1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #ifndef _SYS_CRYPTO_IMPL_H 28 #define _SYS_CRYPTO_IMPL_H 29 30 #pragma ident "%Z%%M% %I% %E% SMI" 31 32 /* 33 * Kernel Cryptographic Framework private implementation definitions. 34 */ 35 36 #include <sys/types.h> 37 #include <sys/param.h> 38 39 #ifdef _KERNEL 40 #include <sys/crypto/common.h> 41 #include <sys/crypto/api.h> 42 #include <sys/crypto/spi.h> 43 #include <sys/crypto/ioctl.h> 44 #include <sys/tnf_probe.h> 45 #include <sys/atomic.h> 46 #include <sys/project.h> 47 #include <sys/taskq.h> 48 #include <sys/rctl.h> 49 #endif /* _KERNEL */ 50 51 #ifdef __cplusplus 52 extern "C" { 53 #endif 54 55 #ifdef _KERNEL 56 57 #define KCF_MODULE "kcf" 58 59 /* 60 * Prefixes convention: structures internal to the kernel cryptographic 61 * framework start with 'kcf_'. Exposed structure start with 'crypto_'. 62 */ 63 64 /* Provider stats. Not protected. */ 65 typedef struct kcf_prov_stats { 66 kstat_named_t ps_ops_total; 67 kstat_named_t ps_ops_passed; 68 kstat_named_t ps_ops_failed; 69 kstat_named_t ps_ops_busy_rval; 70 } kcf_prov_stats_t; 71 72 /* Various kcf stats. Not protected. */ 73 typedef struct kcf_stats { 74 kstat_named_t ks_thrs_in_pool; 75 kstat_named_t ks_idle_thrs; 76 kstat_named_t ks_minthrs; 77 kstat_named_t ks_maxthrs; 78 kstat_named_t ks_swq_njobs; 79 kstat_named_t ks_swq_maxjobs; 80 kstat_named_t ks_taskq_minalloc; 81 kstat_named_t ks_taskq_maxalloc; 82 } kcf_stats_t; 83 84 /* 85 * Keep all the information needed by the scheduler from 86 * this provider. 87 */ 88 typedef struct kcf_sched_info { 89 /* The number of operations dispatched. */ 90 uint64_t ks_ndispatches; 91 92 /* The number of operations that failed. */ 93 uint64_t ks_nfails; 94 95 /* The number of operations that returned CRYPTO_BUSY. */ 96 uint64_t ks_nbusy_rval; 97 98 /* taskq used to dispatch crypto requests */ 99 taskq_t *ks_taskq; 100 } kcf_sched_info_t; 101 102 #define KCF_PROV_INCRSTATS(pd, error) { \ 103 (pd)->pd_sched_info.ks_ndispatches++; \ 104 if (error == CRYPTO_BUSY) \ 105 (pd)->pd_sched_info.ks_nbusy_rval++; \ 106 else if (error != CRYPTO_SUCCESS && error != CRYPTO_QUEUED) \ 107 (pd)->pd_sched_info.ks_nfails++; \ 108 } 109 110 111 /* 112 * The following two macros should be 113 * #define KCF_OPS_CLASSSIZE (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2) 114 * #define KCF_MAXMECHTAB KCF_MAXCIPHER 115 * 116 * However, doing that would involve reorganizing the header file a bit. 117 * When impl.h is broken up (bug# 4703218), this will be done. For now, 118 * we hardcode these values. 119 */ 120 #define KCF_OPS_CLASSSIZE 8 121 #define KCF_MAXMECHTAB 32 122 123 /* 124 * Valid values for the state of a provider. The order of 125 * the elements is important. 126 * 127 * Routines which get a provider or the list of providers 128 * should pick only those that are either in KCF_PROV_READY state 129 * or in KCF_PROV_BUSY state. 130 */ 131 typedef enum { 132 KCF_PROV_ALLOCATED = 1, 133 KCF_PROV_UNVERIFIED, 134 /* 135 * state < KCF_PROV_READY means the provider can not 136 * be used at all. 137 */ 138 KCF_PROV_READY, 139 KCF_PROV_BUSY, 140 /* 141 * state > KCF_PROV_BUSY means the provider can not 142 * be used for new requests. 143 */ 144 KCF_PROV_FAILED, 145 /* 146 * Threads setting the following two states should do so only 147 * if the current state < KCF_PROV_DISABLED. 148 */ 149 KCF_PROV_DISABLED, 150 KCF_PROV_REMOVED, 151 KCF_PROV_FREED 152 } kcf_prov_state_t; 153 154 #define KCF_IS_PROV_UNVERIFIED(pd) ((pd)->pd_state == KCF_PROV_UNVERIFIED) 155 #define KCF_IS_PROV_USABLE(pd) ((pd)->pd_state == KCF_PROV_READY || \ 156 (pd)->pd_state == KCF_PROV_BUSY) 157 #define KCF_IS_PROV_REMOVED(pd) ((pd)->pd_state >= KCF_PROV_REMOVED) 158 159 /* 160 * A provider descriptor structure. There is one such structure per 161 * provider. It is allocated and initialized at registration time and 162 * freed when the provider unregisters. 163 * 164 * pd_prov_type: Provider type, hardware or software 165 * pd_prov_handle: Provider handle specified by provider 166 * pd_kcf_prov_handle: KCF-private handle assigned by KCF 167 * pd_prov_id: Identification # assigned by KCF to provider 168 * pd_description: Provider description string 169 * pd_ops_vector: The ops vector specified by Provider 170 * pd_mech_list_count: The number of entries in pi_mechanisms, specified 171 * by the provider during registration 172 * pd_mechanisms: Mechanisms supported by the provider, specified 173 * by the provider during registration 174 * pd_map_mechnums: Lookup table which maps a core framework mechanism 175 * number to a number understood by this provider 176 * pd_ks_data: kstat data 177 * pd_kstat: kstat associated with the provider 178 * pd_sched_info: Scheduling information associated with the provider 179 * pd_refcnt: Reference counter to this provider descriptor 180 * pd_irefcnt: References held by the framework internal structs 181 * pd_name: Device name or module name 182 * pd_instance: Device instance 183 * pd_module_id: Module ID returned by modload 184 * pd_mctlp: Pointer to modctl structure for this provider 185 * pd_sid: Session ID of the provider used by kernel clients. 186 * This is valid only for session-oriented providers. 187 * pd_lock: lock protects pd_state and pd_real_provider_list 188 * pd_state: State value of the provider 189 * pd_resume_cv: cv to wait for state to change from KCF_PROV_BUSY 190 * pd_remove_cv: cv to wait on while the provider queue drains 191 * pd_restricted: true if this is an export restricted provider 192 * pd_provider_list: Used to cross-reference logical providers and their 193 * members. Not used for software providers. 194 */ 195 typedef struct kcf_provider_desc { 196 crypto_provider_type_t pd_prov_type; 197 crypto_provider_handle_t pd_prov_handle; 198 crypto_kcf_provider_handle_t pd_kcf_prov_handle; 199 crypto_provider_id_t pd_prov_id; 200 char *pd_description; 201 crypto_ops_t *pd_ops_vector; 202 uint_t pd_mech_list_count; 203 crypto_mech_info_t *pd_mechanisms; 204 crypto_mech_type_t pd_map_mechnums[KCF_OPS_CLASSSIZE]\ 205 [KCF_MAXMECHTAB]; 206 kcf_stats_t *pd_stats; 207 kcf_prov_stats_t pd_ks_data; 208 kstat_t *pd_kstat; 209 kcf_sched_info_t pd_sched_info; 210 uint_t pd_refcnt; 211 uint_t pd_irefcnt; 212 char *pd_name; 213 uint_t pd_instance; 214 int pd_module_id; 215 struct modctl *pd_mctlp; 216 crypto_session_id_t pd_sid; 217 kmutex_t pd_lock; 218 kcf_prov_state_t pd_state; 219 kcondvar_t pd_resume_cv; 220 kcondvar_t pd_remove_cv; 221 boolean_t pd_restricted; 222 struct kcf_provider_list *pd_provider_list; 223 } kcf_provider_desc_t; 224 225 /* useful for making a list of providers */ 226 typedef struct kcf_provider_list { 227 struct kcf_provider_list *pl_next; 228 struct kcf_provider_desc *pl_provider; 229 } kcf_provider_list_t; 230 231 /* 232 * If a component has a reference to a kcf_provider_desc_t, 233 * it REFHOLD()s. A new provider descriptor which is referenced only 234 * by the providers table has a reference counter of one. 235 */ 236 #define KCF_PROV_REFHOLD(desc) { \ 237 atomic_add_32(&(desc)->pd_refcnt, 1); \ 238 ASSERT((desc)->pd_refcnt != 0); \ 239 } 240 241 #define KCF_PROV_IREFHOLD(desc) { \ 242 atomic_add_32(&(desc)->pd_irefcnt, 1); \ 243 ASSERT((desc)->pd_irefcnt != 0); \ 244 } 245 246 #define KCF_PROV_IREFRELE(desc) { \ 247 ASSERT((desc)->pd_irefcnt != 0); \ 248 membar_exit(); \ 249 if (atomic_add_32_nv(&(desc)->pd_irefcnt, -1) == 0) { \ 250 cv_broadcast(&(desc)->pd_remove_cv); \ 251 } \ 252 } 253 254 #define KCF_PROV_REFHELD(desc) ((desc)->pd_refcnt >= 1) 255 256 #define KCF_PROV_REFRELE(desc) { \ 257 ASSERT((desc)->pd_refcnt != 0); \ 258 membar_exit(); \ 259 if (atomic_add_32_nv(&(desc)->pd_refcnt, -1) == 0) { \ 260 kcf_provider_zero_refcnt((desc)); \ 261 } \ 262 } 263 264 265 /* list of crypto_mech_info_t valid as the second mech in a dual operation */ 266 267 typedef struct crypto_mech_info_list { 268 struct crypto_mech_info_list *ml_next; 269 crypto_mech_type_t ml_kcf_mechid; /* KCF's id */ 270 crypto_mech_info_t ml_mech_info; 271 } crypto_mech_info_list_t; 272 273 /* 274 * An element in a mechanism provider descriptors chain. 275 * The kcf_prov_mech_desc_t is duplicated in every chain the provider belongs 276 * to. This is a small tradeoff memory vs mutex spinning time to access the 277 * common provider field. 278 */ 279 280 typedef struct kcf_prov_mech_desc { 281 struct kcf_mech_entry *pm_me; /* Back to the head */ 282 struct kcf_prov_mech_desc *pm_next; /* Next in the chain */ 283 crypto_mech_info_t pm_mech_info; /* Provider mech info */ 284 crypto_mech_info_list_t *pm_mi_list; /* list for duals */ 285 kcf_provider_desc_t *pm_prov_desc; /* Common desc. */ 286 } kcf_prov_mech_desc_t; 287 288 /* and the notation shortcuts ... */ 289 #define pm_provider_type pm_prov_desc.pd_provider_type 290 #define pm_provider_handle pm_prov_desc.pd_provider_handle 291 #define pm_ops_vector pm_prov_desc.pd_ops_vector 292 293 294 #define KCF_CPU_PAD (128 - sizeof (crypto_mech_name_t) - \ 295 sizeof (kmutex_t) - 2 * sizeof (kcf_prov_mech_desc_t *) - \ 296 sizeof (int) - sizeof (uint32_t) - sizeof (size_t)) 297 298 /* 299 * A mechanism entry in an xxx_mech_tab[]. KCF_CPU_PAD needs 300 * to be adjusted if this structure is changed. 301 */ 302 typedef struct kcf_mech_entry { 303 crypto_mech_name_t me_name; /* mechanism name */ 304 kmutex_t me_mutex; /* access protection */ 305 kcf_prov_mech_desc_t *me_hw_prov_chain; /* list of HW providers */ 306 kcf_prov_mech_desc_t *me_sw_prov; /* SW provider */ 307 /* 308 * Number of HW providers in the chain. There is only one 309 * SW provider. So, we need only a count of HW providers. 310 */ 311 int me_num_hwprov; 312 /* 313 * When a SW provider is present, this is the generation number that 314 * ensures no objects from old SW providers are used in the new one 315 */ 316 uint32_t me_gen_swprov; 317 /* 318 * threshold for using hardware providers for this mech 319 */ 320 size_t me_threshold; 321 uint8_t me_pad[KCF_CPU_PAD]; 322 } kcf_mech_entry_t; 323 324 /* 325 * A policy descriptor structure. It is allocated and initialized 326 * when administrative ioctls load disabled mechanisms. 327 * 328 * pd_prov_type: Provider type, hardware or software 329 * pd_name: Device name or module name. 330 * pd_instance: Device instance. 331 * pd_refcnt: Reference counter for this policy descriptor 332 * pd_mutex: Protects array and count of disabled mechanisms. 333 * pd_disabled_count: Count of disabled mechanisms. 334 * pd_disabled_mechs: Array of disabled mechanisms. 335 */ 336 typedef struct kcf_policy_desc { 337 crypto_provider_type_t pd_prov_type; 338 char *pd_name; 339 uint_t pd_instance; 340 uint_t pd_refcnt; 341 kmutex_t pd_mutex; 342 uint_t pd_disabled_count; 343 crypto_mech_name_t *pd_disabled_mechs; 344 } kcf_policy_desc_t; 345 346 /* 347 * If a component has a reference to a kcf_policy_desc_t, 348 * it REFHOLD()s. A new policy descriptor which is referenced only 349 * by the policy table has a reference count of one. 350 */ 351 #define KCF_POLICY_REFHOLD(desc) { \ 352 atomic_add_32(&(desc)->pd_refcnt, 1); \ 353 ASSERT((desc)->pd_refcnt != 0); \ 354 } 355 356 /* 357 * Releases a reference to a policy descriptor. When the last 358 * reference is released, the descriptor is freed. 359 */ 360 #define KCF_POLICY_REFRELE(desc) { \ 361 ASSERT((desc)->pd_refcnt != 0); \ 362 membar_exit(); \ 363 if (atomic_add_32_nv(&(desc)->pd_refcnt, -1) == 0) \ 364 kcf_policy_free_desc(desc); \ 365 } 366 367 /* 368 * This entry stores the name of a software module and its 369 * mechanisms. The mechanisms are 'hints' that are used to 370 * trigger loading of the module. 371 */ 372 typedef struct kcf_soft_conf_entry { 373 struct kcf_soft_conf_entry *ce_next; 374 char *ce_name; 375 crypto_mech_name_t *ce_mechs; 376 uint_t ce_count; 377 } kcf_soft_conf_entry_t; 378 379 extern kmutex_t soft_config_mutex; 380 extern kcf_soft_conf_entry_t *soft_config_list; 381 382 /* 383 * Global tables. The sizes are from the predefined PKCS#11 v2.20 mechanisms, 384 * with a margin of few extra empty entry points 385 */ 386 387 #define KCF_MAXDIGEST 16 /* Digests */ 388 #define KCF_MAXCIPHER 64 /* Ciphers */ 389 #define KCF_MAXMAC 40 /* Message authentication codes */ 390 #define KCF_MAXSIGN 24 /* Sign/Verify */ 391 #define KCF_MAXKEYOPS 116 /* Key generation and derivation */ 392 #define KCF_MAXMISC 16 /* Others ... */ 393 394 #define KCF_MAXMECHS KCF_MAXDIGEST + KCF_MAXCIPHER + KCF_MAXMAC + \ 395 KCF_MAXSIGN + KCF_MAXKEYOPS + \ 396 KCF_MAXMISC 397 398 extern kcf_mech_entry_t kcf_digest_mechs_tab[]; 399 extern kcf_mech_entry_t kcf_cipher_mechs_tab[]; 400 extern kcf_mech_entry_t kcf_mac_mechs_tab[]; 401 extern kcf_mech_entry_t kcf_sign_mechs_tab[]; 402 extern kcf_mech_entry_t kcf_keyops_mechs_tab[]; 403 extern kcf_mech_entry_t kcf_misc_mechs_tab[]; 404 405 extern kmutex_t kcf_mech_tabs_lock; 406 407 typedef enum { 408 KCF_DIGEST_CLASS = 1, 409 KCF_CIPHER_CLASS, 410 KCF_MAC_CLASS, 411 KCF_SIGN_CLASS, 412 KCF_KEYOPS_CLASS, 413 KCF_MISC_CLASS 414 } kcf_ops_class_t; 415 416 #define KCF_FIRST_OPSCLASS KCF_DIGEST_CLASS 417 #define KCF_LAST_OPSCLASS KCF_MISC_CLASS 418 419 /* The table of all the kcf_xxx_mech_tab[]s, indexed by kcf_ops_class */ 420 421 typedef struct kcf_mech_entry_tab { 422 int met_size; /* Size of the met_tab[] */ 423 kcf_mech_entry_t *met_tab; /* the table */ 424 } kcf_mech_entry_tab_t; 425 426 extern kcf_mech_entry_tab_t kcf_mech_tabs_tab[]; 427 428 #define KCF_MECHID(class, index) \ 429 (((crypto_mech_type_t)(class) << 32) | (crypto_mech_type_t)(index)) 430 431 #define KCF_MECH2CLASS(mech_type) ((kcf_ops_class_t)((mech_type) >> 32)) 432 433 #define KCF_MECH2INDEX(mech_type) ((int)(mech_type)) 434 435 /* ps_refcnt is protected by cm_lock in the crypto_minor structure */ 436 typedef struct crypto_provider_session { 437 struct crypto_provider_session *ps_next; 438 crypto_session_id_t ps_session; 439 kcf_provider_desc_t *ps_provider; 440 kcf_provider_desc_t *ps_real_provider; 441 uint_t ps_refcnt; 442 } crypto_provider_session_t; 443 444 typedef struct crypto_session_data { 445 kmutex_t sd_lock; 446 kcondvar_t sd_cv; 447 uint32_t sd_flags; 448 crypto_ctx_t *sd_digest_ctx; 449 crypto_ctx_t *sd_encr_ctx; 450 crypto_ctx_t *sd_decr_ctx; 451 crypto_ctx_t *sd_sign_ctx; 452 crypto_ctx_t *sd_verify_ctx; 453 crypto_ctx_t *sd_sign_recover_ctx; 454 crypto_ctx_t *sd_verify_recover_ctx; 455 kcf_provider_desc_t *sd_provider; 456 void *sd_find_init_cookie; 457 crypto_provider_session_t *sd_provider_session; 458 } crypto_session_data_t; 459 460 #define CRYPTO_SESSION_IN_USE 0x00000001 461 #define CRYPTO_SESSION_IS_BUSY 0x00000002 462 #define CRYPTO_SESSION_IS_CLOSED 0x00000004 463 464 #define KCF_MAX_PIN_LEN 1024 465 466 /* 467 * Per-minor info. 468 * 469 * cm_lock protects everything in this structure except for cm_refcnt. 470 */ 471 typedef struct crypto_minor { 472 uint_t cm_refcnt; 473 kmutex_t cm_lock; 474 kcondvar_t cm_cv; 475 crypto_session_data_t **cm_session_table; 476 uint_t cm_session_table_count; 477 kcf_provider_desc_t **cm_provider_array; 478 uint_t cm_provider_count; 479 crypto_provider_session_t *cm_provider_session; 480 kproject_t *cm_projp; 481 } crypto_minor_t; 482 483 /* resource control framework handle used by /dev/crypto */ 484 extern rctl_hndl_t rc_project_crypto_mem; 485 /* 486 * Return codes for internal functions 487 */ 488 #define KCF_SUCCESS 0x0 /* Successful call */ 489 #define KCF_INVALID_MECH_NUMBER 0x1 /* invalid mechanism number */ 490 #define KCF_INVALID_MECH_NAME 0x2 /* invalid mechanism name */ 491 #define KCF_INVALID_MECH_CLASS 0x3 /* invalid mechanism class */ 492 #define KCF_MECH_TAB_FULL 0x4 /* Need more room in the mech tabs. */ 493 494 /* 495 * kCF internal mechanism and function group for tracking RNG providers. 496 */ 497 #define SUN_RANDOM "random" 498 #define CRYPTO_FG_RANDOM 0x80000000 /* generate_random() */ 499 500 /* 501 * Wrappers for ops vectors. In the wrapper definitions below, the pd 502 * argument always corresponds to a pointer to a provider descriptor 503 * of type kcf_prov_desc_t. 504 */ 505 506 #define KCF_PROV_CONTROL_OPS(pd) ((pd)->pd_ops_vector->control_ops) 507 #define KCF_PROV_CTX_OPS(pd) ((pd)->pd_ops_vector->ctx_ops) 508 #define KCF_PROV_DIGEST_OPS(pd) ((pd)->pd_ops_vector->digest_ops) 509 #define KCF_PROV_CIPHER_OPS(pd) ((pd)->pd_ops_vector->cipher_ops) 510 #define KCF_PROV_MAC_OPS(pd) ((pd)->pd_ops_vector->mac_ops) 511 #define KCF_PROV_SIGN_OPS(pd) ((pd)->pd_ops_vector->sign_ops) 512 #define KCF_PROV_VERIFY_OPS(pd) ((pd)->pd_ops_vector->verify_ops) 513 #define KCF_PROV_DUAL_OPS(pd) ((pd)->pd_ops_vector->dual_ops) 514 #define KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) \ 515 ((pd)->pd_ops_vector->dual_cipher_mac_ops) 516 #define KCF_PROV_RANDOM_OPS(pd) ((pd)->pd_ops_vector->random_ops) 517 #define KCF_PROV_SESSION_OPS(pd) ((pd)->pd_ops_vector->session_ops) 518 #define KCF_PROV_OBJECT_OPS(pd) ((pd)->pd_ops_vector->object_ops) 519 #define KCF_PROV_KEY_OPS(pd) ((pd)->pd_ops_vector->key_ops) 520 #define KCF_PROV_PROVIDER_OPS(pd) ((pd)->pd_ops_vector->provider_ops) 521 522 /* 523 * Wrappers for crypto_control_ops(9S) entry points. 524 */ 525 526 #define KCF_PROV_STATUS(pd, status) ( \ 527 (KCF_PROV_CONTROL_OPS(pd) && \ 528 KCF_PROV_CONTROL_OPS(pd)->provider_status) ? \ 529 KCF_PROV_CONTROL_OPS(pd)->provider_status( \ 530 (pd)->pd_prov_handle, status) : \ 531 CRYPTO_NOT_SUPPORTED) 532 533 /* 534 * Wrappers for crypto_ctx_ops(9S) entry points. 535 */ 536 537 #define KCF_PROV_CREATE_CTX_TEMPLATE(pd, mech, key, template, size, req) ( \ 538 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->create_ctx_template) ? \ 539 KCF_PROV_CTX_OPS(pd)->create_ctx_template( \ 540 (pd)->pd_prov_handle, mech, key, template, size, req) : \ 541 CRYPTO_NOT_SUPPORTED) 542 543 #define KCF_PROV_FREE_CONTEXT(pd, ctx) ( \ 544 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->free_context) ? \ 545 KCF_PROV_CTX_OPS(pd)->free_context(ctx) : CRYPTO_NOT_SUPPORTED) 546 547 /* 548 * Wrappers for crypto_digest_ops(9S) entry points. 549 */ 550 551 #define KCF_PROV_DIGEST_INIT(pd, ctx, mech, req) ( \ 552 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_init) ? \ 553 KCF_PROV_DIGEST_OPS(pd)->digest_init(ctx, mech, req) : \ 554 CRYPTO_NOT_SUPPORTED) 555 556 /* 557 * The _ (underscore) in _digest is needed to avoid replacing the 558 * function digest(). 559 */ 560 #define KCF_PROV_DIGEST(pd, ctx, data, _digest, req) ( \ 561 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest) ? \ 562 KCF_PROV_DIGEST_OPS(pd)->digest(ctx, data, _digest, req) : \ 563 CRYPTO_NOT_SUPPORTED) 564 565 #define KCF_PROV_DIGEST_UPDATE(pd, ctx, data, req) ( \ 566 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_update) ? \ 567 KCF_PROV_DIGEST_OPS(pd)->digest_update(ctx, data, req) : \ 568 CRYPTO_NOT_SUPPORTED) 569 570 #define KCF_PROV_DIGEST_KEY(pd, ctx, key, req) ( \ 571 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_key) ? \ 572 KCF_PROV_DIGEST_OPS(pd)->digest_key(ctx, key, req) : \ 573 CRYPTO_NOT_SUPPORTED) 574 575 #define KCF_PROV_DIGEST_FINAL(pd, ctx, digest, req) ( \ 576 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_final) ? \ 577 KCF_PROV_DIGEST_OPS(pd)->digest_final(ctx, digest, req) : \ 578 CRYPTO_NOT_SUPPORTED) 579 580 #define KCF_PROV_DIGEST_ATOMIC(pd, session, mech, data, digest, req) ( \ 581 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_atomic) ? \ 582 KCF_PROV_DIGEST_OPS(pd)->digest_atomic( \ 583 (pd)->pd_prov_handle, session, mech, data, digest, req) : \ 584 CRYPTO_NOT_SUPPORTED) 585 586 /* 587 * Wrappers for crypto_cipher_ops(9S) entry points. 588 */ 589 590 #define KCF_PROV_ENCRYPT_INIT(pd, ctx, mech, key, template, req) ( \ 591 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_init) ? \ 592 KCF_PROV_CIPHER_OPS(pd)->encrypt_init(ctx, mech, key, template, \ 593 req) : \ 594 CRYPTO_NOT_SUPPORTED) 595 596 #define KCF_PROV_ENCRYPT(pd, ctx, plaintext, ciphertext, req) ( \ 597 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt) ? \ 598 KCF_PROV_CIPHER_OPS(pd)->encrypt(ctx, plaintext, ciphertext, req) : \ 599 CRYPTO_NOT_SUPPORTED) 600 601 #define KCF_PROV_ENCRYPT_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \ 602 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_update) ? \ 603 KCF_PROV_CIPHER_OPS(pd)->encrypt_update(ctx, plaintext, \ 604 ciphertext, req) : \ 605 CRYPTO_NOT_SUPPORTED) 606 607 #define KCF_PROV_ENCRYPT_FINAL(pd, ctx, ciphertext, req) ( \ 608 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_final) ? \ 609 KCF_PROV_CIPHER_OPS(pd)->encrypt_final(ctx, ciphertext, req) : \ 610 CRYPTO_NOT_SUPPORTED) 611 612 #define KCF_PROV_ENCRYPT_ATOMIC(pd, session, mech, key, plaintext, ciphertext, \ 613 template, req) ( \ 614 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic) ? \ 615 KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic( \ 616 (pd)->pd_prov_handle, session, mech, key, plaintext, ciphertext, \ 617 template, req) : \ 618 CRYPTO_NOT_SUPPORTED) 619 620 #define KCF_PROV_DECRYPT_INIT(pd, ctx, mech, key, template, req) ( \ 621 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_init) ? \ 622 KCF_PROV_CIPHER_OPS(pd)->decrypt_init(ctx, mech, key, template, \ 623 req) : \ 624 CRYPTO_NOT_SUPPORTED) 625 626 #define KCF_PROV_DECRYPT(pd, ctx, ciphertext, plaintext, req) ( \ 627 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt) ? \ 628 KCF_PROV_CIPHER_OPS(pd)->decrypt(ctx, ciphertext, plaintext, req) : \ 629 CRYPTO_NOT_SUPPORTED) 630 631 #define KCF_PROV_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \ 632 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_update) ? \ 633 KCF_PROV_CIPHER_OPS(pd)->decrypt_update(ctx, ciphertext, \ 634 plaintext, req) : \ 635 CRYPTO_NOT_SUPPORTED) 636 637 #define KCF_PROV_DECRYPT_FINAL(pd, ctx, plaintext, req) ( \ 638 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_final) ? \ 639 KCF_PROV_CIPHER_OPS(pd)->decrypt_final(ctx, plaintext, req) : \ 640 CRYPTO_NOT_SUPPORTED) 641 642 #define KCF_PROV_DECRYPT_ATOMIC(pd, session, mech, key, ciphertext, plaintext, \ 643 template, req) ( \ 644 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic) ? \ 645 KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic( \ 646 (pd)->pd_prov_handle, session, mech, key, ciphertext, plaintext, \ 647 template, req) : \ 648 CRYPTO_NOT_SUPPORTED) 649 650 /* 651 * Wrappers for crypto_mac_ops(9S) entry points. 652 */ 653 654 #define KCF_PROV_MAC_INIT(pd, ctx, mech, key, template, req) ( \ 655 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_init) ? \ 656 KCF_PROV_MAC_OPS(pd)->mac_init(ctx, mech, key, template, req) \ 657 : CRYPTO_NOT_SUPPORTED) 658 659 /* 660 * The _ (underscore) in _mac is needed to avoid replacing the 661 * function mac(). 662 */ 663 #define KCF_PROV_MAC(pd, ctx, data, _mac, req) ( \ 664 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac) ? \ 665 KCF_PROV_MAC_OPS(pd)->mac(ctx, data, _mac, req) : \ 666 CRYPTO_NOT_SUPPORTED) 667 668 #define KCF_PROV_MAC_UPDATE(pd, ctx, data, req) ( \ 669 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_update) ? \ 670 KCF_PROV_MAC_OPS(pd)->mac_update(ctx, data, req) : \ 671 CRYPTO_NOT_SUPPORTED) 672 673 #define KCF_PROV_MAC_FINAL(pd, ctx, mac, req) ( \ 674 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_final) ? \ 675 KCF_PROV_MAC_OPS(pd)->mac_final(ctx, mac, req) : \ 676 CRYPTO_NOT_SUPPORTED) 677 678 #define KCF_PROV_MAC_ATOMIC(pd, session, mech, key, data, mac, template, \ 679 req) ( \ 680 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_atomic) ? \ 681 KCF_PROV_MAC_OPS(pd)->mac_atomic( \ 682 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \ 683 req) : \ 684 CRYPTO_NOT_SUPPORTED) 685 686 #define KCF_PROV_MAC_VERIFY_ATOMIC(pd, session, mech, key, data, mac, \ 687 template, req) ( \ 688 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_verify_atomic) ? \ 689 KCF_PROV_MAC_OPS(pd)->mac_verify_atomic( \ 690 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \ 691 req) : \ 692 CRYPTO_NOT_SUPPORTED) 693 694 /* 695 * Wrappers for crypto_sign_ops(9S) entry points. 696 */ 697 698 #define KCF_PROV_SIGN_INIT(pd, ctx, mech, key, template, req) ( \ 699 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_init) ? \ 700 KCF_PROV_SIGN_OPS(pd)->sign_init( \ 701 ctx, mech, key, template, req) : CRYPTO_NOT_SUPPORTED) 702 703 #define KCF_PROV_SIGN(pd, ctx, data, sig, req) ( \ 704 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign) ? \ 705 KCF_PROV_SIGN_OPS(pd)->sign(ctx, data, sig, req) : \ 706 CRYPTO_NOT_SUPPORTED) 707 708 #define KCF_PROV_SIGN_UPDATE(pd, ctx, data, req) ( \ 709 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_update) ? \ 710 KCF_PROV_SIGN_OPS(pd)->sign_update(ctx, data, req) : \ 711 CRYPTO_NOT_SUPPORTED) 712 713 #define KCF_PROV_SIGN_FINAL(pd, ctx, sig, req) ( \ 714 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_final) ? \ 715 KCF_PROV_SIGN_OPS(pd)->sign_final(ctx, sig, req) : \ 716 CRYPTO_NOT_SUPPORTED) 717 718 #define KCF_PROV_SIGN_ATOMIC(pd, session, mech, key, data, template, \ 719 sig, req) ( \ 720 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_atomic) ? \ 721 KCF_PROV_SIGN_OPS(pd)->sign_atomic( \ 722 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 723 req) : CRYPTO_NOT_SUPPORTED) 724 725 #define KCF_PROV_SIGN_RECOVER_INIT(pd, ctx, mech, key, template, \ 726 req) ( \ 727 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover_init) ? \ 728 KCF_PROV_SIGN_OPS(pd)->sign_recover_init(ctx, mech, key, template, \ 729 req) : CRYPTO_NOT_SUPPORTED) 730 731 #define KCF_PROV_SIGN_RECOVER(pd, ctx, data, sig, req) ( \ 732 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover) ? \ 733 KCF_PROV_SIGN_OPS(pd)->sign_recover(ctx, data, sig, req) : \ 734 CRYPTO_NOT_SUPPORTED) 735 736 #define KCF_PROV_SIGN_RECOVER_ATOMIC(pd, session, mech, key, data, template, \ 737 sig, req) ( \ 738 (KCF_PROV_SIGN_OPS(pd) && \ 739 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic) ? \ 740 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic( \ 741 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 742 req) : CRYPTO_NOT_SUPPORTED) 743 744 /* 745 * Wrappers for crypto_verify_ops(9S) entry points. 746 */ 747 748 #define KCF_PROV_VERIFY_INIT(pd, ctx, mech, key, template, req) ( \ 749 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_init) ? \ 750 KCF_PROV_VERIFY_OPS(pd)->verify_init(ctx, mech, key, template, \ 751 req) : CRYPTO_NOT_SUPPORTED) 752 753 #define KCF_PROV_VERIFY(pd, ctx, data, sig, req) ( \ 754 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify) ? \ 755 KCF_PROV_VERIFY_OPS(pd)->verify(ctx, data, sig, req) : \ 756 CRYPTO_NOT_SUPPORTED) 757 758 #define KCF_PROV_VERIFY_UPDATE(pd, ctx, data, req) ( \ 759 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_update) ? \ 760 KCF_PROV_VERIFY_OPS(pd)->verify_update(ctx, data, req) : \ 761 CRYPTO_NOT_SUPPORTED) 762 763 #define KCF_PROV_VERIFY_FINAL(pd, ctx, sig, req) ( \ 764 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_final) ? \ 765 KCF_PROV_VERIFY_OPS(pd)->verify_final(ctx, sig, req) : \ 766 CRYPTO_NOT_SUPPORTED) 767 768 #define KCF_PROV_VERIFY_ATOMIC(pd, session, mech, key, data, template, sig, \ 769 req) ( \ 770 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_atomic) ? \ 771 KCF_PROV_VERIFY_OPS(pd)->verify_atomic( \ 772 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 773 req) : CRYPTO_NOT_SUPPORTED) 774 775 #define KCF_PROV_VERIFY_RECOVER_INIT(pd, ctx, mech, key, template, \ 776 req) ( \ 777 (KCF_PROV_VERIFY_OPS(pd) && \ 778 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init) ? \ 779 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init(ctx, mech, key, \ 780 template, req) : CRYPTO_NOT_SUPPORTED) 781 782 /* verify_recover() CSPI routine has different argument order than verify() */ 783 #define KCF_PROV_VERIFY_RECOVER(pd, ctx, sig, data, req) ( \ 784 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_recover) ? \ 785 KCF_PROV_VERIFY_OPS(pd)->verify_recover(ctx, sig, data, req) : \ 786 CRYPTO_NOT_SUPPORTED) 787 788 /* 789 * verify_recover_atomic() CSPI routine has different argument order 790 * than verify_atomic(). 791 */ 792 #define KCF_PROV_VERIFY_RECOVER_ATOMIC(pd, session, mech, key, sig, \ 793 template, data, req) ( \ 794 (KCF_PROV_VERIFY_OPS(pd) && \ 795 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic) ? \ 796 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic( \ 797 (pd)->pd_prov_handle, session, mech, key, sig, data, template, \ 798 req) : CRYPTO_NOT_SUPPORTED) 799 800 /* 801 * Wrappers for crypto_dual_ops(9S) entry points. 802 */ 803 804 #define KCF_PROV_DIGEST_ENCRYPT_UPDATE(digest_ctx, encrypt_ctx, plaintext, \ 805 ciphertext, req) ( \ 806 (KCF_PROV_DUAL_OPS(pd) && \ 807 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update) ? \ 808 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update( \ 809 digest_ctx, encrypt_ctx, plaintext, ciphertext, req) : \ 810 CRYPTO_NOT_SUPPORTED) 811 812 #define KCF_PROV_DECRYPT_DIGEST_UPDATE(decrypt_ctx, digest_ctx, ciphertext, \ 813 plaintext, req) ( \ 814 (KCF_PROV_DUAL_OPS(pd) && \ 815 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update) ? \ 816 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update( \ 817 decrypt_ctx, digest_ctx, ciphertext, plaintext, req) : \ 818 CRYPTO_NOT_SUPPORTED) 819 820 #define KCF_PROV_SIGN_ENCRYPT_UPDATE(sign_ctx, encrypt_ctx, plaintext, \ 821 ciphertext, req) ( \ 822 (KCF_PROV_DUAL_OPS(pd) && \ 823 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update) ? \ 824 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update( \ 825 sign_ctx, encrypt_ctx, plaintext, ciphertext, req) : \ 826 CRYPTO_NOT_SUPPORTED) 827 828 #define KCF_PROV_DECRYPT_VERIFY_UPDATE(decrypt_ctx, verify_ctx, ciphertext, \ 829 plaintext, req) ( \ 830 (KCF_PROV_DUAL_OPS(pd) && \ 831 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update) ? \ 832 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update( \ 833 decrypt_ctx, verify_ctx, ciphertext, plaintext, req) : \ 834 CRYPTO_NOT_SUPPORTED) 835 836 /* 837 * Wrappers for crypto_dual_cipher_mac_ops(9S) entry points. 838 */ 839 840 #define KCF_PROV_ENCRYPT_MAC_INIT(pd, ctx, encr_mech, encr_key, mac_mech, \ 841 mac_key, encr_ctx_template, mac_ctx_template, req) ( \ 842 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 843 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init) ? \ 844 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init( \ 845 ctx, encr_mech, encr_key, mac_mech, mac_key, encr_ctx_template, \ 846 mac_ctx_template, req) : \ 847 CRYPTO_NOT_SUPPORTED) 848 849 #define KCF_PROV_ENCRYPT_MAC(pd, ctx, plaintext, ciphertext, mac, req) ( \ 850 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 851 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac) ? \ 852 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac( \ 853 ctx, plaintext, ciphertext, mac, req) : \ 854 CRYPTO_NOT_SUPPORTED) 855 856 #define KCF_PROV_ENCRYPT_MAC_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \ 857 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 858 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update) ? \ 859 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update( \ 860 ctx, plaintext, ciphertext, req) : \ 861 CRYPTO_NOT_SUPPORTED) 862 863 #define KCF_PROV_ENCRYPT_MAC_FINAL(pd, ctx, ciphertext, mac, req) ( \ 864 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 865 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final) ? \ 866 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final( \ 867 ctx, ciphertext, mac, req) : \ 868 CRYPTO_NOT_SUPPORTED) 869 870 #define KCF_PROV_ENCRYPT_MAC_ATOMIC(pd, session, encr_mech, encr_key, \ 871 mac_mech, mac_key, plaintext, ciphertext, mac, \ 872 encr_ctx_template, mac_ctx_template, req) ( \ 873 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 874 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic) ? \ 875 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic( \ 876 (pd)->pd_prov_handle, session, encr_mech, encr_key, \ 877 mac_mech, mac_key, plaintext, ciphertext, mac, \ 878 encr_ctx_template, mac_ctx_template, req) : \ 879 CRYPTO_NOT_SUPPORTED) 880 881 #define KCF_PROV_MAC_DECRYPT_INIT(pd, ctx, mac_mech, mac_key, decr_mech, \ 882 decr_key, mac_ctx_template, decr_ctx_template, req) ( \ 883 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 884 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init) ? \ 885 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init( \ 886 ctx, mac_mech, mac_key, decr_mech, decr_key, mac_ctx_template, \ 887 decr_ctx_template, req) : \ 888 CRYPTO_NOT_SUPPORTED) 889 890 #define KCF_PROV_MAC_DECRYPT(pd, ctx, ciphertext, mac, plaintext, req) ( \ 891 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 892 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt) ? \ 893 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt( \ 894 ctx, ciphertext, mac, plaintext, req) : \ 895 CRYPTO_NOT_SUPPORTED) 896 897 #define KCF_PROV_MAC_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \ 898 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 899 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update) ? \ 900 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update( \ 901 ctx, ciphertext, plaintext, req) : \ 902 CRYPTO_NOT_SUPPORTED) 903 904 #define KCF_PROV_MAC_DECRYPT_FINAL(pd, ctx, mac, plaintext, req) ( \ 905 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 906 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final) ? \ 907 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final( \ 908 ctx, mac, plaintext, req) : \ 909 CRYPTO_NOT_SUPPORTED) 910 911 #define KCF_PROV_MAC_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \ 912 decr_mech, decr_key, ciphertext, mac, plaintext, \ 913 mac_ctx_template, decr_ctx_template, req) ( \ 914 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 915 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic) ? \ 916 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic( \ 917 (pd)->pd_prov_handle, session, mac_mech, mac_key, \ 918 decr_mech, decr_key, ciphertext, mac, plaintext, \ 919 mac_ctx_template, decr_ctx_template, req) : \ 920 CRYPTO_NOT_SUPPORTED) 921 922 #define KCF_PROV_MAC_VERIFY_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \ 923 decr_mech, decr_key, ciphertext, mac, plaintext, \ 924 mac_ctx_template, decr_ctx_template, req) ( \ 925 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 926 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic \ 927 != NULL) ? \ 928 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic( \ 929 (pd)->pd_prov_handle, session, mac_mech, mac_key, \ 930 decr_mech, decr_key, ciphertext, mac, plaintext, \ 931 mac_ctx_template, decr_ctx_template, req) : \ 932 CRYPTO_NOT_SUPPORTED) 933 934 /* 935 * Wrappers for crypto_random_number_ops(9S) entry points. 936 */ 937 938 #define KCF_PROV_SEED_RANDOM(pd, session, buf, len, req) ( \ 939 (KCF_PROV_RANDOM_OPS(pd) && KCF_PROV_RANDOM_OPS(pd)->seed_random) ? \ 940 KCF_PROV_RANDOM_OPS(pd)->seed_random((pd)->pd_prov_handle, \ 941 session, buf, len, req) : CRYPTO_NOT_SUPPORTED) 942 943 #define KCF_PROV_GENERATE_RANDOM(pd, session, buf, len, req) ( \ 944 (KCF_PROV_RANDOM_OPS(pd) && \ 945 KCF_PROV_RANDOM_OPS(pd)->generate_random) ? \ 946 KCF_PROV_RANDOM_OPS(pd)->generate_random((pd)->pd_prov_handle, \ 947 session, buf, len, req) : CRYPTO_NOT_SUPPORTED) 948 949 /* 950 * Wrappers for crypto_session_ops(9S) entry points. 951 * 952 * ops_pd is the provider descriptor that supplies the ops_vector. 953 * pd is the descriptor that supplies the provider handle. 954 * Only session open/close needs two handles. 955 */ 956 957 #define KCF_PROV_SESSION_OPEN(ops_pd, session, req, pd) ( \ 958 (KCF_PROV_SESSION_OPS(ops_pd) && \ 959 KCF_PROV_SESSION_OPS(ops_pd)->session_open) ? \ 960 KCF_PROV_SESSION_OPS(ops_pd)->session_open((pd)->pd_prov_handle, \ 961 session, req) : CRYPTO_NOT_SUPPORTED) 962 963 #define KCF_PROV_SESSION_CLOSE(ops_pd, session, req, pd) ( \ 964 (KCF_PROV_SESSION_OPS(ops_pd) && \ 965 KCF_PROV_SESSION_OPS(ops_pd)->session_close) ? \ 966 KCF_PROV_SESSION_OPS(ops_pd)->session_close((pd)->pd_prov_handle, \ 967 session, req) : CRYPTO_NOT_SUPPORTED) 968 969 #define KCF_PROV_SESSION_LOGIN(pd, session, user_type, pin, len, req) ( \ 970 (KCF_PROV_SESSION_OPS(pd) && \ 971 KCF_PROV_SESSION_OPS(pd)->session_login) ? \ 972 KCF_PROV_SESSION_OPS(pd)->session_login((pd)->pd_prov_handle, \ 973 session, user_type, pin, len, req) : CRYPTO_NOT_SUPPORTED) 974 975 #define KCF_PROV_SESSION_LOGOUT(pd, session, req) ( \ 976 (KCF_PROV_SESSION_OPS(pd) && \ 977 KCF_PROV_SESSION_OPS(pd)->session_logout) ? \ 978 KCF_PROV_SESSION_OPS(pd)->session_logout((pd)->pd_prov_handle, \ 979 session, req) : CRYPTO_NOT_SUPPORTED) 980 981 /* 982 * Wrappers for crypto_object_ops(9S) entry points. 983 */ 984 985 #define KCF_PROV_OBJECT_CREATE(pd, session, template, count, object, req) ( \ 986 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_create) ? \ 987 KCF_PROV_OBJECT_OPS(pd)->object_create((pd)->pd_prov_handle, \ 988 session, template, count, object, req) : CRYPTO_NOT_SUPPORTED) 989 990 #define KCF_PROV_OBJECT_COPY(pd, session, object, template, count, \ 991 new_object, req) ( \ 992 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_copy) ? \ 993 KCF_PROV_OBJECT_OPS(pd)->object_copy((pd)->pd_prov_handle, \ 994 session, object, template, count, new_object, req) : \ 995 CRYPTO_NOT_SUPPORTED) 996 997 #define KCF_PROV_OBJECT_DESTROY(pd, session, object, req) ( \ 998 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_destroy) ? \ 999 KCF_PROV_OBJECT_OPS(pd)->object_destroy((pd)->pd_prov_handle, \ 1000 session, object, req) : CRYPTO_NOT_SUPPORTED) 1001 1002 #define KCF_PROV_OBJECT_GET_SIZE(pd, session, object, size, req) ( \ 1003 (KCF_PROV_OBJECT_OPS(pd) && \ 1004 KCF_PROV_OBJECT_OPS(pd)->object_get_size) ? \ 1005 KCF_PROV_OBJECT_OPS(pd)->object_get_size((pd)->pd_prov_handle, \ 1006 session, object, size, req) : CRYPTO_NOT_SUPPORTED) 1007 1008 #define KCF_PROV_OBJECT_GET_ATTRIBUTE_VALUE(pd, session, object, template, \ 1009 count, req) ( \ 1010 (KCF_PROV_OBJECT_OPS(pd) && \ 1011 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value) ? \ 1012 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value( \ 1013 (pd)->pd_prov_handle, session, object, template, count, req) : \ 1014 CRYPTO_NOT_SUPPORTED) 1015 1016 #define KCF_PROV_OBJECT_SET_ATTRIBUTE_VALUE(pd, session, object, template, \ 1017 count, req) ( \ 1018 (KCF_PROV_OBJECT_OPS(pd) && \ 1019 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value) ? \ 1020 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value( \ 1021 (pd)->pd_prov_handle, session, object, template, count, req) : \ 1022 CRYPTO_NOT_SUPPORTED) 1023 1024 #define KCF_PROV_OBJECT_FIND_INIT(pd, session, template, count, ppriv, \ 1025 req) ( \ 1026 (KCF_PROV_OBJECT_OPS(pd) && \ 1027 KCF_PROV_OBJECT_OPS(pd)->object_find_init) ? \ 1028 KCF_PROV_OBJECT_OPS(pd)->object_find_init((pd)->pd_prov_handle, \ 1029 session, template, count, ppriv, req) : CRYPTO_NOT_SUPPORTED) 1030 1031 #define KCF_PROV_OBJECT_FIND(pd, ppriv, objects, max_objects, object_count, \ 1032 req) ( \ 1033 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_find) ? \ 1034 KCF_PROV_OBJECT_OPS(pd)->object_find( \ 1035 (pd)->pd_prov_handle, ppriv, objects, max_objects, object_count, \ 1036 req) : CRYPTO_NOT_SUPPORTED) 1037 1038 #define KCF_PROV_OBJECT_FIND_FINAL(pd, ppriv, req) ( \ 1039 (KCF_PROV_OBJECT_OPS(pd) && \ 1040 KCF_PROV_OBJECT_OPS(pd)->object_find_final) ? \ 1041 KCF_PROV_OBJECT_OPS(pd)->object_find_final( \ 1042 (pd)->pd_prov_handle, ppriv, req) : CRYPTO_NOT_SUPPORTED) 1043 1044 /* 1045 * Wrappers for crypto_key_ops(9S) entry points. 1046 */ 1047 1048 #define KCF_PROV_KEY_GENERATE(pd, session, mech, template, count, object, \ 1049 req) ( \ 1050 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate) ? \ 1051 KCF_PROV_KEY_OPS(pd)->key_generate((pd)->pd_prov_handle, \ 1052 session, mech, template, count, object, req) : \ 1053 CRYPTO_NOT_SUPPORTED) 1054 1055 #define KCF_PROV_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \ 1056 pub_count, priv_template, priv_count, pub_key, priv_key, req) ( \ 1057 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate_pair) ? \ 1058 KCF_PROV_KEY_OPS(pd)->key_generate_pair((pd)->pd_prov_handle, \ 1059 session, mech, pub_template, pub_count, priv_template, \ 1060 priv_count, pub_key, priv_key, req) : \ 1061 CRYPTO_NOT_SUPPORTED) 1062 1063 #define KCF_PROV_KEY_WRAP(pd, session, mech, wrapping_key, key, wrapped_key, \ 1064 wrapped_key_len, req) ( \ 1065 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_wrap) ? \ 1066 KCF_PROV_KEY_OPS(pd)->key_wrap((pd)->pd_prov_handle, \ 1067 session, mech, wrapping_key, key, wrapped_key, wrapped_key_len, \ 1068 req) : \ 1069 CRYPTO_NOT_SUPPORTED) 1070 1071 #define KCF_PROV_KEY_UNWRAP(pd, session, mech, unwrapping_key, wrapped_key, \ 1072 wrapped_key_len, template, count, key, req) ( \ 1073 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_unwrap) ? \ 1074 KCF_PROV_KEY_OPS(pd)->key_unwrap((pd)->pd_prov_handle, \ 1075 session, mech, unwrapping_key, wrapped_key, wrapped_key_len, \ 1076 template, count, key, req) : \ 1077 CRYPTO_NOT_SUPPORTED) 1078 1079 #define KCF_PROV_KEY_DERIVE(pd, session, mech, base_key, template, count, \ 1080 key, req) ( \ 1081 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_derive) ? \ 1082 KCF_PROV_KEY_OPS(pd)->key_derive((pd)->pd_prov_handle, \ 1083 session, mech, base_key, template, count, key, req) : \ 1084 CRYPTO_NOT_SUPPORTED) 1085 1086 #define KCF_PROV_KEY_CHECK(pd, mech, key) ( \ 1087 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_check) ? \ 1088 KCF_PROV_KEY_OPS(pd)->key_check((pd)->pd_prov_handle, mech, key) : \ 1089 CRYPTO_NOT_SUPPORTED) 1090 1091 /* 1092 * Wrappers for crypto_provider_management_ops(9S) entry points. 1093 * 1094 * ops_pd is the provider descriptor that supplies the ops_vector. 1095 * pd is the descriptor that supplies the provider handle. 1096 * Only ext_info needs two handles. 1097 */ 1098 1099 #define KCF_PROV_EXT_INFO(ops_pd, provext_info, req, pd) ( \ 1100 (KCF_PROV_PROVIDER_OPS(ops_pd) && \ 1101 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info) ? \ 1102 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info((pd)->pd_prov_handle, \ 1103 provext_info, req) : CRYPTO_NOT_SUPPORTED) 1104 1105 #define KCF_PROV_INIT_TOKEN(pd, pin, pin_len, label, req) ( \ 1106 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_token) ? \ 1107 KCF_PROV_PROVIDER_OPS(pd)->init_token((pd)->pd_prov_handle, \ 1108 pin, pin_len, label, req) : CRYPTO_NOT_SUPPORTED) 1109 1110 #define KCF_PROV_INIT_PIN(pd, session, pin, pin_len, req) ( \ 1111 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_pin) ? \ 1112 KCF_PROV_PROVIDER_OPS(pd)->init_pin((pd)->pd_prov_handle, \ 1113 session, pin, pin_len, req) : CRYPTO_NOT_SUPPORTED) 1114 1115 #define KCF_PROV_SET_PIN(pd, session, old_pin, old_len, new_pin, new_len, \ 1116 req) ( \ 1117 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->set_pin) ? \ 1118 KCF_PROV_PROVIDER_OPS(pd)->set_pin((pd)->pd_prov_handle, \ 1119 session, old_pin, old_len, new_pin, new_len, req) : \ 1120 CRYPTO_NOT_SUPPORTED) 1121 1122 /* 1123 * The following routines are exported by the kcf module (/kernel/misc/kcf) 1124 * to the crypto and cryptoadmin modules. 1125 */ 1126 1127 /* Digest/mac/cipher entry points that take a provider descriptor and session */ 1128 extern int crypto_digest_prov(crypto_mechanism_t *, crypto_data_t *, 1129 crypto_data_t *, crypto_call_req_t *, kcf_provider_desc_t *, 1130 crypto_session_id_t); 1131 extern int crypto_digest_init_prov(kcf_provider_desc_t *, crypto_session_id_t, 1132 crypto_mechanism_t *, crypto_context_t *, crypto_call_req_t *); 1133 extern int crypto_digest_single(crypto_context_t, crypto_data_t *, 1134 crypto_data_t *, crypto_call_req_t *); 1135 1136 extern int crypto_mac_prov(crypto_mechanism_t *, crypto_data_t *, 1137 crypto_key_t *, crypto_ctx_template_t, crypto_data_t *, 1138 crypto_call_req_t *, kcf_provider_desc_t *, crypto_session_id_t); 1139 extern int crypto_mac_verify_prov(crypto_mechanism_t *, crypto_data_t *, 1140 crypto_key_t *, crypto_ctx_template_t, crypto_data_t *, 1141 crypto_call_req_t *, kcf_provider_desc_t *, crypto_session_id_t); 1142 extern int crypto_mac_init_prov(kcf_provider_desc_t *, crypto_session_id_t, 1143 crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t, 1144 crypto_context_t *, crypto_call_req_t *); 1145 extern int crypto_mac_single(crypto_context_t, crypto_data_t *, 1146 crypto_data_t *, crypto_call_req_t *); 1147 1148 extern int crypto_encrypt_prov(crypto_mechanism_t *, crypto_data_t *, 1149 crypto_key_t *, crypto_ctx_template_t, crypto_data_t *, 1150 crypto_call_req_t *, kcf_provider_desc_t *, crypto_session_id_t); 1151 extern int crypto_encrypt_init_prov(kcf_provider_desc_t *, 1152 crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *, 1153 crypto_ctx_template_t, crypto_context_t *, crypto_call_req_t *); 1154 extern int crypto_encrypt_single(crypto_context_t, crypto_data_t *, 1155 crypto_data_t *, crypto_call_req_t *); 1156 1157 extern int crypto_decrypt_prov(crypto_mechanism_t *, crypto_data_t *, 1158 crypto_key_t *, crypto_ctx_template_t, crypto_data_t *, 1159 crypto_call_req_t *, kcf_provider_desc_t *, crypto_session_id_t); 1160 extern int crypto_decrypt_init_prov(kcf_provider_desc_t *, crypto_session_id_t, 1161 crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t, 1162 crypto_context_t *, crypto_call_req_t *); 1163 extern int crypto_decrypt_single(crypto_context_t, crypto_data_t *, 1164 crypto_data_t *, crypto_call_req_t *); 1165 1166 1167 /* Other private digest/mac/cipher entry points not exported through k-API */ 1168 extern int crypto_digest_key_prov(crypto_context_t, crypto_key_t *, 1169 crypto_call_req_t *); 1170 1171 /* Private sign entry points exported by KCF */ 1172 extern int crypto_sign_init_prov(kcf_provider_desc_t *, crypto_session_id_t, 1173 crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t, 1174 crypto_context_t *, crypto_call_req_t *); 1175 extern int crypto_sign_single(crypto_context_t, crypto_data_t *, 1176 crypto_data_t *, crypto_call_req_t *); 1177 extern int crypto_sign_prov(kcf_provider_desc_t *, crypto_session_id_t, 1178 crypto_mechanism_t *, crypto_key_t *, crypto_data_t *, 1179 crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *); 1180 1181 extern int crypto_sign_recover_init_prov(kcf_provider_desc_t *, 1182 crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *, 1183 crypto_ctx_template_t tmpl, crypto_context_t *, crypto_call_req_t *); 1184 extern int crypto_sign_recover_single(crypto_context_t, crypto_data_t *, 1185 crypto_data_t *, crypto_call_req_t *); 1186 extern int crypto_sign_recover_prov(kcf_provider_desc_t *, 1187 crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *, 1188 crypto_data_t *, crypto_ctx_template_t, crypto_data_t *, 1189 crypto_call_req_t *); 1190 1191 /* Private verify entry points exported by KCF */ 1192 extern int crypto_verify_init_prov(kcf_provider_desc_t *, crypto_session_id_t, 1193 crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t, 1194 crypto_context_t *, crypto_call_req_t *); 1195 extern int crypto_verify_single(crypto_context_t, crypto_data_t *, 1196 crypto_data_t *, crypto_call_req_t *); 1197 extern int crypto_verify_prov(kcf_provider_desc_t *, crypto_session_id_t, 1198 crypto_mechanism_t *, crypto_key_t *, crypto_data_t *, 1199 crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *); 1200 1201 extern int crypto_verify_recover_init_prov(kcf_provider_desc_t *, 1202 crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *, 1203 crypto_ctx_template_t tmpl, crypto_context_t *, crypto_call_req_t *); 1204 extern int crypto_verify_recover_single(crypto_context_t, crypto_data_t *, 1205 crypto_data_t *, crypto_call_req_t *); 1206 extern int crypto_verify_recover_prov(kcf_provider_desc_t *, 1207 crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *, 1208 crypto_data_t *, crypto_ctx_template_t, crypto_data_t *, 1209 crypto_call_req_t *); 1210 1211 /* Private dual operations entry points exported by KCF */ 1212 extern int crypto_digest_encrypt_update(crypto_context_t, crypto_context_t, 1213 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1214 extern int crypto_decrypt_digest_update(crypto_context_t, crypto_context_t, 1215 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1216 extern int crypto_sign_encrypt_update(crypto_context_t, crypto_context_t, 1217 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1218 extern int crypto_decrypt_verify_update(crypto_context_t, crypto_context_t, 1219 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1220 1221 /* Random Number Generation */ 1222 int crypto_seed_random(crypto_provider_handle_t provider, uchar_t *buf, 1223 size_t len, crypto_call_req_t *req); 1224 int crypto_generate_random(crypto_provider_handle_t provider, uchar_t *buf, 1225 size_t len, crypto_call_req_t *req); 1226 1227 /* Session Management */ 1228 int crypto_session_open(crypto_provider_handle_t provider, 1229 crypto_session_id_t *session_id, crypto_call_req_t *req); 1230 int crypto_session_close(crypto_provider_handle_t provider, 1231 crypto_session_id_t session_id, crypto_call_req_t *req); 1232 int crypto_session_login(crypto_provider_handle_t provider, 1233 crypto_session_id_t session_id, crypto_user_type_t user_type, char *pin, 1234 size_t pin_len, crypto_call_req_t *req); 1235 int crypto_session_logout(crypto_provider_handle_t provider, 1236 crypto_session_id_t session_id, crypto_call_req_t *req); 1237 1238 /* Object Management */ 1239 int crypto_object_create(crypto_provider_handle_t provider, 1240 crypto_session_id_t session_id, crypto_object_attribute_t *template, 1241 uint_t attribute_count, crypto_object_id_t *object_handle, 1242 crypto_call_req_t *req); 1243 int crypto_object_copy(crypto_provider_handle_t provider, 1244 crypto_session_id_t session_id, crypto_object_id_t object_handle, 1245 crypto_object_attribute_t *template, uint_t attribute_count, 1246 crypto_object_id_t *new_object_handle, crypto_call_req_t *req); 1247 int crypto_object_destroy(crypto_provider_handle_t provider, 1248 crypto_session_id_t session_id, crypto_object_id_t object_handle, 1249 crypto_call_req_t *req); 1250 int crypto_object_get_size(crypto_provider_handle_t provider, 1251 crypto_session_id_t session_id, crypto_object_id_t object_handle, 1252 size_t *size, crypto_call_req_t *req); 1253 int crypto_object_get_attribute_value(crypto_provider_handle_t provider, 1254 crypto_session_id_t session_id, crypto_object_id_t object_handle, 1255 crypto_object_attribute_t *template, uint_t attribute_count, 1256 crypto_call_req_t *req); 1257 int crypto_object_set_attribute_value(crypto_provider_handle_t provider, 1258 crypto_session_id_t session_id, crypto_object_id_t object_handle, 1259 crypto_object_attribute_t *template, uint_t count, crypto_call_req_t *req); 1260 int crypto_object_find_init(crypto_provider_handle_t provider, 1261 crypto_session_id_t session_id, crypto_object_attribute_t *template, 1262 uint_t attribute_count, void **provider_private, crypto_call_req_t *req); 1263 int crypto_object_find(crypto_provider_handle_t provider, 1264 void *provider_private, crypto_object_id_t *objects, 1265 uint_t max_object_count, uint_t *object_count, crypto_call_req_t *req); 1266 int crypto_object_find_final(crypto_provider_handle_t provider, 1267 void *provider_private, crypto_call_req_t *req); 1268 1269 /* Key Generation */ 1270 int crypto_generate_key(crypto_provider_handle_t provider, 1271 crypto_session_id_t session_id, crypto_mechanism_t *mech, 1272 crypto_object_attribute_t *key_attributes, uint_t attributes_count, 1273 crypto_object_id_t *key_handle, crypto_call_req_t *req); 1274 int crypto_generate_key_pair(crypto_provider_handle_t provider, 1275 crypto_session_id_t session_id, crypto_mechanism_t *mech, 1276 crypto_object_attribute_t *public_attributes, uint_t public_count, 1277 crypto_object_attribute_t *private_attributes, uint_t private_count, 1278 crypto_object_id_t *public_handle, crypto_object_id_t *private_handle, 1279 crypto_call_req_t *req); 1280 int crypto_wrap_key(crypto_provider_handle_t provider, 1281 crypto_session_id_t session_id, crypto_mechanism_t *mech, 1282 crypto_key_t *wrapping_key, crypto_object_id_t *key_handle, 1283 uchar_t *wrapped_key, size_t wrapped_key_len, crypto_call_req_t *req); 1284 int crypto_unwrap_key(crypto_provider_handle_t provider, 1285 crypto_session_id_t session_id, crypto_mechanism_t *mech, crypto_key_t *key, 1286 uchar_t *wrapped_key, size_t wrapped_key_len, 1287 crypto_object_id_t *key_handle, crypto_call_req_t *req); 1288 int crypto_derive_key(crypto_provider_handle_t provider, 1289 crypto_session_id_t session_id, crypto_mechanism_t *mech, crypto_key_t *key, 1290 crypto_object_attribute_t *attributes, uint_t attribute_count, 1291 crypto_object_id_t *object_handle, crypto_call_req_t *req); 1292 1293 /* Provider Management */ 1294 int crypto_get_provider_info(crypto_provider_id_t id, 1295 crypto_provider_info_t **info, crypto_call_req_t *req); 1296 int crypto_get_provider_mechanisms(crypto_minor_t *, crypto_provider_id_t id, 1297 uint_t *count, crypto_mech_name_t **list); 1298 int crypto_init_token(crypto_provider_handle_t provider, char *pin, 1299 size_t pin_len, char *label, crypto_call_req_t *); 1300 int crypto_init_pin(crypto_provider_handle_t provider, char *pin, 1301 size_t pin_len, crypto_call_req_t *req); 1302 int crypto_set_pin(crypto_provider_handle_t provider, char *old_pin, 1303 size_t old_len, char *new_pin, size_t new_len, crypto_call_req_t *req); 1304 void crypto_free_provider_list(crypto_provider_entry_t *list, uint_t count); 1305 void crypto_free_provider_info(crypto_provider_info_t *info); 1306 1307 /* Administrative */ 1308 int crypto_get_dev_list(uint_t *count, crypto_dev_list_entry_t **list); 1309 int crypto_get_soft_list(uint_t *count, char **list, size_t *len); 1310 int crypto_get_dev_info(char *name, uint_t instance, uint_t *count, 1311 crypto_mech_name_t **list); 1312 int crypto_get_soft_info(caddr_t name, uint_t *count, 1313 crypto_mech_name_t **list); 1314 int crypto_load_dev_disabled(char *name, uint_t instance, uint_t count, 1315 crypto_mech_name_t *list); 1316 int crypto_load_soft_disabled(caddr_t name, uint_t count, 1317 crypto_mech_name_t *list); 1318 int crypto_unload_soft_module(caddr_t path); 1319 int crypto_load_soft_config(caddr_t name, uint_t count, 1320 crypto_mech_name_t *list); 1321 int crypto_load_door(uint_t did); 1322 void crypto_free_mech_list(crypto_mech_name_t *list, uint_t count); 1323 void crypto_free_dev_list(crypto_dev_list_entry_t *list, uint_t count); 1324 1325 /* Miscellaneous */ 1326 int crypto_get_mechanism_number(caddr_t name, crypto_mech_type_t *number); 1327 int crypto_get_function_list(crypto_provider_id_t id, 1328 crypto_function_list_t **list, int kmflag); 1329 void crypto_free_function_list(crypto_function_list_t *list); 1330 int crypto_build_permitted_mech_names(kcf_provider_desc_t *, 1331 crypto_mech_name_t **, uint_t *, int); 1332 extern void kcf_init_mech_tabs(void); 1333 extern int kcf_add_mech_provider(crypto_mech_info_t *, kcf_provider_desc_t *, 1334 kcf_prov_mech_desc_t **); 1335 extern void kcf_remove_mech_provider(char *, kcf_provider_desc_t *); 1336 extern int kcf_get_mech_entry(crypto_mech_type_t, kcf_mech_entry_t **); 1337 extern kcf_provider_desc_t *kcf_alloc_provider_desc(crypto_provider_info_t *); 1338 extern void kcf_provider_zero_refcnt(kcf_provider_desc_t *); 1339 extern void kcf_free_provider_desc(kcf_provider_desc_t *); 1340 extern void kcf_soft_config_init(void); 1341 extern int get_sw_provider_for_mech(crypto_mech_name_t, char **); 1342 extern void kcf_dup_mech(crypto_mechanism_t *, crypto_mechanism_t *, 1343 crypto_mech_type_t *); 1344 extern crypto_mech_type_t crypto_mech2id_common(char *, boolean_t); 1345 extern void undo_register_provider(kcf_provider_desc_t *, boolean_t); 1346 extern void redo_register_provider(kcf_provider_desc_t *); 1347 extern void kcf_rnd_init(); 1348 extern boolean_t kcf_rngprov_check(void); 1349 extern int kcf_rnd_get_pseudo_bytes(uint8_t *, size_t); 1350 extern int kcf_rnd_get_bytes(uint8_t *, size_t, boolean_t, boolean_t); 1351 extern void kcf_rnd_chpoll(int, short *, struct pollhead **); 1352 extern void kcf_rnd_schedule_timeout(boolean_t); 1353 1354 /* Access to the provider's table */ 1355 extern void kcf_prov_tab_init(void); 1356 extern int kcf_prov_tab_add_provider(kcf_provider_desc_t *); 1357 extern int kcf_prov_tab_rem_provider(crypto_provider_id_t); 1358 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_name(char *); 1359 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_dev(char *, uint_t); 1360 extern int kcf_get_hw_prov_tab(uint_t *, kcf_provider_desc_t ***, int, 1361 char *, uint_t, boolean_t); 1362 extern int kcf_get_slot_list(uint_t *, kcf_provider_desc_t ***, boolean_t); 1363 extern void kcf_free_provider_tab(uint_t, kcf_provider_desc_t **); 1364 extern kcf_provider_desc_t *kcf_prov_tab_lookup(crypto_provider_id_t); 1365 extern int kcf_get_sw_prov(crypto_mech_type_t, kcf_provider_desc_t **, 1366 boolean_t); 1367 1368 /* Access to the policy table */ 1369 extern boolean_t is_mech_disabled(kcf_provider_desc_t *, crypto_mech_name_t); 1370 extern boolean_t is_mech_disabled_byname(crypto_provider_type_t, char *, 1371 uint_t, crypto_mech_name_t); 1372 extern void kcf_policy_tab_init(void); 1373 extern void kcf_policy_free_desc(kcf_policy_desc_t *); 1374 extern void kcf_policy_remove_by_name(char *, uint_t *, crypto_mech_name_t **); 1375 extern void kcf_policy_remove_by_dev(char *, uint_t, uint_t *, 1376 crypto_mech_name_t **); 1377 extern kcf_policy_desc_t *kcf_policy_lookup_by_name(char *); 1378 extern kcf_policy_desc_t *kcf_policy_lookup_by_dev(char *, uint_t); 1379 extern int kcf_policy_load_soft_disabled(char *, uint_t, crypto_mech_name_t *, 1380 uint_t *, crypto_mech_name_t **); 1381 extern int kcf_policy_load_dev_disabled(char *, uint_t, uint_t, 1382 crypto_mech_name_t *, uint_t *, crypto_mech_name_t **); 1383 1384 #endif /* _KERNEL */ 1385 1386 #ifdef __cplusplus 1387 } 1388 #endif 1389 1390 #endif /* _SYS_CRYPTO_IMPL_H */ 1391