1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2023-2025 RackTop Systems, Inc. 24 */ 25 26 #ifndef _SYS_CRYPTO_IMPL_H 27 #define _SYS_CRYPTO_IMPL_H 28 29 /* 30 * Kernel Cryptographic Framework private implementation definitions. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 36 #ifdef _KERNEL 37 #include <sys/crypto/common.h> 38 #include <sys/crypto/api.h> 39 #include <sys/crypto/spi.h> 40 #include <sys/crypto/ioctl.h> 41 #include <sys/atomic.h> 42 #include <sys/project.h> 43 #include <sys/taskq.h> 44 #include <sys/rctl.h> 45 #include <sys/cpuvar.h> 46 #endif /* _KERNEL */ 47 48 #ifdef __cplusplus 49 extern "C" { 50 #endif 51 52 #ifdef _KERNEL 53 54 /* 55 * Prefixes convention: structures internal to the kernel cryptographic 56 * framework start with 'kcf_'. Exposed structure start with 'crypto_'. 57 */ 58 59 /* Provider stats. Not protected. */ 60 typedef struct kcf_prov_stats { 61 kstat_named_t ps_ops_total; 62 kstat_named_t ps_ops_passed; 63 kstat_named_t ps_ops_failed; 64 kstat_named_t ps_ops_busy_rval; 65 } kcf_prov_stats_t; 66 67 /* Various kcf stats. Not protected. */ 68 typedef struct kcf_stats { 69 kstat_named_t ks_thrs_in_pool; 70 kstat_named_t ks_idle_thrs; 71 kstat_named_t ks_minthrs; 72 kstat_named_t ks_maxthrs; 73 kstat_named_t ks_swq_njobs; 74 kstat_named_t ks_swq_maxjobs; 75 kstat_named_t ks_taskq_threads; 76 kstat_named_t ks_taskq_minalloc; 77 kstat_named_t ks_taskq_maxalloc; 78 } kcf_stats_t; 79 80 #define CPU_SEQID (CPU->cpu_seqid) 81 82 typedef struct kcf_lock_withpad { 83 kmutex_t kl_lock; 84 uint8_t kl_pad[64 - sizeof (kmutex_t)]; 85 } kcf_lock_withpad_t; 86 87 /* 88 * Per-CPU structure used by a provider to keep track of 89 * various counters. 90 */ 91 typedef struct kcf_prov_cpu { 92 kmutex_t kp_lock; 93 int kp_holdcnt; /* can go negative! */ 94 uint_t kp_jobcnt; 95 96 uint64_t kp_ndispatches; 97 uint64_t kp_nfails; 98 uint64_t kp_nbusy_rval; 99 kcondvar_t kp_cv; 100 101 uint8_t kp_pad[64 - sizeof (kmutex_t) - 2 * sizeof (int) - 102 3 * sizeof (uint64_t) - sizeof (kcondvar_t)]; 103 } kcf_prov_cpu_t; 104 105 /* 106 * kcf_get_refcnt(pd) is the number of inflight requests to the 107 * provider. So, it is a good measure of the load on a provider when 108 * it is not in a busy state. Once a provider notifies it is busy, requests 109 * backup in the taskq. So, we use tq_nalloc in that case which gives 110 * the number of task entries in the task queue. Note that we do not 111 * acquire any locks here as it is not critical to get the exact number 112 * and the lock contention is too costly for this code path. 113 */ 114 #define KCF_PROV_LOAD(pd) ((pd)->pd_state != KCF_PROV_BUSY ? \ 115 kcf_get_refcnt(pd, B_FALSE) : (pd)->pd_taskq->tq_nalloc) 116 117 118 /* 119 * The following two macros should be 120 * #define KCF_OPS_CLASSSIZE (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2) 121 * #define KCF_MAXMECHTAB KCF_MAXCIPHER 122 * 123 * However, doing that would involve reorganizing the header file a bit. 124 * When impl.h is broken up (bug# 4703218), this will be done. For now, 125 * we hardcode these values. 126 */ 127 #define KCF_OPS_CLASSSIZE 8 128 #define KCF_MAXMECHTAB 32 129 130 /* 131 * Valid values for the state of a provider. The order of 132 * the elements is important. 133 * 134 * Routines which get a provider or the list of providers 135 * should pick only those that are either in KCF_PROV_READY state 136 * or in KCF_PROV_BUSY state. 137 */ 138 typedef enum { 139 KCF_PROV_ALLOCATED = 1, 140 KCF_PROV_UNVERIFIED, 141 KCF_PROV_UNVERIFIED_FIPS140, 142 KCF_PROV_VERIFICATION_FAILED, 143 /* 144 * state < KCF_PROV_READY means the provider can not 145 * be used at all. 146 */ 147 KCF_PROV_READY, 148 KCF_PROV_BUSY, 149 /* 150 * state > KCF_PROV_BUSY means the provider can not 151 * be used for new requests. 152 */ 153 KCF_PROV_FAILED, 154 /* 155 * Threads setting the following two states should do so only 156 * if the current state < KCF_PROV_DISABLED. 157 */ 158 KCF_PROV_DISABLED, 159 KCF_PROV_UNREGISTERING, 160 KCF_PROV_UNREGISTERED 161 } kcf_prov_state_t; 162 163 #define KCF_IS_PROV_UNVERIFIED(pd) ((pd)->pd_state == KCF_PROV_UNVERIFIED) 164 #define KCF_IS_PROV_USABLE(pd) ((pd)->pd_state == KCF_PROV_READY || \ 165 (pd)->pd_state == KCF_PROV_BUSY) 166 #define KCF_IS_PROV_REMOVED(pd) ((pd)->pd_state >= KCF_PROV_UNREGISTERING) 167 168 /* Internal flags valid for pd_flags field */ 169 #define KCF_LPROV_MEMBER 0x80000000 /* is member of a logical provider */ 170 171 /* 172 * A provider descriptor structure. There is one such structure per 173 * provider. It is allocated and initialized at registration time and 174 * freed when the provider unregisters. 175 * 176 * pd_prov_type: Provider type, hardware or software 177 * pd_sid: Session ID of the provider used by kernel clients. 178 * This is valid only for session-oriented providers. 179 * pd_taskq: taskq used to dispatch crypto requests 180 * pd_nbins: number of bins in pd_percpu_bins 181 * pd_percpu_bins: Pointer to an array of per-CPU structures 182 * containing a lock, a cv and various counters. 183 * pd_lock: lock protects pd_state and pd_provider_list 184 * pd_state: State value of the provider 185 * pd_provider_list: Used to cross-reference logical providers and their 186 * members. Not used for software providers. 187 * pd_resume_cv: cv to wait for state to change from KCF_PROV_BUSY 188 * pd_prov_handle: Provider handle specified by provider 189 * pd_ops_vector: The ops vector specified by Provider 190 * pd_mech_indx: Lookup table which maps a core framework mechanism 191 * number to an index in pd_mechanisms array 192 * pd_mechanisms: Array of mechanisms supported by the provider, specified 193 * by the provider during registration 194 * pd_mech_list_count: The number of entries in pi_mechanisms, specified 195 * by the provider during registration 196 * pd_name: Device name or module name 197 * pd_instance: Device instance 198 * pd_module_id: Module ID returned by modload 199 * pd_mctlp: Pointer to modctl structure for this provider 200 * pd_description: Provider description string 201 * pd_flags: bitwise OR of pi_flags from crypto_provider_info_t 202 * and other internal flags defined above. 203 * pd_hash_limit: Maximum data size that hash mechanisms of this provider 204 * can support. 205 * pd_hmac_limit: Maximum data size that HMAC mechanisms of this provider 206 * can support. 207 * pd_kcf_prov_handle: KCF-private handle assigned by KCF 208 * pd_prov_id: Identification # assigned by KCF to provider 209 * pd_kstat: kstat associated with the provider 210 * pd_ks_data: kstat data 211 */ 212 typedef struct kcf_provider_desc { 213 crypto_provider_type_t pd_prov_type; 214 crypto_session_id_t pd_sid; 215 taskq_t *pd_taskq; 216 uint_t pd_nbins; 217 kcf_prov_cpu_t *pd_percpu_bins; 218 kmutex_t pd_lock; 219 kcf_prov_state_t pd_state; 220 struct kcf_provider_list *pd_provider_list; 221 kcondvar_t pd_resume_cv; 222 crypto_provider_handle_t pd_prov_handle; 223 crypto_ops_t *pd_ops_vector; 224 ushort_t pd_mech_indx[KCF_OPS_CLASSSIZE]\ 225 [KCF_MAXMECHTAB]; 226 crypto_mech_info_t *pd_mechanisms; 227 uint_t pd_mech_list_count; 228 char *pd_name; 229 uint_t pd_instance; 230 int pd_module_id; 231 struct modctl *pd_mctlp; 232 char *pd_description; 233 uint_t pd_flags; 234 uint_t pd_hash_limit; 235 uint_t pd_hmac_limit; 236 crypto_kcf_provider_handle_t pd_kcf_prov_handle; 237 crypto_provider_id_t pd_prov_id; 238 kstat_t *pd_kstat; 239 kcf_prov_stats_t pd_ks_data; 240 } kcf_provider_desc_t; 241 242 /* useful for making a list of providers */ 243 typedef struct kcf_provider_list { 244 struct kcf_provider_list *pl_next; 245 struct kcf_provider_desc *pl_provider; 246 } kcf_provider_list_t; 247 248 /* 249 * If a component has a reference to a kcf_provider_desc_t, 250 * it REFHOLD()s. A new provider descriptor which is referenced only 251 * by the providers table has a reference counter of one. 252 */ 253 #define KCF_PROV_REFHOLD(desc) { \ 254 kcf_prov_cpu_t *mp; \ 255 \ 256 mp = &((desc)->pd_percpu_bins[CPU_SEQID]); \ 257 mutex_enter(&mp->kp_lock); \ 258 mp->kp_holdcnt++; \ 259 mutex_exit(&mp->kp_lock); \ 260 } 261 262 #define KCF_PROV_REFRELE(desc) { \ 263 kcf_prov_cpu_t *mp; \ 264 \ 265 mp = &((desc)->pd_percpu_bins[CPU_SEQID]); \ 266 mutex_enter(&mp->kp_lock); \ 267 mp->kp_holdcnt--; \ 268 mutex_exit(&mp->kp_lock); \ 269 } 270 271 #define KCF_PROV_REFHELD(desc) (kcf_get_refcnt(desc, B_TRUE) >= 1) 272 273 /* 274 * The JOB macros are used only for a hardware provider. 275 * Hardware providers can have holds that stay forever. 276 * So, the job counter is used to check if it is safe to 277 * unregister a provider. 278 */ 279 #define KCF_PROV_JOB_HOLD(mp) { \ 280 mutex_enter(&(mp)->kp_lock); \ 281 (mp)->kp_jobcnt++; \ 282 mutex_exit(&(mp)->kp_lock); \ 283 } 284 285 #define KCF_PROV_JOB_RELE(mp) { \ 286 mutex_enter(&(mp)->kp_lock); \ 287 (mp)->kp_jobcnt--; \ 288 if ((mp)->kp_jobcnt == 0) \ 289 cv_signal(&(mp)->kp_cv); \ 290 mutex_exit(&(mp)->kp_lock); \ 291 } 292 293 #define KCF_PROV_JOB_RELE_STAT(mp, doincr) { \ 294 if (doincr) \ 295 (mp)->kp_nfails++; \ 296 KCF_PROV_JOB_RELE(mp); \ 297 } 298 299 #define KCF_PROV_INCRSTATS(pd, error) { \ 300 kcf_prov_cpu_t *mp; \ 301 \ 302 mp = &((pd)->pd_percpu_bins[CPU_SEQID]); \ 303 mp->kp_ndispatches++; \ 304 if ((error) == CRYPTO_BUSY) \ 305 mp->kp_nbusy_rval++; \ 306 else if ((error) != CRYPTO_SUCCESS && (error) != CRYPTO_QUEUED) \ 307 mp->kp_nfails++; \ 308 } 309 310 /* list of crypto_mech_info_t valid as the second mech in a dual operation */ 311 312 typedef struct crypto_mech_info_list { 313 struct crypto_mech_info_list *ml_next; 314 crypto_mech_type_t ml_kcf_mechid; /* KCF's id */ 315 crypto_mech_info_t ml_mech_info; 316 } crypto_mech_info_list_t; 317 318 /* 319 * An element in a mechanism provider descriptors chain. 320 * The kcf_prov_mech_desc_t is duplicated in every chain the provider belongs 321 * to. This is a small tradeoff memory vs mutex spinning time to access the 322 * common provider field. 323 */ 324 325 typedef struct kcf_prov_mech_desc { 326 struct kcf_mech_entry *pm_me; /* Back to the head */ 327 struct kcf_prov_mech_desc *pm_next; /* Next in the chain */ 328 crypto_mech_info_t pm_mech_info; /* Provider mech info */ 329 crypto_mech_info_list_t *pm_mi_list; /* list for duals */ 330 kcf_provider_desc_t *pm_prov_desc; /* Common desc. */ 331 } kcf_prov_mech_desc_t; 332 333 /* and the notation shortcuts ... */ 334 #define pm_provider_type pm_prov_desc.pd_provider_type 335 #define pm_provider_handle pm_prov_desc.pd_provider_handle 336 #define pm_ops_vector pm_prov_desc.pd_ops_vector 337 338 extern kcf_lock_withpad_t *me_mutexes; 339 340 typedef int (*kcf_copyin_param_func_t) (caddr_t, size_t, crypto_mechanism_t *, 341 int, int); 342 343 #define KCF_CPU_PAD (128 - sizeof (crypto_mech_name_t) - \ 344 sizeof (crypto_mech_type_t) - \ 345 2 * sizeof (kcf_prov_mech_desc_t *) - \ 346 sizeof (int) - sizeof (uint32_t) - sizeof (size_t) - \ 347 sizeof (kcf_copyin_param_func_t)) 348 349 CTASSERT(KCF_CPU_PAD > 0); 350 351 /* 352 * A mechanism entry in an xxx_mech_tab[]. KCF_CPU_PAD needs 353 * to be adjusted if this structure is changed. 354 */ 355 typedef struct kcf_mech_entry { 356 crypto_mech_name_t me_name; /* mechanism name */ 357 crypto_mech_type_t me_mechid; /* Internal id for mechanism */ 358 kcf_prov_mech_desc_t *me_hw_prov_chain; /* list of HW providers */ 359 kcf_prov_mech_desc_t *me_sw_prov; /* SW provider */ 360 /* 361 * Number of HW providers in the chain. There is only one 362 * SW provider. So, we need only a count of HW providers. 363 */ 364 int me_num_hwprov; 365 /* 366 * When a SW provider is present, this is the generation number that 367 * ensures no objects from old SW providers are used in the new one 368 */ 369 uint32_t me_gen_swprov; 370 /* 371 * threshold for using hardware providers for this mech 372 */ 373 size_t me_threshold; 374 kcf_copyin_param_func_t me_copyin_param; 375 uint8_t me_pad[KCF_CPU_PAD]; 376 } kcf_mech_entry_t; 377 378 /* 379 * A policy descriptor structure. It is allocated and initialized 380 * when administrative ioctls load disabled mechanisms. 381 * 382 * pd_prov_type: Provider type, hardware or software 383 * pd_name: Device name or module name. 384 * pd_instance: Device instance. 385 * pd_refcnt: Reference counter for this policy descriptor 386 * pd_mutex: Protects array and count of disabled mechanisms. 387 * pd_disabled_count: Count of disabled mechanisms. 388 * pd_disabled_mechs: Array of disabled mechanisms. 389 */ 390 typedef struct kcf_policy_desc { 391 crypto_provider_type_t pd_prov_type; 392 char *pd_name; 393 uint_t pd_instance; 394 uint_t pd_refcnt; 395 kmutex_t pd_mutex; 396 uint_t pd_disabled_count; 397 crypto_mech_name_t *pd_disabled_mechs; 398 } kcf_policy_desc_t; 399 400 /* 401 * If a component has a reference to a kcf_policy_desc_t, 402 * it REFHOLD()s. A new policy descriptor which is referenced only 403 * by the policy table has a reference count of one. 404 */ 405 #define KCF_POLICY_REFHOLD(desc) { \ 406 atomic_inc_32(&(desc)->pd_refcnt); \ 407 ASSERT((desc)->pd_refcnt != 0); \ 408 } 409 410 /* 411 * Releases a reference to a policy descriptor. When the last 412 * reference is released, the descriptor is freed. 413 */ 414 #define KCF_POLICY_REFRELE(desc) { \ 415 ASSERT((desc)->pd_refcnt != 0); \ 416 membar_exit(); \ 417 if (atomic_dec_32_nv(&(desc)->pd_refcnt) == 0) \ 418 kcf_policy_free_desc(desc); \ 419 } 420 421 /* 422 * This entry stores the name of a software module and its 423 * mechanisms. The mechanisms are 'hints' that are used to 424 * trigger loading of the module. 425 */ 426 typedef struct kcf_soft_conf_entry { 427 struct kcf_soft_conf_entry *ce_next; 428 char *ce_name; 429 crypto_mech_name_t *ce_mechs; 430 uint_t ce_count; 431 } kcf_soft_conf_entry_t; 432 433 extern kmutex_t soft_config_mutex; 434 extern kcf_soft_conf_entry_t *soft_config_list; 435 436 /* 437 * Global tables. The sizes are from the predefined PKCS#11 v2.20 mechanisms, 438 * with a margin of few extra empty entry points 439 */ 440 441 #define KCF_MAXDIGEST 16 /* Digests */ 442 #define KCF_MAXCIPHER 64 /* Ciphers */ 443 #define KCF_MAXMAC 40 /* Message authentication codes */ 444 #define KCF_MAXSIGN 24 /* Sign/Verify */ 445 #define KCF_MAXKEYOPS 116 /* Key generation and derivation */ 446 #define KCF_MAXMISC 16 /* Others ... */ 447 448 #define KCF_MAXMECHS KCF_MAXDIGEST + KCF_MAXCIPHER + KCF_MAXMAC + \ 449 KCF_MAXSIGN + KCF_MAXKEYOPS + \ 450 KCF_MAXMISC 451 452 extern kcf_mech_entry_t kcf_digest_mechs_tab[]; 453 extern kcf_mech_entry_t kcf_cipher_mechs_tab[]; 454 extern kcf_mech_entry_t kcf_mac_mechs_tab[]; 455 extern kcf_mech_entry_t kcf_sign_mechs_tab[]; 456 extern kcf_mech_entry_t kcf_keyops_mechs_tab[]; 457 extern kcf_mech_entry_t kcf_misc_mechs_tab[]; 458 459 extern kmutex_t kcf_mech_tabs_lock; 460 461 typedef enum { 462 KCF_DIGEST_CLASS = 1, 463 KCF_CIPHER_CLASS, 464 KCF_MAC_CLASS, 465 KCF_SIGN_CLASS, 466 KCF_KEYOPS_CLASS, 467 KCF_MISC_CLASS 468 } kcf_ops_class_t; 469 470 #define KCF_FIRST_OPSCLASS KCF_DIGEST_CLASS 471 #define KCF_LAST_OPSCLASS KCF_MISC_CLASS 472 473 /* The table of all the kcf_xxx_mech_tab[]s, indexed by kcf_ops_class */ 474 475 typedef struct kcf_mech_entry_tab { 476 int met_size; /* Size of the met_tab[] */ 477 kcf_mech_entry_t *met_tab; /* the table */ 478 } kcf_mech_entry_tab_t; 479 480 extern kcf_mech_entry_tab_t kcf_mech_tabs_tab[]; 481 482 #define KCF_MECHID(class, index) \ 483 (((crypto_mech_type_t)(class) << 32) | (crypto_mech_type_t)(index)) 484 485 #define KCF_MECH2CLASS(mech_type) ((kcf_ops_class_t)((mech_type) >> 32)) 486 487 #define KCF_MECH2INDEX(mech_type) ((int)(mech_type)) 488 489 #define KCF_TO_PROV_MECH_INDX(pd, mech_type) \ 490 ((pd)->pd_mech_indx[KCF_MECH2CLASS(mech_type)] \ 491 [KCF_MECH2INDEX(mech_type)]) 492 493 #define KCF_TO_PROV_MECHINFO(pd, mech_type) \ 494 ((pd)->pd_mechanisms[KCF_TO_PROV_MECH_INDX(pd, mech_type)]) 495 496 #define KCF_TO_PROV_MECHNUM(pd, mech_type) \ 497 (KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_number) 498 499 #define KCF_CAN_SHARE_OPSTATE(pd, mech_type) \ 500 ((KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_flags) & \ 501 CRYPTO_CAN_SHARE_OPSTATE) 502 503 /* ps_refcnt is protected by cm_lock in the crypto_minor structure */ 504 typedef struct crypto_provider_session { 505 struct crypto_provider_session *ps_next; 506 crypto_session_id_t ps_session; 507 kcf_provider_desc_t *ps_provider; 508 kcf_provider_desc_t *ps_real_provider; 509 uint_t ps_refcnt; 510 } crypto_provider_session_t; 511 512 typedef struct crypto_session_data { 513 kmutex_t sd_lock; 514 kcondvar_t sd_cv; 515 uint32_t sd_flags; 516 int sd_pre_approved_amount; 517 crypto_ctx_t *sd_digest_ctx; 518 crypto_ctx_t *sd_encr_ctx; 519 crypto_ctx_t *sd_decr_ctx; 520 crypto_ctx_t *sd_mac_ctx; 521 crypto_ctx_t *sd_sign_ctx; 522 crypto_ctx_t *sd_verify_ctx; 523 crypto_ctx_t *sd_sign_recover_ctx; 524 crypto_ctx_t *sd_verify_recover_ctx; 525 kcf_provider_desc_t *sd_provider; 526 void *sd_find_init_cookie; 527 crypto_provider_session_t *sd_provider_session; 528 } crypto_session_data_t; 529 530 #define CRYPTO_SESSION_IN_USE 0x00000001 531 #define CRYPTO_SESSION_IS_BUSY 0x00000002 532 #define CRYPTO_SESSION_IS_CLOSED 0x00000004 533 534 #define KCF_MAX_PIN_LEN 1024 535 536 /* 537 * Per-minor info. 538 * 539 * cm_lock protects everything in this structure except for cm_refcnt. 540 */ 541 typedef struct crypto_minor { 542 uint_t cm_refcnt; 543 kmutex_t cm_lock; 544 kcondvar_t cm_cv; 545 crypto_session_data_t **cm_session_table; 546 uint_t cm_session_table_count; 547 kcf_provider_desc_t **cm_provider_array; 548 uint_t cm_provider_count; 549 crypto_provider_session_t *cm_provider_session; 550 } crypto_minor_t; 551 552 /* resource control framework handle used by /dev/crypto */ 553 extern rctl_hndl_t rc_project_crypto_mem; 554 /* 555 * Return codes for internal functions 556 */ 557 #define KCF_SUCCESS 0x0 /* Successful call */ 558 #define KCF_INVALID_MECH_NUMBER 0x1 /* invalid mechanism number */ 559 #define KCF_INVALID_MECH_NAME 0x2 /* invalid mechanism name */ 560 #define KCF_INVALID_MECH_CLASS 0x3 /* invalid mechanism class */ 561 #define KCF_MECH_TAB_FULL 0x4 /* Need more room in the mech tabs. */ 562 #define KCF_INVALID_INDX ((ushort_t)-1) 563 564 /* 565 * kCF internal mechanism and function group for tracking RNG providers. 566 */ 567 #define SUN_RANDOM "random" 568 #define CRYPTO_FG_RANDOM 0x80000000 /* generate_random() */ 569 570 /* 571 * Wrappers for ops vectors. In the wrapper definitions below, the pd 572 * argument always corresponds to a pointer to a provider descriptor 573 * of type kcf_prov_desc_t. 574 */ 575 576 #define KCF_PROV_CONTROL_OPS(pd) ((pd)->pd_ops_vector->co_control_ops) 577 #define KCF_PROV_CTX_OPS(pd) ((pd)->pd_ops_vector->co_ctx_ops) 578 #define KCF_PROV_DIGEST_OPS(pd) ((pd)->pd_ops_vector->co_digest_ops) 579 #define KCF_PROV_CIPHER_OPS(pd) ((pd)->pd_ops_vector->co_cipher_ops) 580 #define KCF_PROV_MAC_OPS(pd) ((pd)->pd_ops_vector->co_mac_ops) 581 #define KCF_PROV_SIGN_OPS(pd) ((pd)->pd_ops_vector->co_sign_ops) 582 #define KCF_PROV_VERIFY_OPS(pd) ((pd)->pd_ops_vector->co_verify_ops) 583 #define KCF_PROV_DUAL_OPS(pd) ((pd)->pd_ops_vector->co_dual_ops) 584 #define KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) \ 585 ((pd)->pd_ops_vector->co_dual_cipher_mac_ops) 586 #define KCF_PROV_RANDOM_OPS(pd) ((pd)->pd_ops_vector->co_random_ops) 587 #define KCF_PROV_SESSION_OPS(pd) ((pd)->pd_ops_vector->co_session_ops) 588 #define KCF_PROV_OBJECT_OPS(pd) ((pd)->pd_ops_vector->co_object_ops) 589 #define KCF_PROV_KEY_OPS(pd) ((pd)->pd_ops_vector->co_key_ops) 590 #define KCF_PROV_PROVIDER_OPS(pd) ((pd)->pd_ops_vector->co_provider_ops) 591 #define KCF_PROV_MECH_OPS(pd) ((pd)->pd_ops_vector->co_mech_ops) 592 #define KCF_PROV_NOSTORE_KEY_OPS(pd) \ 593 ((pd)->pd_ops_vector->co_nostore_key_ops) 594 #define KCF_PROV_FIPS140_OPS(pd) ((pd)->pd_ops_vector->co_fips140_ops) 595 #define KCF_PROV_PROVMGMT_OPS(pd) ((pd)->pd_ops_vector->co_provider_ops) 596 597 /* 598 * Wrappers for crypto_control_ops(9S) entry points. 599 */ 600 601 #define KCF_PROV_STATUS(pd, status) ( \ 602 (KCF_PROV_CONTROL_OPS(pd) && \ 603 KCF_PROV_CONTROL_OPS(pd)->provider_status) ? \ 604 KCF_PROV_CONTROL_OPS(pd)->provider_status( \ 605 (pd)->pd_prov_handle, status) : \ 606 CRYPTO_NOT_SUPPORTED) 607 608 /* 609 * Wrappers for crypto_ctx_ops(9S) entry points. 610 */ 611 612 #define KCF_PROV_CREATE_CTX_TEMPLATE(pd, mech, key, template, size, req) ( \ 613 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->create_ctx_template) ? \ 614 KCF_PROV_CTX_OPS(pd)->create_ctx_template( \ 615 (pd)->pd_prov_handle, mech, key, template, size, req) : \ 616 CRYPTO_NOT_SUPPORTED) 617 618 #define KCF_PROV_FREE_CONTEXT(pd, ctx) ( \ 619 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->free_context) ? \ 620 KCF_PROV_CTX_OPS(pd)->free_context(ctx) : CRYPTO_NOT_SUPPORTED) 621 622 #define KCF_PROV_COPYIN_MECH(pd, umech, kmech, errorp, mode) ( \ 623 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyin_mechanism) ? \ 624 KCF_PROV_MECH_OPS(pd)->copyin_mechanism( \ 625 (pd)->pd_prov_handle, umech, kmech, errorp, mode) : \ 626 CRYPTO_NOT_SUPPORTED) 627 628 #define KCF_PROV_COPYOUT_MECH(pd, kmech, umech, errorp, mode) ( \ 629 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyout_mechanism) ? \ 630 KCF_PROV_MECH_OPS(pd)->copyout_mechanism( \ 631 (pd)->pd_prov_handle, kmech, umech, errorp, mode) : \ 632 CRYPTO_NOT_SUPPORTED) 633 634 #define KCF_PROV_FREE_MECH(pd, prov_mech) ( \ 635 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->free_mechanism) ? \ 636 KCF_PROV_MECH_OPS(pd)->free_mechanism( \ 637 (pd)->pd_prov_handle, prov_mech) : CRYPTO_NOT_SUPPORTED) 638 639 /* 640 * Wrappers for crypto_digest_ops(9S) entry points. 641 */ 642 643 #define KCF_PROV_DIGEST_INIT(pd, ctx, mech, req) ( \ 644 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_init) ? \ 645 KCF_PROV_DIGEST_OPS(pd)->digest_init(ctx, mech, req) : \ 646 CRYPTO_NOT_SUPPORTED) 647 648 /* 649 * The _ (underscore) in _digest is needed to avoid replacing the 650 * function digest(). 651 */ 652 #define KCF_PROV_DIGEST(pd, ctx, data, _digest, req) ( \ 653 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest) ? \ 654 KCF_PROV_DIGEST_OPS(pd)->digest(ctx, data, _digest, req) : \ 655 CRYPTO_NOT_SUPPORTED) 656 657 #define KCF_PROV_DIGEST_UPDATE(pd, ctx, data, req) ( \ 658 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_update) ? \ 659 KCF_PROV_DIGEST_OPS(pd)->digest_update(ctx, data, req) : \ 660 CRYPTO_NOT_SUPPORTED) 661 662 #define KCF_PROV_DIGEST_KEY(pd, ctx, key, req) ( \ 663 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_key) ? \ 664 KCF_PROV_DIGEST_OPS(pd)->digest_key(ctx, key, req) : \ 665 CRYPTO_NOT_SUPPORTED) 666 667 #define KCF_PROV_DIGEST_FINAL(pd, ctx, digest, req) ( \ 668 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_final) ? \ 669 KCF_PROV_DIGEST_OPS(pd)->digest_final(ctx, digest, req) : \ 670 CRYPTO_NOT_SUPPORTED) 671 672 #define KCF_PROV_DIGEST_ATOMIC(pd, session, mech, data, digest, req) ( \ 673 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_atomic) ? \ 674 KCF_PROV_DIGEST_OPS(pd)->digest_atomic( \ 675 (pd)->pd_prov_handle, session, mech, data, digest, req) : \ 676 CRYPTO_NOT_SUPPORTED) 677 678 /* 679 * Wrappers for crypto_cipher_ops(9S) entry points. 680 */ 681 682 #define KCF_PROV_ENCRYPT_INIT(pd, ctx, mech, key, template, req) ( \ 683 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_init) ? \ 684 KCF_PROV_CIPHER_OPS(pd)->encrypt_init(ctx, mech, key, template, \ 685 req) : \ 686 CRYPTO_NOT_SUPPORTED) 687 688 #define KCF_PROV_ENCRYPT(pd, ctx, plaintext, ciphertext, req) ( \ 689 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt) ? \ 690 KCF_PROV_CIPHER_OPS(pd)->encrypt(ctx, plaintext, ciphertext, req) : \ 691 CRYPTO_NOT_SUPPORTED) 692 693 #define KCF_PROV_ENCRYPT_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \ 694 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_update) ? \ 695 KCF_PROV_CIPHER_OPS(pd)->encrypt_update(ctx, plaintext, \ 696 ciphertext, req) : \ 697 CRYPTO_NOT_SUPPORTED) 698 699 #define KCF_PROV_ENCRYPT_FINAL(pd, ctx, ciphertext, req) ( \ 700 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_final) ? \ 701 KCF_PROV_CIPHER_OPS(pd)->encrypt_final(ctx, ciphertext, req) : \ 702 CRYPTO_NOT_SUPPORTED) 703 704 #define KCF_PROV_ENCRYPT_ATOMIC(pd, session, mech, key, plaintext, ciphertext, \ 705 template, req) ( \ 706 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic) ? \ 707 KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic( \ 708 (pd)->pd_prov_handle, session, mech, key, plaintext, ciphertext, \ 709 template, req) : \ 710 CRYPTO_NOT_SUPPORTED) 711 712 #define KCF_PROV_DECRYPT_INIT(pd, ctx, mech, key, template, req) ( \ 713 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_init) ? \ 714 KCF_PROV_CIPHER_OPS(pd)->decrypt_init(ctx, mech, key, template, \ 715 req) : \ 716 CRYPTO_NOT_SUPPORTED) 717 718 #define KCF_PROV_DECRYPT(pd, ctx, ciphertext, plaintext, req) ( \ 719 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt) ? \ 720 KCF_PROV_CIPHER_OPS(pd)->decrypt(ctx, ciphertext, plaintext, req) : \ 721 CRYPTO_NOT_SUPPORTED) 722 723 #define KCF_PROV_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \ 724 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_update) ? \ 725 KCF_PROV_CIPHER_OPS(pd)->decrypt_update(ctx, ciphertext, \ 726 plaintext, req) : \ 727 CRYPTO_NOT_SUPPORTED) 728 729 #define KCF_PROV_DECRYPT_FINAL(pd, ctx, plaintext, req) ( \ 730 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_final) ? \ 731 KCF_PROV_CIPHER_OPS(pd)->decrypt_final(ctx, plaintext, req) : \ 732 CRYPTO_NOT_SUPPORTED) 733 734 #define KCF_PROV_DECRYPT_ATOMIC(pd, session, mech, key, ciphertext, plaintext, \ 735 template, req) ( \ 736 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic) ? \ 737 KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic( \ 738 (pd)->pd_prov_handle, session, mech, key, ciphertext, plaintext, \ 739 template, req) : \ 740 CRYPTO_NOT_SUPPORTED) 741 742 /* 743 * Wrappers for crypto_mac_ops(9S) entry points. 744 */ 745 746 #define KCF_PROV_MAC_INIT(pd, ctx, mech, key, template, req) ( \ 747 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_init) ? \ 748 KCF_PROV_MAC_OPS(pd)->mac_init(ctx, mech, key, template, req) \ 749 : CRYPTO_NOT_SUPPORTED) 750 751 /* 752 * The _ (underscore) in _mac is needed to avoid replacing the 753 * function mac(). 754 */ 755 #define KCF_PROV_MAC(pd, ctx, data, _mac, req) ( \ 756 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac) ? \ 757 KCF_PROV_MAC_OPS(pd)->mac(ctx, data, _mac, req) : \ 758 CRYPTO_NOT_SUPPORTED) 759 760 #define KCF_PROV_MAC_UPDATE(pd, ctx, data, req) ( \ 761 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_update) ? \ 762 KCF_PROV_MAC_OPS(pd)->mac_update(ctx, data, req) : \ 763 CRYPTO_NOT_SUPPORTED) 764 765 #define KCF_PROV_MAC_FINAL(pd, ctx, mac, req) ( \ 766 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_final) ? \ 767 KCF_PROV_MAC_OPS(pd)->mac_final(ctx, mac, req) : \ 768 CRYPTO_NOT_SUPPORTED) 769 770 #define KCF_PROV_MAC_ATOMIC(pd, session, mech, key, data, mac, template, \ 771 req) ( \ 772 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_atomic) ? \ 773 KCF_PROV_MAC_OPS(pd)->mac_atomic( \ 774 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \ 775 req) : \ 776 CRYPTO_NOT_SUPPORTED) 777 778 #define KCF_PROV_MAC_VERIFY_ATOMIC(pd, session, mech, key, data, mac, \ 779 template, req) ( \ 780 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_verify_atomic) ? \ 781 KCF_PROV_MAC_OPS(pd)->mac_verify_atomic( \ 782 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \ 783 req) : \ 784 CRYPTO_NOT_SUPPORTED) 785 786 /* 787 * Wrappers for crypto_sign_ops(9S) entry points. 788 */ 789 790 #define KCF_PROV_SIGN_INIT(pd, ctx, mech, key, template, req) ( \ 791 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_init) ? \ 792 KCF_PROV_SIGN_OPS(pd)->sign_init( \ 793 ctx, mech, key, template, req) : CRYPTO_NOT_SUPPORTED) 794 795 #define KCF_PROV_SIGN(pd, ctx, data, sig, req) ( \ 796 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign) ? \ 797 KCF_PROV_SIGN_OPS(pd)->sign(ctx, data, sig, req) : \ 798 CRYPTO_NOT_SUPPORTED) 799 800 #define KCF_PROV_SIGN_UPDATE(pd, ctx, data, req) ( \ 801 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_update) ? \ 802 KCF_PROV_SIGN_OPS(pd)->sign_update(ctx, data, req) : \ 803 CRYPTO_NOT_SUPPORTED) 804 805 #define KCF_PROV_SIGN_FINAL(pd, ctx, sig, req) ( \ 806 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_final) ? \ 807 KCF_PROV_SIGN_OPS(pd)->sign_final(ctx, sig, req) : \ 808 CRYPTO_NOT_SUPPORTED) 809 810 #define KCF_PROV_SIGN_ATOMIC(pd, session, mech, key, data, template, \ 811 sig, req) ( \ 812 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_atomic) ? \ 813 KCF_PROV_SIGN_OPS(pd)->sign_atomic( \ 814 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 815 req) : CRYPTO_NOT_SUPPORTED) 816 817 #define KCF_PROV_SIGN_RECOVER_INIT(pd, ctx, mech, key, template, \ 818 req) ( \ 819 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover_init) ? \ 820 KCF_PROV_SIGN_OPS(pd)->sign_recover_init(ctx, mech, key, template, \ 821 req) : CRYPTO_NOT_SUPPORTED) 822 823 #define KCF_PROV_SIGN_RECOVER(pd, ctx, data, sig, req) ( \ 824 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover) ? \ 825 KCF_PROV_SIGN_OPS(pd)->sign_recover(ctx, data, sig, req) : \ 826 CRYPTO_NOT_SUPPORTED) 827 828 #define KCF_PROV_SIGN_RECOVER_ATOMIC(pd, session, mech, key, data, template, \ 829 sig, req) ( \ 830 (KCF_PROV_SIGN_OPS(pd) && \ 831 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic) ? \ 832 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic( \ 833 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 834 req) : CRYPTO_NOT_SUPPORTED) 835 836 /* 837 * Wrappers for crypto_verify_ops(9S) entry points. 838 */ 839 840 #define KCF_PROV_VERIFY_INIT(pd, ctx, mech, key, template, req) ( \ 841 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_init) ? \ 842 KCF_PROV_VERIFY_OPS(pd)->verify_init(ctx, mech, key, template, \ 843 req) : CRYPTO_NOT_SUPPORTED) 844 845 #define KCF_PROV_VERIFY(pd, ctx, data, sig, req) ( \ 846 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify) ? \ 847 KCF_PROV_VERIFY_OPS(pd)->verify(ctx, data, sig, req) : \ 848 CRYPTO_NOT_SUPPORTED) 849 850 #define KCF_PROV_VERIFY_UPDATE(pd, ctx, data, req) ( \ 851 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_update) ? \ 852 KCF_PROV_VERIFY_OPS(pd)->verify_update(ctx, data, req) : \ 853 CRYPTO_NOT_SUPPORTED) 854 855 #define KCF_PROV_VERIFY_FINAL(pd, ctx, sig, req) ( \ 856 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_final) ? \ 857 KCF_PROV_VERIFY_OPS(pd)->verify_final(ctx, sig, req) : \ 858 CRYPTO_NOT_SUPPORTED) 859 860 #define KCF_PROV_VERIFY_ATOMIC(pd, session, mech, key, data, template, sig, \ 861 req) ( \ 862 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_atomic) ? \ 863 KCF_PROV_VERIFY_OPS(pd)->verify_atomic( \ 864 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 865 req) : CRYPTO_NOT_SUPPORTED) 866 867 #define KCF_PROV_VERIFY_RECOVER_INIT(pd, ctx, mech, key, template, \ 868 req) ( \ 869 (KCF_PROV_VERIFY_OPS(pd) && \ 870 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init) ? \ 871 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init(ctx, mech, key, \ 872 template, req) : CRYPTO_NOT_SUPPORTED) 873 874 /* verify_recover() CSPI routine has different argument order than verify() */ 875 #define KCF_PROV_VERIFY_RECOVER(pd, ctx, sig, data, req) ( \ 876 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_recover) ? \ 877 KCF_PROV_VERIFY_OPS(pd)->verify_recover(ctx, sig, data, req) : \ 878 CRYPTO_NOT_SUPPORTED) 879 880 /* 881 * verify_recover_atomic() CSPI routine has different argument order 882 * than verify_atomic(). 883 */ 884 #define KCF_PROV_VERIFY_RECOVER_ATOMIC(pd, session, mech, key, sig, \ 885 template, data, req) ( \ 886 (KCF_PROV_VERIFY_OPS(pd) && \ 887 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic) ? \ 888 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic( \ 889 (pd)->pd_prov_handle, session, mech, key, sig, data, template, \ 890 req) : CRYPTO_NOT_SUPPORTED) 891 892 /* 893 * Wrappers for crypto_dual_ops(9S) entry points. 894 */ 895 896 #define KCF_PROV_DIGEST_ENCRYPT_UPDATE(digest_ctx, encrypt_ctx, plaintext, \ 897 ciphertext, req) ( \ 898 (KCF_PROV_DUAL_OPS(pd) && \ 899 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update) ? \ 900 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update( \ 901 digest_ctx, encrypt_ctx, plaintext, ciphertext, req) : \ 902 CRYPTO_NOT_SUPPORTED) 903 904 #define KCF_PROV_DECRYPT_DIGEST_UPDATE(decrypt_ctx, digest_ctx, ciphertext, \ 905 plaintext, req) ( \ 906 (KCF_PROV_DUAL_OPS(pd) && \ 907 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update) ? \ 908 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update( \ 909 decrypt_ctx, digest_ctx, ciphertext, plaintext, req) : \ 910 CRYPTO_NOT_SUPPORTED) 911 912 #define KCF_PROV_SIGN_ENCRYPT_UPDATE(sign_ctx, encrypt_ctx, plaintext, \ 913 ciphertext, req) ( \ 914 (KCF_PROV_DUAL_OPS(pd) && \ 915 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update) ? \ 916 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update( \ 917 sign_ctx, encrypt_ctx, plaintext, ciphertext, req) : \ 918 CRYPTO_NOT_SUPPORTED) 919 920 #define KCF_PROV_DECRYPT_VERIFY_UPDATE(decrypt_ctx, verify_ctx, ciphertext, \ 921 plaintext, req) ( \ 922 (KCF_PROV_DUAL_OPS(pd) && \ 923 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update) ? \ 924 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update( \ 925 decrypt_ctx, verify_ctx, ciphertext, plaintext, req) : \ 926 CRYPTO_NOT_SUPPORTED) 927 928 /* 929 * Wrappers for crypto_dual_cipher_mac_ops(9S) entry points. 930 */ 931 932 #define KCF_PROV_ENCRYPT_MAC_INIT(pd, ctx, encr_mech, encr_key, mac_mech, \ 933 mac_key, encr_ctx_template, mac_ctx_template, req) ( \ 934 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 935 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init) ? \ 936 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init( \ 937 ctx, encr_mech, encr_key, mac_mech, mac_key, encr_ctx_template, \ 938 mac_ctx_template, req) : \ 939 CRYPTO_NOT_SUPPORTED) 940 941 #define KCF_PROV_ENCRYPT_MAC(pd, ctx, plaintext, ciphertext, mac, req) ( \ 942 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 943 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac) ? \ 944 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac( \ 945 ctx, plaintext, ciphertext, mac, req) : \ 946 CRYPTO_NOT_SUPPORTED) 947 948 #define KCF_PROV_ENCRYPT_MAC_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \ 949 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 950 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update) ? \ 951 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update( \ 952 ctx, plaintext, ciphertext, req) : \ 953 CRYPTO_NOT_SUPPORTED) 954 955 #define KCF_PROV_ENCRYPT_MAC_FINAL(pd, ctx, ciphertext, mac, req) ( \ 956 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 957 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final) ? \ 958 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final( \ 959 ctx, ciphertext, mac, req) : \ 960 CRYPTO_NOT_SUPPORTED) 961 962 #define KCF_PROV_ENCRYPT_MAC_ATOMIC(pd, session, encr_mech, encr_key, \ 963 mac_mech, mac_key, plaintext, ciphertext, mac, \ 964 encr_ctx_template, mac_ctx_template, req) ( \ 965 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 966 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic) ? \ 967 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic( \ 968 (pd)->pd_prov_handle, session, encr_mech, encr_key, \ 969 mac_mech, mac_key, plaintext, ciphertext, mac, \ 970 encr_ctx_template, mac_ctx_template, req) : \ 971 CRYPTO_NOT_SUPPORTED) 972 973 #define KCF_PROV_MAC_DECRYPT_INIT(pd, ctx, mac_mech, mac_key, decr_mech, \ 974 decr_key, mac_ctx_template, decr_ctx_template, req) ( \ 975 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 976 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init) ? \ 977 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init( \ 978 ctx, mac_mech, mac_key, decr_mech, decr_key, mac_ctx_template, \ 979 decr_ctx_template, req) : \ 980 CRYPTO_NOT_SUPPORTED) 981 982 #define KCF_PROV_MAC_DECRYPT(pd, ctx, ciphertext, mac, plaintext, req) ( \ 983 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 984 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt) ? \ 985 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt( \ 986 ctx, ciphertext, mac, plaintext, req) : \ 987 CRYPTO_NOT_SUPPORTED) 988 989 #define KCF_PROV_MAC_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \ 990 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 991 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update) ? \ 992 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update( \ 993 ctx, ciphertext, plaintext, req) : \ 994 CRYPTO_NOT_SUPPORTED) 995 996 #define KCF_PROV_MAC_DECRYPT_FINAL(pd, ctx, mac, plaintext, req) ( \ 997 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 998 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final) ? \ 999 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final( \ 1000 ctx, mac, plaintext, req) : \ 1001 CRYPTO_NOT_SUPPORTED) 1002 1003 #define KCF_PROV_MAC_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \ 1004 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1005 mac_ctx_template, decr_ctx_template, req) ( \ 1006 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 1007 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic) ? \ 1008 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic( \ 1009 (pd)->pd_prov_handle, session, mac_mech, mac_key, \ 1010 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1011 mac_ctx_template, decr_ctx_template, req) : \ 1012 CRYPTO_NOT_SUPPORTED) 1013 1014 #define KCF_PROV_MAC_VERIFY_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \ 1015 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1016 mac_ctx_template, decr_ctx_template, req) ( \ 1017 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 1018 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic \ 1019 != NULL) ? \ 1020 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic( \ 1021 (pd)->pd_prov_handle, session, mac_mech, mac_key, \ 1022 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1023 mac_ctx_template, decr_ctx_template, req) : \ 1024 CRYPTO_NOT_SUPPORTED) 1025 1026 /* 1027 * Wrappers for crypto_random_number_ops(9S) entry points. 1028 */ 1029 1030 #define KCF_PROV_SEED_RANDOM(pd, session, buf, len, est, flags, req) ( \ 1031 (KCF_PROV_RANDOM_OPS(pd) && KCF_PROV_RANDOM_OPS(pd)->seed_random) ? \ 1032 KCF_PROV_RANDOM_OPS(pd)->seed_random((pd)->pd_prov_handle, \ 1033 session, buf, len, est, flags, req) : CRYPTO_NOT_SUPPORTED) 1034 1035 #define KCF_PROV_GENERATE_RANDOM(pd, session, buf, len, req) ( \ 1036 (KCF_PROV_RANDOM_OPS(pd) && \ 1037 KCF_PROV_RANDOM_OPS(pd)->generate_random) ? \ 1038 KCF_PROV_RANDOM_OPS(pd)->generate_random((pd)->pd_prov_handle, \ 1039 session, buf, len, req) : CRYPTO_NOT_SUPPORTED) 1040 1041 /* 1042 * Wrappers for crypto_session_ops(9S) entry points. 1043 * 1044 * ops_pd is the provider descriptor that supplies the ops_vector. 1045 * pd is the descriptor that supplies the provider handle. 1046 * Only session open/close needs two handles. 1047 */ 1048 1049 #define KCF_PROV_SESSION_OPEN(ops_pd, session, req, pd) ( \ 1050 (KCF_PROV_SESSION_OPS(ops_pd) && \ 1051 KCF_PROV_SESSION_OPS(ops_pd)->session_open) ? \ 1052 KCF_PROV_SESSION_OPS(ops_pd)->session_open((pd)->pd_prov_handle, \ 1053 session, req) : CRYPTO_NOT_SUPPORTED) 1054 1055 #define KCF_PROV_SESSION_CLOSE(ops_pd, session, req, pd) ( \ 1056 (KCF_PROV_SESSION_OPS(ops_pd) && \ 1057 KCF_PROV_SESSION_OPS(ops_pd)->session_close) ? \ 1058 KCF_PROV_SESSION_OPS(ops_pd)->session_close((pd)->pd_prov_handle, \ 1059 session, req) : CRYPTO_NOT_SUPPORTED) 1060 1061 #define KCF_PROV_SESSION_LOGIN(pd, session, user_type, pin, len, req) ( \ 1062 (KCF_PROV_SESSION_OPS(pd) && \ 1063 KCF_PROV_SESSION_OPS(pd)->session_login) ? \ 1064 KCF_PROV_SESSION_OPS(pd)->session_login((pd)->pd_prov_handle, \ 1065 session, user_type, pin, len, req) : CRYPTO_NOT_SUPPORTED) 1066 1067 #define KCF_PROV_SESSION_LOGOUT(pd, session, req) ( \ 1068 (KCF_PROV_SESSION_OPS(pd) && \ 1069 KCF_PROV_SESSION_OPS(pd)->session_logout) ? \ 1070 KCF_PROV_SESSION_OPS(pd)->session_logout((pd)->pd_prov_handle, \ 1071 session, req) : CRYPTO_NOT_SUPPORTED) 1072 1073 /* 1074 * Wrappers for crypto_object_ops(9S) entry points. 1075 */ 1076 1077 #define KCF_PROV_OBJECT_CREATE(pd, session, template, count, object, req) ( \ 1078 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_create) ? \ 1079 KCF_PROV_OBJECT_OPS(pd)->object_create((pd)->pd_prov_handle, \ 1080 session, template, count, object, req) : CRYPTO_NOT_SUPPORTED) 1081 1082 #define KCF_PROV_OBJECT_COPY(pd, session, object, template, count, \ 1083 new_object, req) ( \ 1084 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_copy) ? \ 1085 KCF_PROV_OBJECT_OPS(pd)->object_copy((pd)->pd_prov_handle, \ 1086 session, object, template, count, new_object, req) : \ 1087 CRYPTO_NOT_SUPPORTED) 1088 1089 #define KCF_PROV_OBJECT_DESTROY(pd, session, object, req) ( \ 1090 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_destroy) ? \ 1091 KCF_PROV_OBJECT_OPS(pd)->object_destroy((pd)->pd_prov_handle, \ 1092 session, object, req) : CRYPTO_NOT_SUPPORTED) 1093 1094 #define KCF_PROV_OBJECT_GET_SIZE(pd, session, object, size, req) ( \ 1095 (KCF_PROV_OBJECT_OPS(pd) && \ 1096 KCF_PROV_OBJECT_OPS(pd)->object_get_size) ? \ 1097 KCF_PROV_OBJECT_OPS(pd)->object_get_size((pd)->pd_prov_handle, \ 1098 session, object, size, req) : CRYPTO_NOT_SUPPORTED) 1099 1100 #define KCF_PROV_OBJECT_GET_ATTRIBUTE_VALUE(pd, session, object, template, \ 1101 count, req) ( \ 1102 (KCF_PROV_OBJECT_OPS(pd) && \ 1103 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value) ? \ 1104 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value( \ 1105 (pd)->pd_prov_handle, session, object, template, count, req) : \ 1106 CRYPTO_NOT_SUPPORTED) 1107 1108 #define KCF_PROV_OBJECT_SET_ATTRIBUTE_VALUE(pd, session, object, template, \ 1109 count, req) ( \ 1110 (KCF_PROV_OBJECT_OPS(pd) && \ 1111 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value) ? \ 1112 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value( \ 1113 (pd)->pd_prov_handle, session, object, template, count, req) : \ 1114 CRYPTO_NOT_SUPPORTED) 1115 1116 #define KCF_PROV_OBJECT_FIND_INIT(pd, session, template, count, ppriv, \ 1117 req) ( \ 1118 (KCF_PROV_OBJECT_OPS(pd) && \ 1119 KCF_PROV_OBJECT_OPS(pd)->object_find_init) ? \ 1120 KCF_PROV_OBJECT_OPS(pd)->object_find_init((pd)->pd_prov_handle, \ 1121 session, template, count, ppriv, req) : CRYPTO_NOT_SUPPORTED) 1122 1123 #define KCF_PROV_OBJECT_FIND(pd, ppriv, objects, max_objects, object_count, \ 1124 req) ( \ 1125 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_find) ? \ 1126 KCF_PROV_OBJECT_OPS(pd)->object_find( \ 1127 (pd)->pd_prov_handle, ppriv, objects, max_objects, object_count, \ 1128 req) : CRYPTO_NOT_SUPPORTED) 1129 1130 #define KCF_PROV_OBJECT_FIND_FINAL(pd, ppriv, req) ( \ 1131 (KCF_PROV_OBJECT_OPS(pd) && \ 1132 KCF_PROV_OBJECT_OPS(pd)->object_find_final) ? \ 1133 KCF_PROV_OBJECT_OPS(pd)->object_find_final( \ 1134 (pd)->pd_prov_handle, ppriv, req) : CRYPTO_NOT_SUPPORTED) 1135 1136 /* 1137 * Wrappers for crypto_key_ops(9S) entry points. 1138 */ 1139 1140 #define KCF_PROV_KEY_GENERATE(pd, session, mech, template, count, object, \ 1141 req) ( \ 1142 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate) ? \ 1143 KCF_PROV_KEY_OPS(pd)->key_generate((pd)->pd_prov_handle, \ 1144 session, mech, template, count, object, req) : \ 1145 CRYPTO_NOT_SUPPORTED) 1146 1147 #define KCF_PROV_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \ 1148 pub_count, priv_template, priv_count, pub_key, priv_key, req) ( \ 1149 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate_pair) ? \ 1150 KCF_PROV_KEY_OPS(pd)->key_generate_pair((pd)->pd_prov_handle, \ 1151 session, mech, pub_template, pub_count, priv_template, \ 1152 priv_count, pub_key, priv_key, req) : \ 1153 CRYPTO_NOT_SUPPORTED) 1154 1155 #define KCF_PROV_KEY_WRAP(pd, session, mech, wrapping_key, key, wrapped_key, \ 1156 wrapped_key_len, req) ( \ 1157 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_wrap) ? \ 1158 KCF_PROV_KEY_OPS(pd)->key_wrap((pd)->pd_prov_handle, \ 1159 session, mech, wrapping_key, key, wrapped_key, wrapped_key_len, \ 1160 req) : \ 1161 CRYPTO_NOT_SUPPORTED) 1162 1163 #define KCF_PROV_KEY_UNWRAP(pd, session, mech, unwrapping_key, wrapped_key, \ 1164 wrapped_key_len, template, count, key, req) ( \ 1165 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_unwrap) ? \ 1166 KCF_PROV_KEY_OPS(pd)->key_unwrap((pd)->pd_prov_handle, \ 1167 session, mech, unwrapping_key, wrapped_key, wrapped_key_len, \ 1168 template, count, key, req) : \ 1169 CRYPTO_NOT_SUPPORTED) 1170 1171 #define KCF_PROV_KEY_DERIVE(pd, session, mech, base_key, template, count, \ 1172 key, req) ( \ 1173 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_derive) ? \ 1174 KCF_PROV_KEY_OPS(pd)->key_derive((pd)->pd_prov_handle, \ 1175 session, mech, base_key, template, count, key, req) : \ 1176 CRYPTO_NOT_SUPPORTED) 1177 1178 #define KCF_PROV_KEY_CHECK(pd, mech, key) ( \ 1179 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_check) ? \ 1180 KCF_PROV_KEY_OPS(pd)->key_check((pd)->pd_prov_handle, mech, key) : \ 1181 CRYPTO_NOT_SUPPORTED) 1182 1183 /* 1184 * Wrappers for crypto_provider_management_ops(9S) entry points. 1185 * 1186 * ops_pd is the provider descriptor that supplies the ops_vector. 1187 * pd is the descriptor that supplies the provider handle. 1188 * Only ext_info needs two handles. 1189 */ 1190 1191 #define KCF_PROV_EXT_INFO(ops_pd, provext_info, req, pd) ( \ 1192 (KCF_PROV_PROVIDER_OPS(ops_pd) && \ 1193 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info) ? \ 1194 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info((pd)->pd_prov_handle, \ 1195 provext_info, req) : CRYPTO_NOT_SUPPORTED) 1196 1197 #define KCF_PROV_INIT_TOKEN(pd, pin, pin_len, label, req) ( \ 1198 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_token) ? \ 1199 KCF_PROV_PROVIDER_OPS(pd)->init_token((pd)->pd_prov_handle, \ 1200 pin, pin_len, label, req) : CRYPTO_NOT_SUPPORTED) 1201 1202 #define KCF_PROV_INIT_PIN(pd, session, pin, pin_len, req) ( \ 1203 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_pin) ? \ 1204 KCF_PROV_PROVIDER_OPS(pd)->init_pin((pd)->pd_prov_handle, \ 1205 session, pin, pin_len, req) : CRYPTO_NOT_SUPPORTED) 1206 1207 #define KCF_PROV_SET_PIN(pd, session, old_pin, old_len, new_pin, new_len, \ 1208 req) ( \ 1209 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->set_pin) ? \ 1210 KCF_PROV_PROVIDER_OPS(pd)->set_pin((pd)->pd_prov_handle, \ 1211 session, old_pin, old_len, new_pin, new_len, req) : \ 1212 CRYPTO_NOT_SUPPORTED) 1213 1214 /* 1215 * Wrappers for crypto_nostore_key_ops(9S) entry points. 1216 */ 1217 1218 #define KCF_PROV_NOSTORE_KEY_GENERATE(pd, session, mech, template, count, \ 1219 out_template, out_count, req) ( \ 1220 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1221 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate) ? \ 1222 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate( \ 1223 (pd)->pd_prov_handle, session, mech, template, count, \ 1224 out_template, out_count, req) : CRYPTO_NOT_SUPPORTED) 1225 1226 #define KCF_PROV_NOSTORE_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \ 1227 pub_count, priv_template, priv_count, out_pub_template, \ 1228 out_pub_count, out_priv_template, out_priv_count, req) ( \ 1229 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1230 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair) ? \ 1231 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair( \ 1232 (pd)->pd_prov_handle, session, mech, pub_template, pub_count, \ 1233 priv_template, priv_count, out_pub_template, out_pub_count, \ 1234 out_priv_template, out_priv_count, req) : CRYPTO_NOT_SUPPORTED) 1235 1236 #define KCF_PROV_NOSTORE_KEY_DERIVE(pd, session, mech, base_key, template, \ 1237 count, out_template, out_count, req) ( \ 1238 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1239 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive) ? \ 1240 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive( \ 1241 (pd)->pd_prov_handle, session, mech, base_key, template, count, \ 1242 out_template, out_count, req) : CRYPTO_NOT_SUPPORTED) 1243 1244 /* 1245 * The following routines are exported by the kcf module (/kernel/misc/kcf) 1246 * to the crypto and cryptoadmin modules. 1247 */ 1248 1249 /* Digest/mac/cipher entry points that take a provider descriptor and session */ 1250 extern int crypto_digest_single(crypto_context_t, crypto_data_t *, 1251 crypto_data_t *, crypto_call_req_t *); 1252 1253 extern int crypto_mac_single(crypto_context_t, crypto_data_t *, 1254 crypto_data_t *, crypto_call_req_t *); 1255 1256 extern int crypto_encrypt_single(crypto_context_t, crypto_data_t *, 1257 crypto_data_t *, crypto_call_req_t *); 1258 1259 extern int crypto_decrypt_single(crypto_context_t, crypto_data_t *, 1260 crypto_data_t *, crypto_call_req_t *); 1261 1262 1263 /* Other private digest/mac/cipher entry points not exported through k-API */ 1264 extern int crypto_digest_key_prov(crypto_context_t, crypto_key_t *, 1265 crypto_call_req_t *); 1266 1267 /* Private sign entry points exported by KCF */ 1268 extern int crypto_sign_single(crypto_context_t, crypto_data_t *, 1269 crypto_data_t *, crypto_call_req_t *); 1270 1271 extern int crypto_sign_recover_single(crypto_context_t, crypto_data_t *, 1272 crypto_data_t *, crypto_call_req_t *); 1273 1274 /* Private verify entry points exported by KCF */ 1275 extern int crypto_verify_single(crypto_context_t, crypto_data_t *, 1276 crypto_data_t *, crypto_call_req_t *); 1277 1278 extern int crypto_verify_recover_single(crypto_context_t, crypto_data_t *, 1279 crypto_data_t *, crypto_call_req_t *); 1280 1281 /* Private dual operations entry points exported by KCF */ 1282 extern int crypto_digest_encrypt_update(crypto_context_t, crypto_context_t, 1283 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1284 extern int crypto_decrypt_digest_update(crypto_context_t, crypto_context_t, 1285 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1286 extern int crypto_sign_encrypt_update(crypto_context_t, crypto_context_t, 1287 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1288 extern int crypto_decrypt_verify_update(crypto_context_t, crypto_context_t, 1289 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1290 1291 /* Random Number Generation */ 1292 int crypto_seed_random(crypto_provider_handle_t provider, uchar_t *buf, 1293 size_t len, crypto_call_req_t *req); 1294 int crypto_generate_random(crypto_provider_handle_t provider, uchar_t *buf, 1295 size_t len, crypto_call_req_t *req); 1296 1297 /* Provider Management */ 1298 int crypto_get_provider_info(crypto_provider_id_t id, 1299 crypto_provider_info_t **info, crypto_call_req_t *req); 1300 int crypto_get_provider_mechanisms(crypto_minor_t *, crypto_provider_id_t id, 1301 uint_t *count, crypto_mech_name_t **list); 1302 int crypto_init_token(crypto_provider_handle_t provider, char *pin, 1303 size_t pin_len, char *label, crypto_call_req_t *); 1304 int crypto_init_pin(crypto_provider_handle_t provider, char *pin, 1305 size_t pin_len, crypto_call_req_t *req); 1306 int crypto_set_pin(crypto_provider_handle_t provider, char *old_pin, 1307 size_t old_len, char *new_pin, size_t new_len, crypto_call_req_t *req); 1308 void crypto_free_provider_list(crypto_provider_entry_t *list, uint_t count); 1309 void crypto_free_provider_info(crypto_provider_info_t *info); 1310 1311 /* Administrative */ 1312 int crypto_get_dev_list(uint_t *count, crypto_dev_list_entry_t **list); 1313 int crypto_get_soft_list(uint_t *count, char **list, size_t *len); 1314 int crypto_get_dev_info(char *name, uint_t instance, uint_t *count, 1315 crypto_mech_name_t **list); 1316 int crypto_get_soft_info(caddr_t name, uint_t *count, 1317 crypto_mech_name_t **list); 1318 int crypto_load_dev_disabled(char *name, uint_t instance, uint_t count, 1319 crypto_mech_name_t *list); 1320 int crypto_load_soft_disabled(caddr_t name, uint_t count, 1321 crypto_mech_name_t *list); 1322 int crypto_unload_soft_module(caddr_t path); 1323 int crypto_load_soft_config(caddr_t name, uint_t count, 1324 crypto_mech_name_t *list); 1325 int crypto_load_door(uint_t did); 1326 void crypto_free_mech_list(crypto_mech_name_t *list, uint_t count); 1327 void crypto_free_dev_list(crypto_dev_list_entry_t *list, uint_t count); 1328 extern void kcf_activate(); 1329 1330 /* Miscellaneous */ 1331 int crypto_get_mechanism_number(caddr_t name, crypto_mech_type_t *number); 1332 int crypto_get_function_list(crypto_provider_id_t id, 1333 crypto_function_list_t **list, int kmflag); 1334 void crypto_free_function_list(crypto_function_list_t *list); 1335 int crypto_build_permitted_mech_names(kcf_provider_desc_t *, 1336 crypto_mech_name_t **, uint_t *, int); 1337 extern void kcf_init_mech_tabs(void); 1338 extern int kcf_add_mech_provider(short, kcf_provider_desc_t *, 1339 kcf_prov_mech_desc_t **); 1340 extern void kcf_remove_mech_provider(char *, kcf_provider_desc_t *); 1341 extern int kcf_get_mech_entry(crypto_mech_type_t, kcf_mech_entry_t **); 1342 extern kcf_provider_desc_t *kcf_alloc_provider_desc(crypto_provider_info_t *); 1343 extern void kcf_free_provider_desc(kcf_provider_desc_t *); 1344 extern void kcf_soft_config_init(void); 1345 extern int get_sw_provider_for_mech(crypto_mech_name_t, char **); 1346 extern crypto_mech_type_t crypto_mech2id_common(char *, boolean_t); 1347 extern void undo_register_provider(kcf_provider_desc_t *, boolean_t); 1348 extern void redo_register_provider(kcf_provider_desc_t *); 1349 extern void kcf_rnd_init(); 1350 extern boolean_t kcf_rngprov_check(void); 1351 extern int kcf_rnd_get_pseudo_bytes(uint8_t *, size_t); 1352 extern int kcf_rnd_get_bytes(uint8_t *, size_t, boolean_t); 1353 extern int random_add_pseudo_entropy(uint8_t *, size_t, uint_t); 1354 extern void kcf_rnd_chpoll(short, int, short *, struct pollhead **); 1355 extern int crypto_uio_data(crypto_data_t *, uchar_t *, int, cmd_type_t, 1356 void *, void (*update)()); 1357 extern int crypto_mblk_data(crypto_data_t *, uchar_t *, int, cmd_type_t, 1358 void *, void (*update)()); 1359 extern int crypto_put_output_data(uchar_t *, crypto_data_t *, int); 1360 extern int crypto_get_input_data(crypto_data_t *, uchar_t **, uchar_t *); 1361 extern int crypto_copy_key_to_ctx(crypto_key_t *, crypto_key_t **, size_t *, 1362 int kmflag); 1363 extern int crypto_digest_data(crypto_data_t *, void *, uchar_t *, 1364 void (*update)(), void (*final)(), uchar_t); 1365 extern int crypto_update_iov(void *, crypto_data_t *, crypto_data_t *, 1366 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1367 void (*copy_block)(uint8_t *, uint64_t *)); 1368 extern int crypto_update_uio(void *, crypto_data_t *, crypto_data_t *, 1369 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1370 void (*copy_block)(uint8_t *, uint64_t *)); 1371 extern int crypto_update_mp(void *, crypto_data_t *, crypto_data_t *, 1372 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1373 void (*copy_block)(uint8_t *, uint64_t *)); 1374 extern int crypto_get_key_attr(crypto_key_t *, crypto_attr_type_t, uchar_t **, 1375 ssize_t *); 1376 1377 /* param copyin helpers used in kcf_mech_tabs */ 1378 int kcf_copyin_aes_ccm_param(caddr_t, size_t, crypto_mechanism_t *, int, int); 1379 int kcf_copyin_aes_gcm_param(caddr_t, size_t, crypto_mechanism_t *, int, int); 1380 int kcf_copyin_aes_gmac_param(caddr_t, size_t, crypto_mechanism_t *, int, int); 1381 int kcf_copyin_ecdh1_param(caddr_t, size_t, crypto_mechanism_t *, int, int); 1382 1383 /* Access to the provider's table */ 1384 extern void kcf_prov_tab_init(void); 1385 extern int kcf_prov_tab_add_provider(kcf_provider_desc_t *); 1386 extern int kcf_prov_tab_rem_provider(crypto_provider_id_t); 1387 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_name(char *); 1388 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_dev(char *, uint_t); 1389 extern int kcf_get_hw_prov_tab(uint_t *, kcf_provider_desc_t ***, int, 1390 char *, uint_t, boolean_t); 1391 extern int kcf_get_slot_list(uint_t *, kcf_provider_desc_t ***, boolean_t); 1392 extern void kcf_free_provider_tab(uint_t, kcf_provider_desc_t **); 1393 extern kcf_provider_desc_t *kcf_prov_tab_lookup(crypto_provider_id_t); 1394 extern int kcf_get_sw_prov(crypto_mech_type_t, kcf_provider_desc_t **, 1395 kcf_mech_entry_t **, boolean_t); 1396 1397 extern kmutex_t prov_tab_mutex; 1398 extern boolean_t kcf_need_provtab_walk; 1399 extern int kcf_get_refcnt(kcf_provider_desc_t *, boolean_t); 1400 1401 /* Access to the policy table */ 1402 extern boolean_t is_mech_disabled(kcf_provider_desc_t *, crypto_mech_name_t); 1403 extern boolean_t is_mech_disabled_byname(crypto_provider_type_t, char *, 1404 uint_t, crypto_mech_name_t); 1405 extern void kcf_policy_tab_init(void); 1406 extern void kcf_policy_free_desc(kcf_policy_desc_t *); 1407 extern void kcf_policy_remove_by_name(char *, uint_t *, crypto_mech_name_t **); 1408 extern void kcf_policy_remove_by_dev(char *, uint_t, uint_t *, 1409 crypto_mech_name_t **); 1410 extern kcf_policy_desc_t *kcf_policy_lookup_by_name(char *); 1411 extern kcf_policy_desc_t *kcf_policy_lookup_by_dev(char *, uint_t); 1412 extern int kcf_policy_load_soft_disabled(char *, uint_t, crypto_mech_name_t *, 1413 uint_t *, crypto_mech_name_t **); 1414 extern int kcf_policy_load_dev_disabled(char *, uint_t, uint_t, 1415 crypto_mech_name_t *, uint_t *, crypto_mech_name_t **); 1416 extern void remove_soft_config(char *); 1417 1418 #endif /* _KERNEL */ 1419 1420 #ifdef __cplusplus 1421 } 1422 #endif 1423 1424 #endif /* _SYS_CRYPTO_IMPL_H */ 1425