp_callback = (int (*) (struct cryptkop *)) cryptodevkey_cb; 1181 1182 for (i = 0; i < CRK_MAXPARAM; i++) { 1183 if (kop->crk_param[i].crp_nbits > 65536) { 1184 /* Limit is the same as in OpenBSD */ 1185 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1186 goto fail; 1187 } 1188 krp->krp_param[i].crp_nbits = kop->crk_param[i].crp_nbits; 1189 } 1190 for (i = 0; i < krp->krp_iparams + krp->krp_oparams; i++) { 1191 size = (krp->krp_param[i].crp_nbits + 7) / 8; 1192 if (size == 0) 1193 continue; 1194 krp->krp_param[i].crp_p = malloc(size, M_XDATA, M_WAITOK); 1195 if (i >= krp->krp_iparams) 1196 continue; 1197 error = copyin(kop->crk_param[i].crp_p, krp->krp_param[i].crp_p, size); 1198 if (error) { 1199 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1200 goto fail; 1201 } 1202 } 1203 1204 error = crypto_kdispatch(krp); 1205 if (error) { 1206 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1207 goto fail; 1208 } 1209 error = tsleep(krp, PSOCK, "crydev", 0); 1210 if (error) { 1211 /* XXX can this happen? if so, how do we recover? */ 1212 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1213 goto fail; 1214 } 1215 1216 kop->crk_crid = krp->krp_crid; /* device that did the work */ 1217 if (krp->krp_status != 0) { 1218 error = krp->krp_status; 1219 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1220 goto fail; 1221 } 1222 1223 for (i = krp->krp_iparams; i < krp->krp_iparams + krp->krp_oparams; i++) { 1224 size = (krp->krp_param[i].crp_nbits + 7) / 8; 1225 if (size == 0) 1226 continue; 1227 error = copyout(krp->krp_param[i].crp_p, kop->crk_param[i].crp_p, size); 1228 if (error) { 1229 SDT_PROBE1(opencrypto, dev, ioctl, error, __LINE__); 1230 goto fail; 1231 } 1232 } 1233 1234 fail: 1235 if (krp) { 1236 kop->crk_status = krp->krp_status; 1237 for (i = 0; i < CRK_MAXPARAM; i++) { 1238 if (krp->krp_param[i].crp_p) 1239 free(krp->krp_param[i].crp_p, M_XDATA); 1240 } 1241 free(krp, M_XDATA); 1242 } 1243 return (error); 1244 } 1245 1246 static int 1247 cryptodev_find(struct crypt_find_op *find) 1248 { 1249 device_t dev; 1250 size_t fnlen = sizeof find->name; 1251 1252 if (find->crid != -1) { 1253 dev = crypto_find_device_byhid(find->crid); 1254 if (dev == NULL) 1255 return (ENOENT); 1256 strncpy(find->name, device_get_nameunit(dev), fnlen); 1257 find->name[fnlen - 1] = '\x0'; 1258 } else { 1259 find->name[fnlen - 1] = '\x0'; 1260 find->crid = crypto_find_driver(find->name); 1261 if (find->crid == -1) 1262 return (ENOENT); 1263 } 1264 return (0); 1265 } 1266 1267 /* ARGSUSED */ 1268 static int 1269 cryptof_stat( 1270 struct file *fp, 1271 struct stat *sb, 1272 struct ucred *active_cred, 1273 struct thread *td) 1274 { 1275 1276 return (EOPNOTSUPP); 1277 } 1278 1279 /* ARGSUSED */ 1280 static int 1281 cryptof_close(struct file *fp, struct thread *td) 1282 { 1283 struct fcrypt *fcr = fp->f_data; 1284 struct csession *cse; 1285 1286 while ((cse = TAILQ_FIRST(&fcr->csessions))) { 1287 TAILQ_REMOVE(&fcr->csessions, cse, next); 1288 (void)csefree(cse); 1289 } 1290 free(fcr, M_XDATA); 1291 fp->f_data = NULL; 1292 return 0; 1293 } 1294 1295 static int 1296 cryptof_fill_kinfo(struct file *fp, struct kinfo_file *kif, struct filedesc *fdp) 1297 { 1298 1299 kif->kf_type = KF_TYPE_CRYPTO; 1300 return (0); 1301 } 1302 1303 static struct csession * 1304 csefind(struct fcrypt *fcr, u_int ses) 1305 { 1306 struct csession *cse; 1307 1308 TAILQ_FOREACH(cse, &fcr->csessions, next) 1309 if (cse->ses == ses) 1310 return (cse); 1311 return (NULL); 1312 } 1313 1314 static int 1315 csedelete(struct fcrypt *fcr, struct csession *cse_del) 1316 { 1317 struct csession *cse; 1318 1319 TAILQ_FOREACH(cse, &fcr->csessions, next) { 1320 if (cse == cse_del) { 1321 TAILQ_REMOVE(&fcr->csessions, cse, next); 1322 return (1); 1323 } 1324 } 1325 return (0); 1326 } 1327 1328 static struct csession * 1329 cseadd(struct fcrypt *fcr, struct csession *cse) 1330 { 1331 TAILQ_INSERT_TAIL(&fcr->csessions, cse, next); 1332 cse->ses = fcr->sesn++; 1333 return (cse); 1334 } 1335 1336 struct csession * 1337 csecreate(struct fcrypt *fcr, u_int64_t sid, caddr_t key, u_int64_t keylen, 1338 caddr_t mackey, u_int64_t mackeylen, u_int32_t cipher, u_int32_t mac, 1339 struct enc_xform *txform, struct auth_hash *thash) 1340 { 1341 struct csession *cse; 1342 1343 cse = malloc(sizeof(struct csession), M_XDATA, M_NOWAIT | M_ZERO); 1344 if (cse == NULL) 1345 return NULL; 1346 mtx_init(&cse->lock, "cryptodev", "crypto session lock", MTX_DEF); 1347 cse->key = key; 1348 cse->keylen = keylen/8; 1349 cse->mackey = mackey; 1350 cse->mackeylen = mackeylen/8; 1351 cse->sid = sid; 1352 cse->cipher = cipher; 1353 cse->mac = mac; 1354 cse->txform = txform; 1355 cse->thash = thash; 1356 cseadd(fcr, cse); 1357 return (cse); 1358 } 1359 1360 static int 1361 csefree(struct csession *cse) 1362 { 1363 int error; 1364 1365 error = crypto_freesession(cse->sid); 1366 mtx_destroy(&cse->lock); 1367 if (cse->key) 1368 free(cse->key, M_XDATA); 1369 if (cse->mackey) 1370 free(cse->mackey, M_XDATA); 1371 free(cse, M_XDATA); 1372 return (error); 1373 } 1374 1375 static int 1376 cryptoopen(struct cdev *dev, int oflags, int devtype, struct thread *td) 1377 { 1378 return (0); 1379 } 1380 1381 static int 1382 cryptoread(struct cdev *dev, struct uio *uio, int ioflag) 1383 { 1384 return (EIO); 1385 } 1386 1387 static int 1388 cryptowrite(struct cdev *dev, struct uio *uio, int ioflag) 1389 { 1390 return (EIO); 1391 } 1392 1393 static int 1394 cryptoioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td) 1395 { 1396 struct file *f; 1397 struct fcrypt *fcr; 1398 int fd, error; 1399 1400 switch (cmd) { 1401 case CRIOGET: 1402 fcr = malloc(sizeof(struct fcrypt), M_XDATA, M_WAITOK); 1403 TAILQ_INIT(&fcr->csessions); 1404 fcr->sesn = 0; 1405 1406 error = falloc(td, &f, &fd, 0); 1407 1408 if (error) { 1409 free(fcr, M_XDATA); 1410 return (error); 1411 } 1412 /* falloc automatically provides an extra reference to 'f'. */ 1413 finit(f, FREAD | FWRITE, DTYPE_CRYPTO, fcr, &cryptofops); 1414 *(u_int32_t *)data = fd; 1415 fdrop(f, td); 1416 break; 1417 case CRIOFINDDEV: 1418 error = cryptodev_find((struct crypt_find_op *)data); 1419 break; 1420 case CRIOASYMFEAT: 1421 error = crypto_getfeat((int *)data); 1422 break; 1423 default: 1424 error = EINVAL; 1425 break; 1426 } 1427 return (error); 1428 } 1429 1430 static struct cdevsw crypto_cdevsw = { 1431 .d_version = D_VERSION, 1432 .d_flags = D_NEEDGIANT, 1433 .d_open = cryptoopen, 1434 .d_read = cryptoread, 1435 .d_write = cryptowrite, 1436 .d_ioctl = cryptoioctl, 1437 .d_name = "crypto", 1438 }; 1439 static struct cdev *crypto_dev; 1440 1441 /* 1442 * Initialization code, both for static and dynamic loading. 1443 */ 1444 static int 1445 cryptodev_modevent(module_t mod, int type, void *unused) 1446 { 1447 switch (type) { 1448 case MOD_LOAD: 1449 if (bootverbose) 1450 printf("crypto: <crypto device>\n"); 1451 crypto_dev = make_dev(&crypto_cdevsw, 0, 1452 UID_ROOT, GID_WHEEL, 0666, 1453 "crypto"); 1454 return 0; 1455 case MOD_UNLOAD: 1456 /*XXX disallow if active sessions */ 1457 destroy_dev(crypto_dev); 1458 return 0; 1459 } 1460 return EINVAL; 1461 } 1462 1463 static moduledata_t cryptodev_mod = { 1464 "cryptodev", 1465 cryptodev_modevent, 1466 0 1467 }; 1468 MODULE_VERSION(cryptodev, 1); 1469 DECLARE_MODULE(cryptodev, cryptodev_mod, SI_SUB_PSEUDO, SI_ORDER_ANY); 1470 MODULE_DEPEND(cryptodev, crypto, 1, 1, 1); 1471 MODULE_DEPEND(cryptodev, zlib, 1, 1, 1); 1472