xref: /titanic_50/usr/src/uts/common/sys/crypto/impl.h (revision 8c4f9701439555b41fbfe7848508f53b52166007)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef	_SYS_CRYPTO_IMPL_H
27 #define	_SYS_CRYPTO_IMPL_H
28 
29 /*
30  * Kernel Cryptographic Framework private implementation definitions.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/param.h>
35 
36 #ifdef _KERNEL
37 #include <sys/crypto/common.h>
38 #include <sys/crypto/api.h>
39 #include <sys/crypto/spi.h>
40 #include <sys/crypto/ioctl.h>
41 #include <sys/tnf_probe.h>
42 #include <sys/atomic.h>
43 #include <sys/project.h>
44 #include <sys/taskq.h>
45 #include <sys/rctl.h>
46 #include <sys/cpuvar.h>
47 #endif /* _KERNEL */
48 
49 #ifdef	__cplusplus
50 extern "C" {
51 #endif
52 
53 #ifdef _KERNEL
54 
55 /*
56  * Prefixes convention: structures internal to the kernel cryptographic
57  * framework start with 'kcf_'. Exposed structure start with 'crypto_'.
58  */
59 
60 /* Provider stats. Not protected. */
61 typedef	struct kcf_prov_stats {
62 	kstat_named_t	ps_ops_total;
63 	kstat_named_t	ps_ops_passed;
64 	kstat_named_t	ps_ops_failed;
65 	kstat_named_t	ps_ops_busy_rval;
66 } kcf_prov_stats_t;
67 
68 /* Various kcf stats. Not protected. */
69 typedef	struct kcf_stats {
70 	kstat_named_t	ks_thrs_in_pool;
71 	kstat_named_t	ks_idle_thrs;
72 	kstat_named_t	ks_minthrs;
73 	kstat_named_t	ks_maxthrs;
74 	kstat_named_t	ks_swq_njobs;
75 	kstat_named_t	ks_swq_maxjobs;
76 	kstat_named_t	ks_taskq_threads;
77 	kstat_named_t	ks_taskq_minalloc;
78 	kstat_named_t	ks_taskq_maxalloc;
79 } kcf_stats_t;
80 
81 #define	CPU_SEQID	(CPU->cpu_seqid)
82 
83 typedef struct kcf_lock_withpad {
84 	kmutex_t	kl_lock;
85 	uint8_t		kl_pad[64 - sizeof (kmutex_t)];
86 } kcf_lock_withpad_t;
87 
88 /*
89  * Per-CPU structure used by a provider to keep track of
90  * various counters.
91  */
92 typedef struct kcf_prov_cpu {
93 	kmutex_t	kp_lock;
94 	int		kp_holdcnt;	/* can go negative! */
95 	uint_t		kp_jobcnt;
96 
97 	uint64_t	kp_ndispatches;
98 	uint64_t	kp_nfails;
99 	uint64_t	kp_nbusy_rval;
100 	kcondvar_t	kp_cv;
101 
102 	uint8_t		kp_pad[64 - sizeof (kmutex_t) - 2 * sizeof (int) -
103 	    3 * sizeof (uint64_t) - sizeof (kcondvar_t)];
104 } kcf_prov_cpu_t;
105 
106 /*
107  * kcf_get_refcnt(pd) is the number of inflight requests to the
108  * provider. So, it is a good measure of the load on a provider when
109  * it is not in a busy state. Once a provider notifies it is busy, requests
110  * backup in the taskq. So, we use tq_nalloc in that case which gives
111  * the number of task entries in the task queue. Note that we do not
112  * acquire any locks here as it is not critical to get the exact number
113  * and the lock contention is too costly for this code path.
114  */
115 #define	KCF_PROV_LOAD(pd)	((pd)->pd_state != KCF_PROV_BUSY ?	\
116 	kcf_get_refcnt(pd, B_FALSE) : (pd)->pd_taskq->tq_nalloc)
117 
118 
119 /*
120  * The following two macros should be
121  * #define KCF_OPS_CLASSSIZE (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2)
122  * #define KCF_MAXMECHTAB KCF_MAXCIPHER
123  *
124  * However, doing that would involve reorganizing the header file a bit.
125  * When impl.h is broken up (bug# 4703218), this will be done. For now,
126  * we hardcode these values.
127  */
128 #define	KCF_OPS_CLASSSIZE	8
129 #define	KCF_MAXMECHTAB		32
130 
131 /*
132  * Valid values for the state of a provider. The order of
133  * the elements is important.
134  *
135  * Routines which get a provider or the list of providers
136  * should pick only those that are either in KCF_PROV_READY state
137  * or in KCF_PROV_BUSY state.
138  */
139 typedef enum {
140 	KCF_PROV_ALLOCATED = 1,
141 	KCF_PROV_UNVERIFIED,
142 	KCF_PROV_UNVERIFIED_FIPS140,
143 	KCF_PROV_VERIFICATION_FAILED,
144 	/*
145 	 * state < KCF_PROV_READY means the provider can not
146 	 * be used at all.
147 	 */
148 	KCF_PROV_READY,
149 	KCF_PROV_BUSY,
150 	/*
151 	 * state > KCF_PROV_BUSY means the provider can not
152 	 * be used for new requests.
153 	 */
154 	KCF_PROV_FAILED,
155 	/*
156 	 * Threads setting the following two states should do so only
157 	 * if the current state < KCF_PROV_DISABLED.
158 	 */
159 	KCF_PROV_DISABLED,
160 	KCF_PROV_UNREGISTERING,
161 	KCF_PROV_UNREGISTERED
162 } kcf_prov_state_t;
163 
164 #define	KCF_IS_PROV_UNVERIFIED(pd) ((pd)->pd_state == KCF_PROV_UNVERIFIED)
165 #define	KCF_IS_PROV_USABLE(pd) ((pd)->pd_state == KCF_PROV_READY || \
166 	(pd)->pd_state == KCF_PROV_BUSY)
167 #define	KCF_IS_PROV_REMOVED(pd)	((pd)->pd_state >= KCF_PROV_UNREGISTERING)
168 
169 /* Internal flags valid for pd_flags field */
170 #define	KCF_PROV_RESTRICTED	0x40000000
171 #define	KCF_LPROV_MEMBER	0x80000000 /* is member of a logical provider */
172 
173 /*
174  * A provider descriptor structure. There is one such structure per
175  * provider. It is allocated and initialized at registration time and
176  * freed when the provider unregisters.
177  *
178  * pd_prov_type:	Provider type, hardware or software
179  * pd_sid:		Session ID of the provider used by kernel clients.
180  *			This is valid only for session-oriented providers.
181  * pd_taskq:		taskq used to dispatch crypto requests
182  * pd_nbins:		number of bins in pd_percpu_bins
183  * pd_percpu_bins:	Pointer to an array of per-CPU structures
184  *			containing a lock, a cv and various counters.
185  * pd_lock:		lock protects pd_state and pd_provider_list
186  * pd_state:		State value of the provider
187  * pd_provider_list:	Used to cross-reference logical providers and their
188  *			members. Not used for software providers.
189  * pd_resume_cv:	cv to wait for state to change from KCF_PROV_BUSY
190  * pd_prov_handle:	Provider handle specified by provider
191  * pd_ops_vector:	The ops vector specified by Provider
192  * pd_mech_indx:	Lookup table which maps a core framework mechanism
193  *			number to an index in pd_mechanisms array
194  * pd_mechanisms:	Array of mechanisms supported by the provider, specified
195  *			by the provider during registration
196  * pd_mech_list_count:	The number of entries in pi_mechanisms, specified
197  *			by the provider during registration
198  * pd_name:		Device name or module name
199  * pd_instance:		Device instance
200  * pd_module_id:	Module ID returned by modload
201  * pd_mctlp:		Pointer to modctl structure for this provider
202  * pd_description:	Provider description string
203  * pd_flags:		bitwise OR of pi_flags from crypto_provider_info_t
204  *			and other internal flags defined above.
205  * pd_hash_limit:	Maximum data size that hash mechanisms of this provider
206  * 			can support.
207  * pd_hmac_limit:	Maximum data size that HMAC mechanisms of this provider
208  * 			can support.
209  * pd_kcf_prov_handle:	KCF-private handle assigned by KCF
210  * pd_prov_id:		Identification # assigned by KCF to provider
211  * pd_kstat:		kstat associated with the provider
212  * pd_ks_data:		kstat data
213  */
214 typedef struct kcf_provider_desc {
215 	crypto_provider_type_t		pd_prov_type;
216 	crypto_session_id_t		pd_sid;
217 	taskq_t				*pd_taskq;
218 	uint_t				pd_nbins;
219 	kcf_prov_cpu_t			*pd_percpu_bins;
220 	kmutex_t			pd_lock;
221 	kcf_prov_state_t		pd_state;
222 	struct kcf_provider_list	*pd_provider_list;
223 	kcondvar_t			pd_resume_cv;
224 	crypto_provider_handle_t	pd_prov_handle;
225 	crypto_ops_t			*pd_ops_vector;
226 	ushort_t			pd_mech_indx[KCF_OPS_CLASSSIZE]\
227 					    [KCF_MAXMECHTAB];
228 	crypto_mech_info_t		*pd_mechanisms;
229 	uint_t				pd_mech_list_count;
230 	char				*pd_name;
231 	uint_t				pd_instance;
232 	int				pd_module_id;
233 	struct modctl			*pd_mctlp;
234 	char				*pd_description;
235 	uint_t				pd_flags;
236 	uint_t				pd_hash_limit;
237 	uint_t				pd_hmac_limit;
238 	crypto_kcf_provider_handle_t	pd_kcf_prov_handle;
239 	crypto_provider_id_t		pd_prov_id;
240 	kstat_t				*pd_kstat;
241 	kcf_prov_stats_t		pd_ks_data;
242 } kcf_provider_desc_t;
243 
244 /* useful for making a list of providers */
245 typedef struct kcf_provider_list {
246 	struct kcf_provider_list *pl_next;
247 	struct kcf_provider_desc *pl_provider;
248 } kcf_provider_list_t;
249 
250 /*
251  * If a component has a reference to a kcf_provider_desc_t,
252  * it REFHOLD()s. A new provider descriptor which is referenced only
253  * by the providers table has a reference counter of one.
254  */
255 #define	KCF_PROV_REFHOLD(desc) {			\
256 	kcf_prov_cpu_t	*mp;				\
257 							\
258 	mp = &((desc)->pd_percpu_bins[CPU_SEQID]);	\
259 	mutex_enter(&mp->kp_lock);			\
260 	mp->kp_holdcnt++;				\
261 	mutex_exit(&mp->kp_lock);			\
262 }
263 
264 #define	KCF_PROV_REFRELE(desc) {			\
265 	kcf_prov_cpu_t	*mp;				\
266 							\
267 	mp = &((desc)->pd_percpu_bins[CPU_SEQID]);	\
268 	mutex_enter(&mp->kp_lock);			\
269 	mp->kp_holdcnt--;				\
270 	mutex_exit(&mp->kp_lock);			\
271 }
272 
273 #define	KCF_PROV_REFHELD(desc)	(kcf_get_refcnt(desc, B_TRUE) >= 1)
274 
275 /*
276  * The JOB macros are used only for a hardware provider.
277  * Hardware providers can have holds that stay forever.
278  * So, the job counter is used to check if it is safe to
279  * unregister a provider.
280  */
281 #define	KCF_PROV_JOB_HOLD(mp) {			\
282 	mutex_enter(&(mp)->kp_lock);		\
283 	(mp)->kp_jobcnt++;			\
284 	mutex_exit(&(mp)->kp_lock);		\
285 }
286 
287 #define	KCF_PROV_JOB_RELE(mp) {			\
288 	mutex_enter(&(mp)->kp_lock);		\
289 	(mp)->kp_jobcnt--;			\
290 	if ((mp)->kp_jobcnt == 0)		\
291 		cv_signal(&(mp)->kp_cv);	\
292 	mutex_exit(&(mp)->kp_lock);		\
293 }
294 
295 #define	KCF_PROV_JOB_RELE_STAT(mp, doincr) {	\
296 	if (doincr)				\
297 		(mp)->kp_nfails++;		\
298 	KCF_PROV_JOB_RELE(mp);			\
299 }
300 
301 #define	KCF_PROV_INCRSTATS(pd, error)	{				\
302 	kcf_prov_cpu_t	*mp;						\
303 									\
304 	mp = &((pd)->pd_percpu_bins[CPU_SEQID]);			\
305 	mp->kp_ndispatches++;						\
306 	if ((error) == CRYPTO_BUSY)					\
307 		mp->kp_nbusy_rval++;					\
308 	else if ((error) != CRYPTO_SUCCESS && (error) != CRYPTO_QUEUED)	\
309 		mp->kp_nfails++;					\
310 }
311 
312 /* list of crypto_mech_info_t valid as the second mech in a dual operation */
313 
314 typedef	struct crypto_mech_info_list {
315 	struct crypto_mech_info_list	*ml_next;
316 	crypto_mech_type_t		ml_kcf_mechid;	/* KCF's id */
317 	crypto_mech_info_t		ml_mech_info;
318 } crypto_mech_info_list_t;
319 
320 /*
321  * An element in a mechanism provider descriptors chain.
322  * The kcf_prov_mech_desc_t is duplicated in every chain the provider belongs
323  * to. This is a small tradeoff memory vs mutex spinning time to access the
324  * common provider field.
325  */
326 
327 typedef struct kcf_prov_mech_desc {
328 	struct kcf_mech_entry		*pm_me;		/* Back to the head */
329 	struct kcf_prov_mech_desc	*pm_next;	/* Next in the chain */
330 	crypto_mech_info_t		pm_mech_info;	/* Provider mech info */
331 	crypto_mech_info_list_t		*pm_mi_list;	/* list for duals */
332 	kcf_provider_desc_t		*pm_prov_desc;	/* Common desc. */
333 } kcf_prov_mech_desc_t;
334 
335 /* and the notation shortcuts ... */
336 #define	pm_provider_type	pm_prov_desc.pd_provider_type
337 #define	pm_provider_handle	pm_prov_desc.pd_provider_handle
338 #define	pm_ops_vector		pm_prov_desc.pd_ops_vector
339 
340 extern kcf_lock_withpad_t *me_mutexes;
341 
342 #define	KCF_CPU_PAD (128 - sizeof (crypto_mech_name_t) - \
343     sizeof (crypto_mech_type_t) - \
344     2 * sizeof (kcf_prov_mech_desc_t *) - \
345     sizeof (int) - sizeof (uint32_t) - sizeof (size_t))
346 
347 /*
348  * A mechanism entry in an xxx_mech_tab[]. KCF_CPU_PAD needs
349  * to be adjusted if this structure is changed.
350  */
351 typedef	struct kcf_mech_entry {
352 	crypto_mech_name_t	me_name;	/* mechanism name */
353 	crypto_mech_type_t	me_mechid;	/* Internal id for mechanism */
354 	kcf_prov_mech_desc_t	*me_hw_prov_chain;  /* list of HW providers */
355 	kcf_prov_mech_desc_t	*me_sw_prov;    /* SW provider */
356 	/*
357 	 * Number of HW providers in the chain. There is only one
358 	 * SW provider. So, we need only a count of HW providers.
359 	 */
360 	int			me_num_hwprov;
361 	/*
362 	 * When a SW provider is present, this is the generation number that
363 	 * ensures no objects from old SW providers are used in the new one
364 	 */
365 	uint32_t		me_gen_swprov;
366 	/*
367 	 *  threshold for using hardware providers for this mech
368 	 */
369 	size_t			me_threshold;
370 	uint8_t			me_pad[KCF_CPU_PAD];
371 } kcf_mech_entry_t;
372 
373 /*
374  * A policy descriptor structure. It is allocated and initialized
375  * when administrative ioctls load disabled mechanisms.
376  *
377  * pd_prov_type:	Provider type, hardware or software
378  * pd_name:		Device name or module name.
379  * pd_instance:		Device instance.
380  * pd_refcnt:		Reference counter for this policy descriptor
381  * pd_mutex:		Protects array and count of disabled mechanisms.
382  * pd_disabled_count:	Count of disabled mechanisms.
383  * pd_disabled_mechs:	Array of disabled mechanisms.
384  */
385 typedef struct kcf_policy_desc {
386 	crypto_provider_type_t	pd_prov_type;
387 	char			*pd_name;
388 	uint_t			pd_instance;
389 	uint_t			pd_refcnt;
390 	kmutex_t		pd_mutex;
391 	uint_t			pd_disabled_count;
392 	crypto_mech_name_t	*pd_disabled_mechs;
393 } kcf_policy_desc_t;
394 
395 /*
396  * If a component has a reference to a kcf_policy_desc_t,
397  * it REFHOLD()s. A new policy descriptor which is referenced only
398  * by the policy table has a reference count of one.
399  */
400 #define	KCF_POLICY_REFHOLD(desc) {		\
401 	atomic_add_32(&(desc)->pd_refcnt, 1);	\
402 	ASSERT((desc)->pd_refcnt != 0);		\
403 }
404 
405 /*
406  * Releases a reference to a policy descriptor. When the last
407  * reference is released, the descriptor is freed.
408  */
409 #define	KCF_POLICY_REFRELE(desc) {				\
410 	ASSERT((desc)->pd_refcnt != 0);				\
411 	membar_exit();						\
412 	if (atomic_add_32_nv(&(desc)->pd_refcnt, -1) == 0)	\
413 		kcf_policy_free_desc(desc);			\
414 }
415 
416 /*
417  * This entry stores the name of a software module and its
418  * mechanisms.  The mechanisms are 'hints' that are used to
419  * trigger loading of the module.
420  */
421 typedef struct kcf_soft_conf_entry {
422 	struct kcf_soft_conf_entry	*ce_next;
423 	char				*ce_name;
424 	crypto_mech_name_t		*ce_mechs;
425 	uint_t				ce_count;
426 } kcf_soft_conf_entry_t;
427 
428 extern kmutex_t soft_config_mutex;
429 extern kcf_soft_conf_entry_t *soft_config_list;
430 
431 /*
432  * Global tables. The sizes are from the predefined PKCS#11 v2.20 mechanisms,
433  * with a margin of few extra empty entry points
434  */
435 
436 #define	KCF_MAXDIGEST		16	/* Digests */
437 #define	KCF_MAXCIPHER		64	/* Ciphers */
438 #define	KCF_MAXMAC		40	/* Message authentication codes */
439 #define	KCF_MAXSIGN		24	/* Sign/Verify */
440 #define	KCF_MAXKEYOPS		116	/* Key generation and derivation */
441 #define	KCF_MAXMISC		16	/* Others ... */
442 
443 #define	KCF_MAXMECHS		KCF_MAXDIGEST + KCF_MAXCIPHER + KCF_MAXMAC + \
444 				KCF_MAXSIGN + KCF_MAXKEYOPS + \
445 				KCF_MAXMISC
446 
447 extern kcf_mech_entry_t kcf_digest_mechs_tab[];
448 extern kcf_mech_entry_t kcf_cipher_mechs_tab[];
449 extern kcf_mech_entry_t kcf_mac_mechs_tab[];
450 extern kcf_mech_entry_t kcf_sign_mechs_tab[];
451 extern kcf_mech_entry_t kcf_keyops_mechs_tab[];
452 extern kcf_mech_entry_t kcf_misc_mechs_tab[];
453 
454 extern kmutex_t kcf_mech_tabs_lock;
455 
456 typedef	enum {
457 	KCF_DIGEST_CLASS = 1,
458 	KCF_CIPHER_CLASS,
459 	KCF_MAC_CLASS,
460 	KCF_SIGN_CLASS,
461 	KCF_KEYOPS_CLASS,
462 	KCF_MISC_CLASS
463 } kcf_ops_class_t;
464 
465 #define	KCF_FIRST_OPSCLASS	KCF_DIGEST_CLASS
466 #define	KCF_LAST_OPSCLASS	KCF_MISC_CLASS
467 
468 /* The table of all the kcf_xxx_mech_tab[]s, indexed by kcf_ops_class */
469 
470 typedef	struct kcf_mech_entry_tab {
471 	int			met_size;	/* Size of the met_tab[] */
472 	kcf_mech_entry_t	*met_tab;	/* the table		 */
473 } kcf_mech_entry_tab_t;
474 
475 extern kcf_mech_entry_tab_t kcf_mech_tabs_tab[];
476 
477 #define	KCF_MECHID(class, index)				\
478 	(((crypto_mech_type_t)(class) << 32) | (crypto_mech_type_t)(index))
479 
480 #define	KCF_MECH2CLASS(mech_type) ((kcf_ops_class_t)((mech_type) >> 32))
481 
482 #define	KCF_MECH2INDEX(mech_type) ((int)(mech_type))
483 
484 #define	KCF_TO_PROV_MECH_INDX(pd, mech_type) 			\
485 	((pd)->pd_mech_indx[KCF_MECH2CLASS(mech_type)] 		\
486 	[KCF_MECH2INDEX(mech_type)])
487 
488 #define	KCF_TO_PROV_MECHINFO(pd, mech_type)			\
489 	((pd)->pd_mechanisms[KCF_TO_PROV_MECH_INDX(pd, mech_type)])
490 
491 #define	KCF_TO_PROV_MECHNUM(pd, mech_type)			\
492 	(KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_number)
493 
494 #define	KCF_CAN_SHARE_OPSTATE(pd, mech_type)			\
495 	((KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_flags) &	\
496 	CRYPTO_CAN_SHARE_OPSTATE)
497 
498 /* ps_refcnt is protected by cm_lock in the crypto_minor structure */
499 typedef struct crypto_provider_session {
500 	struct crypto_provider_session *ps_next;
501 	crypto_session_id_t		ps_session;
502 	kcf_provider_desc_t		*ps_provider;
503 	kcf_provider_desc_t		*ps_real_provider;
504 	uint_t				ps_refcnt;
505 } crypto_provider_session_t;
506 
507 typedef struct crypto_session_data {
508 	kmutex_t			sd_lock;
509 	kcondvar_t			sd_cv;
510 	uint32_t			sd_flags;
511 	int				sd_pre_approved_amount;
512 	crypto_ctx_t			*sd_digest_ctx;
513 	crypto_ctx_t			*sd_encr_ctx;
514 	crypto_ctx_t			*sd_decr_ctx;
515 	crypto_ctx_t			*sd_sign_ctx;
516 	crypto_ctx_t			*sd_verify_ctx;
517 	crypto_ctx_t			*sd_sign_recover_ctx;
518 	crypto_ctx_t			*sd_verify_recover_ctx;
519 	kcf_provider_desc_t		*sd_provider;
520 	void				*sd_find_init_cookie;
521 	crypto_provider_session_t	*sd_provider_session;
522 } crypto_session_data_t;
523 
524 #define	CRYPTO_SESSION_IN_USE		0x00000001
525 #define	CRYPTO_SESSION_IS_BUSY		0x00000002
526 #define	CRYPTO_SESSION_IS_CLOSED	0x00000004
527 
528 #define	KCF_MAX_PIN_LEN			1024
529 
530 /* Global FIPS 140 mode variable */
531 extern uint32_t global_fips140_mode;
532 /* Global FIPS 140 mode lock */
533 extern kmutex_t fips140_mode_lock;
534 /* Conditional variable for kcf to wait until kcfd tells the FIPS mode status */
535 extern kcondvar_t cv_fips140;
536 
537 /*
538  * Per-minor info.
539  *
540  * cm_lock protects everything in this structure except for cm_refcnt.
541  */
542 typedef struct crypto_minor {
543 	uint_t				cm_refcnt;
544 	kmutex_t			cm_lock;
545 	kcondvar_t			cm_cv;
546 	crypto_session_data_t		**cm_session_table;
547 	uint_t				cm_session_table_count;
548 	kcf_provider_desc_t		**cm_provider_array;
549 	uint_t				cm_provider_count;
550 	crypto_provider_session_t	*cm_provider_session;
551 } crypto_minor_t;
552 
553 /* resource control framework handle used by /dev/crypto */
554 extern rctl_hndl_t rc_project_crypto_mem;
555 /*
556  * Return codes for internal functions
557  */
558 #define	KCF_SUCCESS		0x0	/* Successful call */
559 #define	KCF_INVALID_MECH_NUMBER	0x1	/* invalid mechanism number */
560 #define	KCF_INVALID_MECH_NAME	0x2	/* invalid mechanism name */
561 #define	KCF_INVALID_MECH_CLASS	0x3	/* invalid mechanism class */
562 #define	KCF_MECH_TAB_FULL	0x4	/* Need more room in the mech tabs. */
563 #define	KCF_INVALID_INDX	((ushort_t)-1)
564 
565 /*
566  * kCF internal mechanism and function group for tracking RNG providers.
567  */
568 #define	SUN_RANDOM		"random"
569 #define	CRYPTO_FG_RANDOM	0x80000000	/* generate_random() */
570 
571 /*
572  * Wrappers for ops vectors. In the wrapper definitions below, the pd
573  * argument always corresponds to a pointer to a provider descriptor
574  * of type kcf_prov_desc_t.
575  */
576 
577 #define	KCF_PROV_CONTROL_OPS(pd)	((pd)->pd_ops_vector->co_control_ops)
578 #define	KCF_PROV_CTX_OPS(pd)		((pd)->pd_ops_vector->co_ctx_ops)
579 #define	KCF_PROV_DIGEST_OPS(pd)		((pd)->pd_ops_vector->co_digest_ops)
580 #define	KCF_PROV_CIPHER_OPS(pd)		((pd)->pd_ops_vector->co_cipher_ops)
581 #define	KCF_PROV_MAC_OPS(pd)		((pd)->pd_ops_vector->co_mac_ops)
582 #define	KCF_PROV_SIGN_OPS(pd)		((pd)->pd_ops_vector->co_sign_ops)
583 #define	KCF_PROV_VERIFY_OPS(pd)		((pd)->pd_ops_vector->co_verify_ops)
584 #define	KCF_PROV_DUAL_OPS(pd)		((pd)->pd_ops_vector->co_dual_ops)
585 #define	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) \
586 	((pd)->pd_ops_vector->co_dual_cipher_mac_ops)
587 #define	KCF_PROV_RANDOM_OPS(pd)		((pd)->pd_ops_vector->co_random_ops)
588 #define	KCF_PROV_SESSION_OPS(pd)	((pd)->pd_ops_vector->co_session_ops)
589 #define	KCF_PROV_OBJECT_OPS(pd)		((pd)->pd_ops_vector->co_object_ops)
590 #define	KCF_PROV_KEY_OPS(pd)		((pd)->pd_ops_vector->co_key_ops)
591 #define	KCF_PROV_PROVIDER_OPS(pd)	((pd)->pd_ops_vector->co_provider_ops)
592 #define	KCF_PROV_MECH_OPS(pd)		((pd)->pd_ops_vector->co_mech_ops)
593 #define	KCF_PROV_NOSTORE_KEY_OPS(pd)	\
594 	((pd)->pd_ops_vector->co_nostore_key_ops)
595 #define	KCF_PROV_FIPS140_OPS(pd)	((pd)->pd_ops_vector->co_fips140_ops)
596 #define	KCF_PROV_PROVMGMT_OPS(pd)	((pd)->pd_ops_vector->co_provider_ops)
597 
598 /*
599  * Wrappers for crypto_control_ops(9S) entry points.
600  */
601 
602 #define	KCF_PROV_STATUS(pd, status) ( \
603 	(KCF_PROV_CONTROL_OPS(pd) && \
604 	KCF_PROV_CONTROL_OPS(pd)->provider_status) ? \
605 	KCF_PROV_CONTROL_OPS(pd)->provider_status( \
606 	    (pd)->pd_prov_handle, status) : \
607 	CRYPTO_NOT_SUPPORTED)
608 
609 /*
610  * Wrappers for crypto_ctx_ops(9S) entry points.
611  */
612 
613 #define	KCF_PROV_CREATE_CTX_TEMPLATE(pd, mech, key, template, size, req) ( \
614 	(KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->create_ctx_template) ? \
615 	KCF_PROV_CTX_OPS(pd)->create_ctx_template( \
616 	    (pd)->pd_prov_handle, mech, key, template, size, req) : \
617 	CRYPTO_NOT_SUPPORTED)
618 
619 #define	KCF_PROV_FREE_CONTEXT(pd, ctx) ( \
620 	(KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->free_context) ? \
621 	KCF_PROV_CTX_OPS(pd)->free_context(ctx) : CRYPTO_NOT_SUPPORTED)
622 
623 #define	KCF_PROV_COPYIN_MECH(pd, umech, kmech, errorp, mode) ( \
624 	(KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyin_mechanism) ? \
625 	KCF_PROV_MECH_OPS(pd)->copyin_mechanism( \
626 	    (pd)->pd_prov_handle, umech, kmech, errorp, mode) : \
627 	CRYPTO_NOT_SUPPORTED)
628 
629 #define	KCF_PROV_COPYOUT_MECH(pd, kmech, umech, errorp, mode) ( \
630 	(KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyout_mechanism) ? \
631 	KCF_PROV_MECH_OPS(pd)->copyout_mechanism( \
632 	    (pd)->pd_prov_handle, kmech, umech, errorp, mode) : \
633 	CRYPTO_NOT_SUPPORTED)
634 
635 #define	KCF_PROV_FREE_MECH(pd, prov_mech) ( \
636 	(KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->free_mechanism) ? \
637 	KCF_PROV_MECH_OPS(pd)->free_mechanism( \
638 	    (pd)->pd_prov_handle, prov_mech) : CRYPTO_NOT_SUPPORTED)
639 
640 /*
641  * Wrappers for crypto_digest_ops(9S) entry points.
642  */
643 
644 #define	KCF_PROV_DIGEST_INIT(pd, ctx, mech, req) ( \
645 	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_init) ? \
646 	KCF_PROV_DIGEST_OPS(pd)->digest_init(ctx, mech, req) : \
647 	CRYPTO_NOT_SUPPORTED)
648 
649 /*
650  * The _ (underscore) in _digest is needed to avoid replacing the
651  * function digest().
652  */
653 #define	KCF_PROV_DIGEST(pd, ctx, data, _digest, req) ( \
654 	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest) ? \
655 	KCF_PROV_DIGEST_OPS(pd)->digest(ctx, data, _digest, req) : \
656 	CRYPTO_NOT_SUPPORTED)
657 
658 #define	KCF_PROV_DIGEST_UPDATE(pd, ctx, data, req) ( \
659 	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_update) ? \
660 	KCF_PROV_DIGEST_OPS(pd)->digest_update(ctx, data, req) : \
661 	CRYPTO_NOT_SUPPORTED)
662 
663 #define	KCF_PROV_DIGEST_KEY(pd, ctx, key, req) ( \
664 	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_key) ? \
665 	KCF_PROV_DIGEST_OPS(pd)->digest_key(ctx, key, req) : \
666 	CRYPTO_NOT_SUPPORTED)
667 
668 #define	KCF_PROV_DIGEST_FINAL(pd, ctx, digest, req) ( \
669 	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_final) ? \
670 	KCF_PROV_DIGEST_OPS(pd)->digest_final(ctx, digest, req) : \
671 	CRYPTO_NOT_SUPPORTED)
672 
673 #define	KCF_PROV_DIGEST_ATOMIC(pd, session, mech, data, digest, req) ( \
674 	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_atomic) ? \
675 	KCF_PROV_DIGEST_OPS(pd)->digest_atomic( \
676 	    (pd)->pd_prov_handle, session, mech, data, digest, req) : \
677 	CRYPTO_NOT_SUPPORTED)
678 
679 /*
680  * Wrappers for crypto_cipher_ops(9S) entry points.
681  */
682 
683 #define	KCF_PROV_ENCRYPT_INIT(pd, ctx, mech, key, template, req) ( \
684 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_init) ? \
685 	KCF_PROV_CIPHER_OPS(pd)->encrypt_init(ctx, mech, key, template, \
686 	    req) : \
687 	CRYPTO_NOT_SUPPORTED)
688 
689 #define	KCF_PROV_ENCRYPT(pd, ctx, plaintext, ciphertext, req) ( \
690 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt) ? \
691 	KCF_PROV_CIPHER_OPS(pd)->encrypt(ctx, plaintext, ciphertext, req) : \
692 	CRYPTO_NOT_SUPPORTED)
693 
694 #define	KCF_PROV_ENCRYPT_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \
695 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_update) ? \
696 	KCF_PROV_CIPHER_OPS(pd)->encrypt_update(ctx, plaintext, \
697 	    ciphertext, req) : \
698 	CRYPTO_NOT_SUPPORTED)
699 
700 #define	KCF_PROV_ENCRYPT_FINAL(pd, ctx, ciphertext, req) ( \
701 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_final) ? \
702 	KCF_PROV_CIPHER_OPS(pd)->encrypt_final(ctx, ciphertext, req) : \
703 	CRYPTO_NOT_SUPPORTED)
704 
705 #define	KCF_PROV_ENCRYPT_ATOMIC(pd, session, mech, key, plaintext, ciphertext, \
706 	    template, req) ( \
707 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic) ? \
708 	KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic( \
709 	    (pd)->pd_prov_handle, session, mech, key, plaintext, ciphertext, \
710 	    template, req) : \
711 	CRYPTO_NOT_SUPPORTED)
712 
713 #define	KCF_PROV_DECRYPT_INIT(pd, ctx, mech, key, template, req) ( \
714 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_init) ? \
715 	KCF_PROV_CIPHER_OPS(pd)->decrypt_init(ctx, mech, key, template, \
716 	    req) : \
717 	CRYPTO_NOT_SUPPORTED)
718 
719 #define	KCF_PROV_DECRYPT(pd, ctx, ciphertext, plaintext, req) ( \
720 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt) ? \
721 	KCF_PROV_CIPHER_OPS(pd)->decrypt(ctx, ciphertext, plaintext, req) : \
722 	CRYPTO_NOT_SUPPORTED)
723 
724 #define	KCF_PROV_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \
725 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_update) ? \
726 	KCF_PROV_CIPHER_OPS(pd)->decrypt_update(ctx, ciphertext, \
727 	    plaintext, req) : \
728 	CRYPTO_NOT_SUPPORTED)
729 
730 #define	KCF_PROV_DECRYPT_FINAL(pd, ctx, plaintext, req) ( \
731 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_final) ? \
732 	KCF_PROV_CIPHER_OPS(pd)->decrypt_final(ctx, plaintext, req) : \
733 	CRYPTO_NOT_SUPPORTED)
734 
735 #define	KCF_PROV_DECRYPT_ATOMIC(pd, session, mech, key, ciphertext, plaintext, \
736 	    template, req) ( \
737 	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic) ? \
738 	KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic( \
739 	    (pd)->pd_prov_handle, session, mech, key, ciphertext, plaintext, \
740 	    template, req) : \
741 	CRYPTO_NOT_SUPPORTED)
742 
743 /*
744  * Wrappers for crypto_mac_ops(9S) entry points.
745  */
746 
747 #define	KCF_PROV_MAC_INIT(pd, ctx, mech, key, template, req) ( \
748 	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_init) ? \
749 	KCF_PROV_MAC_OPS(pd)->mac_init(ctx, mech, key, template, req) \
750 	: CRYPTO_NOT_SUPPORTED)
751 
752 /*
753  * The _ (underscore) in _mac is needed to avoid replacing the
754  * function mac().
755  */
756 #define	KCF_PROV_MAC(pd, ctx, data, _mac, req) ( \
757 	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac) ? \
758 	KCF_PROV_MAC_OPS(pd)->mac(ctx, data, _mac, req) : \
759 	CRYPTO_NOT_SUPPORTED)
760 
761 #define	KCF_PROV_MAC_UPDATE(pd, ctx, data, req) ( \
762 	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_update) ? \
763 	KCF_PROV_MAC_OPS(pd)->mac_update(ctx, data, req) : \
764 	CRYPTO_NOT_SUPPORTED)
765 
766 #define	KCF_PROV_MAC_FINAL(pd, ctx, mac, req) ( \
767 	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_final) ? \
768 	KCF_PROV_MAC_OPS(pd)->mac_final(ctx, mac, req) : \
769 	CRYPTO_NOT_SUPPORTED)
770 
771 #define	KCF_PROV_MAC_ATOMIC(pd, session, mech, key, data, mac, template, \
772 	    req) ( \
773 	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_atomic) ? \
774 	KCF_PROV_MAC_OPS(pd)->mac_atomic( \
775 	    (pd)->pd_prov_handle, session, mech, key, data, mac, template, \
776 	    req) : \
777 	CRYPTO_NOT_SUPPORTED)
778 
779 #define	KCF_PROV_MAC_VERIFY_ATOMIC(pd, session, mech, key, data, mac, \
780 	    template, req) ( \
781 	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_verify_atomic) ? \
782 	KCF_PROV_MAC_OPS(pd)->mac_verify_atomic( \
783 	    (pd)->pd_prov_handle, session, mech, key, data, mac, template, \
784 	    req) : \
785 	CRYPTO_NOT_SUPPORTED)
786 
787 /*
788  * Wrappers for crypto_sign_ops(9S) entry points.
789  */
790 
791 #define	KCF_PROV_SIGN_INIT(pd, ctx, mech, key, template, req) ( \
792 	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_init) ? \
793 	KCF_PROV_SIGN_OPS(pd)->sign_init( \
794 	    ctx, mech, key, template, req) : CRYPTO_NOT_SUPPORTED)
795 
796 #define	KCF_PROV_SIGN(pd, ctx, data, sig, req) ( \
797 	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign) ? \
798 	KCF_PROV_SIGN_OPS(pd)->sign(ctx, data, sig, req) : \
799 	CRYPTO_NOT_SUPPORTED)
800 
801 #define	KCF_PROV_SIGN_UPDATE(pd, ctx, data, req) ( \
802 	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_update) ? \
803 	KCF_PROV_SIGN_OPS(pd)->sign_update(ctx, data, req) : \
804 	CRYPTO_NOT_SUPPORTED)
805 
806 #define	KCF_PROV_SIGN_FINAL(pd, ctx, sig, req) ( \
807 	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_final) ? \
808 	KCF_PROV_SIGN_OPS(pd)->sign_final(ctx, sig, req) : \
809 	CRYPTO_NOT_SUPPORTED)
810 
811 #define	KCF_PROV_SIGN_ATOMIC(pd, session, mech, key, data, template, \
812 	    sig, req) ( \
813 	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_atomic) ? \
814 	KCF_PROV_SIGN_OPS(pd)->sign_atomic( \
815 	    (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
816 	    req) : CRYPTO_NOT_SUPPORTED)
817 
818 #define	KCF_PROV_SIGN_RECOVER_INIT(pd, ctx, mech, key, template, \
819 	    req) ( \
820 	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover_init) ? \
821 	KCF_PROV_SIGN_OPS(pd)->sign_recover_init(ctx, mech, key, template, \
822 	    req) : CRYPTO_NOT_SUPPORTED)
823 
824 #define	KCF_PROV_SIGN_RECOVER(pd, ctx, data, sig, req) ( \
825 	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover) ? \
826 	KCF_PROV_SIGN_OPS(pd)->sign_recover(ctx, data, sig, req) : \
827 	CRYPTO_NOT_SUPPORTED)
828 
829 #define	KCF_PROV_SIGN_RECOVER_ATOMIC(pd, session, mech, key, data, template, \
830 	    sig, req) ( \
831 	(KCF_PROV_SIGN_OPS(pd) && \
832 	KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic) ? \
833 	KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic( \
834 	    (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
835 	    req) : CRYPTO_NOT_SUPPORTED)
836 
837 /*
838  * Wrappers for crypto_verify_ops(9S) entry points.
839  */
840 
841 #define	KCF_PROV_VERIFY_INIT(pd, ctx, mech, key, template, req) ( \
842 	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_init) ? \
843 	KCF_PROV_VERIFY_OPS(pd)->verify_init(ctx, mech, key, template, \
844 	    req) : CRYPTO_NOT_SUPPORTED)
845 
846 #define	KCF_PROV_VERIFY(pd, ctx, data, sig, req) ( \
847 	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify) ? \
848 	KCF_PROV_VERIFY_OPS(pd)->verify(ctx, data, sig, req) : \
849 	CRYPTO_NOT_SUPPORTED)
850 
851 #define	KCF_PROV_VERIFY_UPDATE(pd, ctx, data, req) ( \
852 	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_update) ? \
853 	KCF_PROV_VERIFY_OPS(pd)->verify_update(ctx, data, req) : \
854 	CRYPTO_NOT_SUPPORTED)
855 
856 #define	KCF_PROV_VERIFY_FINAL(pd, ctx, sig, req) ( \
857 	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_final) ? \
858 	KCF_PROV_VERIFY_OPS(pd)->verify_final(ctx, sig, req) : \
859 	CRYPTO_NOT_SUPPORTED)
860 
861 #define	KCF_PROV_VERIFY_ATOMIC(pd, session, mech, key, data, template, sig, \
862 	    req) ( \
863 	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_atomic) ? \
864 	KCF_PROV_VERIFY_OPS(pd)->verify_atomic( \
865 	    (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
866 	    req) : CRYPTO_NOT_SUPPORTED)
867 
868 #define	KCF_PROV_VERIFY_RECOVER_INIT(pd, ctx, mech, key, template, \
869 	    req) ( \
870 	(KCF_PROV_VERIFY_OPS(pd) && \
871 	KCF_PROV_VERIFY_OPS(pd)->verify_recover_init) ? \
872 	KCF_PROV_VERIFY_OPS(pd)->verify_recover_init(ctx, mech, key, \
873 	    template, req) : CRYPTO_NOT_SUPPORTED)
874 
875 /* verify_recover() CSPI routine has different argument order than verify() */
876 #define	KCF_PROV_VERIFY_RECOVER(pd, ctx, sig, data, req) ( \
877 	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_recover) ? \
878 	KCF_PROV_VERIFY_OPS(pd)->verify_recover(ctx, sig, data, req) : \
879 	CRYPTO_NOT_SUPPORTED)
880 
881 /*
882  * verify_recover_atomic() CSPI routine has different argument order
883  * than verify_atomic().
884  */
885 #define	KCF_PROV_VERIFY_RECOVER_ATOMIC(pd, session, mech, key, sig, \
886 	    template, data,  req) ( \
887 	(KCF_PROV_VERIFY_OPS(pd) && \
888 	KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic) ? \
889 	KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic( \
890 	    (pd)->pd_prov_handle, session, mech, key, sig, data, template, \
891 	    req) : CRYPTO_NOT_SUPPORTED)
892 
893 /*
894  * Wrappers for crypto_dual_ops(9S) entry points.
895  */
896 
897 #define	KCF_PROV_DIGEST_ENCRYPT_UPDATE(digest_ctx, encrypt_ctx, plaintext, \
898 	    ciphertext, req) ( \
899 	(KCF_PROV_DUAL_OPS(pd) && \
900 	KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update) ? \
901 	KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update( \
902 	    digest_ctx, encrypt_ctx, plaintext, ciphertext, req) : \
903 	CRYPTO_NOT_SUPPORTED)
904 
905 #define	KCF_PROV_DECRYPT_DIGEST_UPDATE(decrypt_ctx, digest_ctx, ciphertext, \
906 	    plaintext, req) ( \
907 	(KCF_PROV_DUAL_OPS(pd) && \
908 	KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update) ? \
909 	KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update( \
910 	    decrypt_ctx, digest_ctx, ciphertext, plaintext, req) : \
911 	CRYPTO_NOT_SUPPORTED)
912 
913 #define	KCF_PROV_SIGN_ENCRYPT_UPDATE(sign_ctx, encrypt_ctx, plaintext, \
914 	    ciphertext, req) ( \
915 	(KCF_PROV_DUAL_OPS(pd) && \
916 	KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update) ? \
917 	KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update( \
918 	    sign_ctx, encrypt_ctx, plaintext, ciphertext, req) : \
919 	CRYPTO_NOT_SUPPORTED)
920 
921 #define	KCF_PROV_DECRYPT_VERIFY_UPDATE(decrypt_ctx, verify_ctx, ciphertext, \
922 	    plaintext, req) ( \
923 	(KCF_PROV_DUAL_OPS(pd) && \
924 	KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update) ? \
925 	KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update( \
926 	    decrypt_ctx, verify_ctx, ciphertext, plaintext, req) : \
927 	CRYPTO_NOT_SUPPORTED)
928 
929 /*
930  * Wrappers for crypto_dual_cipher_mac_ops(9S) entry points.
931  */
932 
933 #define	KCF_PROV_ENCRYPT_MAC_INIT(pd, ctx, encr_mech, encr_key, mac_mech, \
934 	    mac_key, encr_ctx_template, mac_ctx_template, req) ( \
935 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
936 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init) ? \
937 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init( \
938 	    ctx, encr_mech, encr_key, mac_mech, mac_key, encr_ctx_template, \
939 	    mac_ctx_template, req) : \
940 	CRYPTO_NOT_SUPPORTED)
941 
942 #define	KCF_PROV_ENCRYPT_MAC(pd, ctx, plaintext, ciphertext, mac, req) ( \
943 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
944 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac) ? \
945 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac( \
946 	    ctx, plaintext, ciphertext, mac, req) : \
947 	CRYPTO_NOT_SUPPORTED)
948 
949 #define	KCF_PROV_ENCRYPT_MAC_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \
950 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
951 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update) ? \
952 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update( \
953 	    ctx, plaintext, ciphertext, req) : \
954 	CRYPTO_NOT_SUPPORTED)
955 
956 #define	KCF_PROV_ENCRYPT_MAC_FINAL(pd, ctx, ciphertext, mac, req) ( \
957 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
958 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final) ? \
959 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final( \
960 	    ctx, ciphertext, mac, req) : \
961 	CRYPTO_NOT_SUPPORTED)
962 
963 #define	KCF_PROV_ENCRYPT_MAC_ATOMIC(pd, session, encr_mech, encr_key, \
964 	    mac_mech, mac_key, plaintext, ciphertext, mac, \
965 	    encr_ctx_template, mac_ctx_template, req) ( \
966 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
967 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic) ? \
968 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic( \
969 	    (pd)->pd_prov_handle, session, encr_mech, encr_key, \
970 	    mac_mech, mac_key, plaintext, ciphertext, mac, \
971 	    encr_ctx_template, mac_ctx_template, req) : \
972 	CRYPTO_NOT_SUPPORTED)
973 
974 #define	KCF_PROV_MAC_DECRYPT_INIT(pd, ctx, mac_mech, mac_key, decr_mech, \
975 	    decr_key, mac_ctx_template, decr_ctx_template, req) ( \
976 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
977 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init) ? \
978 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init( \
979 	    ctx, mac_mech, mac_key, decr_mech, decr_key, mac_ctx_template, \
980 	    decr_ctx_template, req) : \
981 	CRYPTO_NOT_SUPPORTED)
982 
983 #define	KCF_PROV_MAC_DECRYPT(pd, ctx, ciphertext, mac, plaintext, req) ( \
984 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
985 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt) ? \
986 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt( \
987 	    ctx, ciphertext, mac, plaintext, req) : \
988 	CRYPTO_NOT_SUPPORTED)
989 
990 #define	KCF_PROV_MAC_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \
991 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
992 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update) ? \
993 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update( \
994 	    ctx, ciphertext, plaintext, req) : \
995 	CRYPTO_NOT_SUPPORTED)
996 
997 #define	KCF_PROV_MAC_DECRYPT_FINAL(pd, ctx, mac, plaintext, req) ( \
998 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
999 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final) ? \
1000 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final( \
1001 	    ctx, mac, plaintext, req) : \
1002 	CRYPTO_NOT_SUPPORTED)
1003 
1004 #define	KCF_PROV_MAC_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \
1005 	    decr_mech, decr_key, ciphertext, mac, plaintext, \
1006 	    mac_ctx_template, decr_ctx_template, req) ( \
1007 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
1008 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic) ? \
1009 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic( \
1010 	    (pd)->pd_prov_handle, session, mac_mech, mac_key, \
1011 	    decr_mech, decr_key, ciphertext, mac, plaintext, \
1012 	    mac_ctx_template, decr_ctx_template, req) : \
1013 	CRYPTO_NOT_SUPPORTED)
1014 
1015 #define	KCF_PROV_MAC_VERIFY_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \
1016 	    decr_mech, decr_key, ciphertext, mac, plaintext, \
1017 	    mac_ctx_template, decr_ctx_template, req) ( \
1018 	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
1019 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic \
1020 	    != NULL) ? \
1021 	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic( \
1022 	    (pd)->pd_prov_handle, session, mac_mech, mac_key, \
1023 	    decr_mech, decr_key, ciphertext, mac, plaintext, \
1024 	    mac_ctx_template, decr_ctx_template, req) : \
1025 	CRYPTO_NOT_SUPPORTED)
1026 
1027 /*
1028  * Wrappers for crypto_random_number_ops(9S) entry points.
1029  */
1030 
1031 #define	KCF_PROV_SEED_RANDOM(pd, session, buf, len, est, flags, req) ( \
1032 	(KCF_PROV_RANDOM_OPS(pd) && KCF_PROV_RANDOM_OPS(pd)->seed_random) ? \
1033 	KCF_PROV_RANDOM_OPS(pd)->seed_random((pd)->pd_prov_handle, \
1034 	    session, buf, len, est, flags, req) : CRYPTO_NOT_SUPPORTED)
1035 
1036 #define	KCF_PROV_GENERATE_RANDOM(pd, session, buf, len, req) ( \
1037 	(KCF_PROV_RANDOM_OPS(pd) && \
1038 	KCF_PROV_RANDOM_OPS(pd)->generate_random) ? \
1039 	KCF_PROV_RANDOM_OPS(pd)->generate_random((pd)->pd_prov_handle, \
1040 	    session, buf, len, req) : CRYPTO_NOT_SUPPORTED)
1041 
1042 /*
1043  * Wrappers for crypto_session_ops(9S) entry points.
1044  *
1045  * ops_pd is the provider descriptor that supplies the ops_vector.
1046  * pd is the descriptor that supplies the provider handle.
1047  * Only session open/close needs two handles.
1048  */
1049 
1050 #define	KCF_PROV_SESSION_OPEN(ops_pd, session, req, pd) ( \
1051 	(KCF_PROV_SESSION_OPS(ops_pd) && \
1052 	KCF_PROV_SESSION_OPS(ops_pd)->session_open) ? \
1053 	KCF_PROV_SESSION_OPS(ops_pd)->session_open((pd)->pd_prov_handle, \
1054 	    session, req) : CRYPTO_NOT_SUPPORTED)
1055 
1056 #define	KCF_PROV_SESSION_CLOSE(ops_pd, session, req, pd) ( \
1057 	(KCF_PROV_SESSION_OPS(ops_pd) && \
1058 	KCF_PROV_SESSION_OPS(ops_pd)->session_close) ? \
1059 	KCF_PROV_SESSION_OPS(ops_pd)->session_close((pd)->pd_prov_handle, \
1060 	    session, req) : CRYPTO_NOT_SUPPORTED)
1061 
1062 #define	KCF_PROV_SESSION_LOGIN(pd, session, user_type, pin, len, req) ( \
1063 	(KCF_PROV_SESSION_OPS(pd) && \
1064 	KCF_PROV_SESSION_OPS(pd)->session_login) ? \
1065 	KCF_PROV_SESSION_OPS(pd)->session_login((pd)->pd_prov_handle, \
1066 	    session, user_type, pin, len, req) : CRYPTO_NOT_SUPPORTED)
1067 
1068 #define	KCF_PROV_SESSION_LOGOUT(pd, session, req) ( \
1069 	(KCF_PROV_SESSION_OPS(pd) && \
1070 	KCF_PROV_SESSION_OPS(pd)->session_logout) ? \
1071 	KCF_PROV_SESSION_OPS(pd)->session_logout((pd)->pd_prov_handle, \
1072 	    session, req) : CRYPTO_NOT_SUPPORTED)
1073 
1074 /*
1075  * Wrappers for crypto_object_ops(9S) entry points.
1076  */
1077 
1078 #define	KCF_PROV_OBJECT_CREATE(pd, session, template, count, object, req) ( \
1079 	(KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_create) ? \
1080 	KCF_PROV_OBJECT_OPS(pd)->object_create((pd)->pd_prov_handle, \
1081 	    session, template, count, object, req) : CRYPTO_NOT_SUPPORTED)
1082 
1083 #define	KCF_PROV_OBJECT_COPY(pd, session, object, template, count, \
1084 	    new_object, req) ( \
1085 	(KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_copy) ? \
1086 	KCF_PROV_OBJECT_OPS(pd)->object_copy((pd)->pd_prov_handle, \
1087 	session, object, template, count, new_object, req) : \
1088 	    CRYPTO_NOT_SUPPORTED)
1089 
1090 #define	KCF_PROV_OBJECT_DESTROY(pd, session, object, req) ( \
1091 	(KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_destroy) ? \
1092 	KCF_PROV_OBJECT_OPS(pd)->object_destroy((pd)->pd_prov_handle, \
1093 	    session, object, req) : CRYPTO_NOT_SUPPORTED)
1094 
1095 #define	KCF_PROV_OBJECT_GET_SIZE(pd, session, object, size, req) ( \
1096 	(KCF_PROV_OBJECT_OPS(pd) && \
1097 	KCF_PROV_OBJECT_OPS(pd)->object_get_size) ? \
1098 	KCF_PROV_OBJECT_OPS(pd)->object_get_size((pd)->pd_prov_handle, \
1099 	    session, object, size, req) : CRYPTO_NOT_SUPPORTED)
1100 
1101 #define	KCF_PROV_OBJECT_GET_ATTRIBUTE_VALUE(pd, session, object, template, \
1102 	    count, req) ( \
1103 	(KCF_PROV_OBJECT_OPS(pd) && \
1104 	KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value) ? \
1105 	KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value( \
1106 	(pd)->pd_prov_handle, session, object, template, count, req) : \
1107 	    CRYPTO_NOT_SUPPORTED)
1108 
1109 #define	KCF_PROV_OBJECT_SET_ATTRIBUTE_VALUE(pd, session, object, template, \
1110 	    count, req) ( \
1111 	(KCF_PROV_OBJECT_OPS(pd) && \
1112 	KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value) ? \
1113 	KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value( \
1114 	(pd)->pd_prov_handle, session, object, template, count, req) : \
1115 	    CRYPTO_NOT_SUPPORTED)
1116 
1117 #define	KCF_PROV_OBJECT_FIND_INIT(pd, session, template, count, ppriv, \
1118 	    req) ( \
1119 	(KCF_PROV_OBJECT_OPS(pd) && \
1120 	KCF_PROV_OBJECT_OPS(pd)->object_find_init) ? \
1121 	KCF_PROV_OBJECT_OPS(pd)->object_find_init((pd)->pd_prov_handle, \
1122 	session, template, count, ppriv, req) : CRYPTO_NOT_SUPPORTED)
1123 
1124 #define	KCF_PROV_OBJECT_FIND(pd, ppriv, objects, max_objects, object_count, \
1125 	    req) ( \
1126 	(KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_find) ? \
1127 	KCF_PROV_OBJECT_OPS(pd)->object_find( \
1128 	(pd)->pd_prov_handle, ppriv, objects, max_objects, object_count, \
1129 	req) : CRYPTO_NOT_SUPPORTED)
1130 
1131 #define	KCF_PROV_OBJECT_FIND_FINAL(pd, ppriv, req) ( \
1132 	(KCF_PROV_OBJECT_OPS(pd) && \
1133 	KCF_PROV_OBJECT_OPS(pd)->object_find_final) ? \
1134 	KCF_PROV_OBJECT_OPS(pd)->object_find_final( \
1135 	    (pd)->pd_prov_handle, ppriv, req) : CRYPTO_NOT_SUPPORTED)
1136 
1137 /*
1138  * Wrappers for crypto_key_ops(9S) entry points.
1139  */
1140 
1141 #define	KCF_PROV_KEY_GENERATE(pd, session, mech, template, count, object, \
1142 	    req) ( \
1143 	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate) ? \
1144 	KCF_PROV_KEY_OPS(pd)->key_generate((pd)->pd_prov_handle, \
1145 	    session, mech, template, count, object, req) : \
1146 	CRYPTO_NOT_SUPPORTED)
1147 
1148 #define	KCF_PROV_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \
1149 	    pub_count, priv_template, priv_count, pub_key, priv_key, req) ( \
1150 	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate_pair) ? \
1151 	KCF_PROV_KEY_OPS(pd)->key_generate_pair((pd)->pd_prov_handle, \
1152 	    session, mech, pub_template, pub_count, priv_template, \
1153 	    priv_count, pub_key, priv_key, req) : \
1154 	CRYPTO_NOT_SUPPORTED)
1155 
1156 #define	KCF_PROV_KEY_WRAP(pd, session, mech, wrapping_key, key, wrapped_key, \
1157 	    wrapped_key_len, req) ( \
1158 	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_wrap) ? \
1159 	KCF_PROV_KEY_OPS(pd)->key_wrap((pd)->pd_prov_handle, \
1160 	    session, mech, wrapping_key, key, wrapped_key, wrapped_key_len, \
1161 	    req) : \
1162 	CRYPTO_NOT_SUPPORTED)
1163 
1164 #define	KCF_PROV_KEY_UNWRAP(pd, session, mech, unwrapping_key, wrapped_key, \
1165 	    wrapped_key_len, template, count, key, req) ( \
1166 	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_unwrap) ? \
1167 	KCF_PROV_KEY_OPS(pd)->key_unwrap((pd)->pd_prov_handle, \
1168 	    session, mech, unwrapping_key, wrapped_key, wrapped_key_len, \
1169 	    template, count, key, req) : \
1170 	CRYPTO_NOT_SUPPORTED)
1171 
1172 #define	KCF_PROV_KEY_DERIVE(pd, session, mech, base_key, template, count, \
1173 	    key, req) ( \
1174 	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_derive) ? \
1175 	KCF_PROV_KEY_OPS(pd)->key_derive((pd)->pd_prov_handle, \
1176 	    session, mech, base_key, template, count, key, req) : \
1177 	CRYPTO_NOT_SUPPORTED)
1178 
1179 #define	KCF_PROV_KEY_CHECK(pd, mech, key) ( \
1180 	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_check) ? \
1181 	KCF_PROV_KEY_OPS(pd)->key_check((pd)->pd_prov_handle, mech, key) : \
1182 	CRYPTO_NOT_SUPPORTED)
1183 
1184 /*
1185  * Wrappers for crypto_provider_management_ops(9S) entry points.
1186  *
1187  * ops_pd is the provider descriptor that supplies the ops_vector.
1188  * pd is the descriptor that supplies the provider handle.
1189  * Only ext_info needs two handles.
1190  */
1191 
1192 #define	KCF_PROV_EXT_INFO(ops_pd, provext_info, req, pd) ( \
1193 	(KCF_PROV_PROVIDER_OPS(ops_pd) && \
1194 	KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info) ? \
1195 	KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info((pd)->pd_prov_handle, \
1196 	    provext_info, req) : CRYPTO_NOT_SUPPORTED)
1197 
1198 #define	KCF_PROV_INIT_TOKEN(pd, pin, pin_len, label, req) ( \
1199 	(KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_token) ? \
1200 	KCF_PROV_PROVIDER_OPS(pd)->init_token((pd)->pd_prov_handle, \
1201 	    pin, pin_len, label, req) : CRYPTO_NOT_SUPPORTED)
1202 
1203 #define	KCF_PROV_INIT_PIN(pd, session, pin, pin_len, req) ( \
1204 	(KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_pin) ? \
1205 	KCF_PROV_PROVIDER_OPS(pd)->init_pin((pd)->pd_prov_handle, \
1206 	    session, pin, pin_len, req) : CRYPTO_NOT_SUPPORTED)
1207 
1208 #define	KCF_PROV_SET_PIN(pd, session, old_pin, old_len, new_pin, new_len, \
1209 	    req) ( \
1210 	(KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->set_pin) ? \
1211 	KCF_PROV_PROVIDER_OPS(pd)->set_pin((pd)->pd_prov_handle, \
1212 	session, old_pin, old_len, new_pin, new_len, req) : \
1213 	    CRYPTO_NOT_SUPPORTED)
1214 
1215 /*
1216  * Wrappers for crypto_nostore_key_ops(9S) entry points.
1217  */
1218 
1219 #define	KCF_PROV_NOSTORE_KEY_GENERATE(pd, session, mech, template, count, \
1220 	    out_template, out_count, req) ( \
1221 	(KCF_PROV_NOSTORE_KEY_OPS(pd) && \
1222 	    KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate) ? \
1223 	KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate( \
1224 	    (pd)->pd_prov_handle, session, mech, template, count, \
1225 	    out_template, out_count, req) : CRYPTO_NOT_SUPPORTED)
1226 
1227 #define	KCF_PROV_NOSTORE_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \
1228 	    pub_count, priv_template, priv_count, out_pub_template, \
1229 	    out_pub_count, out_priv_template, out_priv_count, req) ( \
1230 	(KCF_PROV_NOSTORE_KEY_OPS(pd) && \
1231 	    KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair) ? \
1232 	KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair( \
1233 	    (pd)->pd_prov_handle, session, mech, pub_template, pub_count, \
1234 	    priv_template, priv_count, out_pub_template, out_pub_count, \
1235 	    out_priv_template, out_priv_count, req) : CRYPTO_NOT_SUPPORTED)
1236 
1237 #define	KCF_PROV_NOSTORE_KEY_DERIVE(pd, session, mech, base_key, template, \
1238 	    count, out_template, out_count, req) ( \
1239 	(KCF_PROV_NOSTORE_KEY_OPS(pd) && \
1240 	    KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive) ? \
1241 	KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive( \
1242 	    (pd)->pd_prov_handle, session, mech, base_key, template, count, \
1243 	    out_template, out_count, req) : CRYPTO_NOT_SUPPORTED)
1244 
1245 /*
1246  * The following routines are exported by the kcf module (/kernel/misc/kcf)
1247  * to the crypto and cryptoadmin modules.
1248  */
1249 
1250 /* Digest/mac/cipher entry points that take a provider descriptor and session */
1251 extern int crypto_digest_single(crypto_context_t, crypto_data_t *,
1252     crypto_data_t *, crypto_call_req_t *);
1253 
1254 extern int crypto_mac_single(crypto_context_t, crypto_data_t *,
1255     crypto_data_t *, crypto_call_req_t *);
1256 
1257 extern int crypto_encrypt_single(crypto_context_t, crypto_data_t *,
1258     crypto_data_t *, crypto_call_req_t *);
1259 
1260 extern int crypto_decrypt_single(crypto_context_t, crypto_data_t *,
1261     crypto_data_t *, crypto_call_req_t *);
1262 
1263 
1264 /* Other private digest/mac/cipher entry points not exported through k-API */
1265 extern int crypto_digest_key_prov(crypto_context_t, crypto_key_t *,
1266     crypto_call_req_t *);
1267 
1268 /* Private sign entry points exported by KCF */
1269 extern int crypto_sign_single(crypto_context_t, crypto_data_t *,
1270     crypto_data_t *, crypto_call_req_t *);
1271 
1272 extern int crypto_sign_recover_single(crypto_context_t, crypto_data_t *,
1273     crypto_data_t *, crypto_call_req_t *);
1274 
1275 /* Private verify entry points exported by KCF */
1276 extern int crypto_verify_single(crypto_context_t, crypto_data_t *,
1277     crypto_data_t *, crypto_call_req_t *);
1278 
1279 extern int crypto_verify_recover_single(crypto_context_t, crypto_data_t *,
1280     crypto_data_t *, crypto_call_req_t *);
1281 
1282 /* Private dual operations entry points exported by KCF */
1283 extern int crypto_digest_encrypt_update(crypto_context_t, crypto_context_t,
1284     crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
1285 extern int crypto_decrypt_digest_update(crypto_context_t, crypto_context_t,
1286     crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
1287 extern int crypto_sign_encrypt_update(crypto_context_t, crypto_context_t,
1288     crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
1289 extern int crypto_decrypt_verify_update(crypto_context_t, crypto_context_t,
1290     crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
1291 
1292 /* Random Number Generation */
1293 int crypto_seed_random(crypto_provider_handle_t provider, uchar_t *buf,
1294     size_t len, crypto_call_req_t *req);
1295 int crypto_generate_random(crypto_provider_handle_t provider, uchar_t *buf,
1296     size_t len, crypto_call_req_t *req);
1297 
1298 /* Provider Management */
1299 int crypto_get_provider_info(crypto_provider_id_t id,
1300     crypto_provider_info_t **info, crypto_call_req_t *req);
1301 int crypto_get_provider_mechanisms(crypto_minor_t *, crypto_provider_id_t id,
1302     uint_t *count, crypto_mech_name_t **list);
1303 int crypto_init_token(crypto_provider_handle_t provider, char *pin,
1304     size_t pin_len, char *label, crypto_call_req_t *);
1305 int crypto_init_pin(crypto_provider_handle_t provider, char *pin,
1306     size_t pin_len, crypto_call_req_t *req);
1307 int crypto_set_pin(crypto_provider_handle_t provider, char *old_pin,
1308     size_t old_len, char *new_pin, size_t new_len, crypto_call_req_t *req);
1309 void crypto_free_provider_list(crypto_provider_entry_t *list, uint_t count);
1310 void crypto_free_provider_info(crypto_provider_info_t *info);
1311 
1312 /* Administrative */
1313 int crypto_get_dev_list(uint_t *count, crypto_dev_list_entry_t **list);
1314 int crypto_get_soft_list(uint_t *count, char **list, size_t *len);
1315 int crypto_get_dev_info(char *name, uint_t instance, uint_t *count,
1316     crypto_mech_name_t **list);
1317 int crypto_get_soft_info(caddr_t name, uint_t *count,
1318     crypto_mech_name_t **list);
1319 int crypto_load_dev_disabled(char *name, uint_t instance, uint_t count,
1320     crypto_mech_name_t *list);
1321 int crypto_load_soft_disabled(caddr_t name, uint_t count,
1322     crypto_mech_name_t *list);
1323 int crypto_unload_soft_module(caddr_t path);
1324 int crypto_load_soft_config(caddr_t name, uint_t count,
1325     crypto_mech_name_t *list);
1326 int crypto_load_door(uint_t did);
1327 void crypto_free_mech_list(crypto_mech_name_t *list, uint_t count);
1328 void crypto_free_dev_list(crypto_dev_list_entry_t *list, uint_t count);
1329 extern void kcf_activate();
1330 
1331 /* Miscellaneous */
1332 int crypto_get_mechanism_number(caddr_t name, crypto_mech_type_t *number);
1333 int crypto_get_function_list(crypto_provider_id_t id,
1334     crypto_function_list_t **list, int kmflag);
1335 void crypto_free_function_list(crypto_function_list_t *list);
1336 int crypto_build_permitted_mech_names(kcf_provider_desc_t *,
1337     crypto_mech_name_t **, uint_t *, int);
1338 extern void kcf_init_mech_tabs(void);
1339 extern int kcf_add_mech_provider(short, kcf_provider_desc_t *,
1340     kcf_prov_mech_desc_t **);
1341 extern void kcf_remove_mech_provider(char *, kcf_provider_desc_t *);
1342 extern int kcf_get_mech_entry(crypto_mech_type_t, kcf_mech_entry_t **);
1343 extern kcf_provider_desc_t *kcf_alloc_provider_desc(crypto_provider_info_t *);
1344 extern void kcf_free_provider_desc(kcf_provider_desc_t *);
1345 extern void kcf_soft_config_init(void);
1346 extern int get_sw_provider_for_mech(crypto_mech_name_t, char **);
1347 extern crypto_mech_type_t crypto_mech2id_common(char *, boolean_t);
1348 extern void undo_register_provider(kcf_provider_desc_t *, boolean_t);
1349 extern void redo_register_provider(kcf_provider_desc_t *);
1350 extern void kcf_rnd_init();
1351 extern boolean_t kcf_rngprov_check(void);
1352 extern int kcf_rnd_get_pseudo_bytes(uint8_t *, size_t);
1353 extern int kcf_rnd_get_bytes(uint8_t *, size_t, boolean_t);
1354 extern int random_add_pseudo_entropy(uint8_t *, size_t, uint_t);
1355 extern void kcf_rnd_chpoll(short, int, short *, struct pollhead **);
1356 extern void kcf_rnd_schedule_timeout(boolean_t);
1357 extern int crypto_uio_data(crypto_data_t *, uchar_t *, int, cmd_type_t,
1358     void *, void (*update)());
1359 extern int crypto_mblk_data(crypto_data_t *, uchar_t *, int, cmd_type_t,
1360     void *, void (*update)());
1361 extern int crypto_put_output_data(uchar_t *, crypto_data_t *, int);
1362 extern int crypto_get_input_data(crypto_data_t *, uchar_t **, uchar_t *);
1363 extern int crypto_copy_key_to_ctx(crypto_key_t *, crypto_key_t **, size_t *,
1364     int kmflag);
1365 extern int crypto_digest_data(crypto_data_t *, void *, uchar_t *,
1366     void (*update)(), void (*final)(), uchar_t);
1367 extern int crypto_update_iov(void *, crypto_data_t *, crypto_data_t *,
1368     int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
1369     void (*copy_block)(uint8_t *, uint64_t *));
1370 extern int crypto_update_uio(void *, crypto_data_t *, crypto_data_t *,
1371     int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
1372     void (*copy_block)(uint8_t *, uint64_t *));
1373 extern int crypto_update_mp(void *, crypto_data_t *, crypto_data_t *,
1374     int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
1375     void (*copy_block)(uint8_t *, uint64_t *));
1376 extern int crypto_get_key_attr(crypto_key_t *, crypto_attr_type_t, uchar_t **,
1377     ssize_t *);
1378 
1379 /* Access to the provider's table */
1380 extern void kcf_prov_tab_init(void);
1381 extern int kcf_prov_tab_add_provider(kcf_provider_desc_t *);
1382 extern int kcf_prov_tab_rem_provider(crypto_provider_id_t);
1383 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_name(char *);
1384 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_dev(char *, uint_t);
1385 extern int kcf_get_hw_prov_tab(uint_t *, kcf_provider_desc_t ***, int,
1386     char *, uint_t, boolean_t);
1387 extern int kcf_get_slot_list(uint_t *, kcf_provider_desc_t ***, boolean_t);
1388 extern void kcf_free_provider_tab(uint_t, kcf_provider_desc_t **);
1389 extern kcf_provider_desc_t *kcf_prov_tab_lookup(crypto_provider_id_t);
1390 extern int kcf_get_sw_prov(crypto_mech_type_t, kcf_provider_desc_t **,
1391     kcf_mech_entry_t **, boolean_t);
1392 
1393 extern kmutex_t prov_tab_mutex;
1394 extern boolean_t kcf_need_provtab_walk;
1395 extern int kcf_get_refcnt(kcf_provider_desc_t *, boolean_t);
1396 
1397 /* Access to the policy table */
1398 extern boolean_t is_mech_disabled(kcf_provider_desc_t *, crypto_mech_name_t);
1399 extern boolean_t is_mech_disabled_byname(crypto_provider_type_t, char *,
1400     uint_t, crypto_mech_name_t);
1401 extern void kcf_policy_tab_init(void);
1402 extern void kcf_policy_free_desc(kcf_policy_desc_t *);
1403 extern void kcf_policy_remove_by_name(char *, uint_t *, crypto_mech_name_t **);
1404 extern void kcf_policy_remove_by_dev(char *, uint_t, uint_t *,
1405     crypto_mech_name_t **);
1406 extern kcf_policy_desc_t *kcf_policy_lookup_by_name(char *);
1407 extern kcf_policy_desc_t *kcf_policy_lookup_by_dev(char *, uint_t);
1408 extern int kcf_policy_load_soft_disabled(char *, uint_t, crypto_mech_name_t *,
1409     uint_t *, crypto_mech_name_t **);
1410 extern int kcf_policy_load_dev_disabled(char *, uint_t, uint_t,
1411     crypto_mech_name_t *, uint_t *, crypto_mech_name_t **);
1412 extern void remove_soft_config(char *);
1413 
1414 /* FIPS 140 functions */
1415 extern int kcf_get_fips140_mode(void);
1416 extern void kcf_fips140_validate();
1417 extern void kcf_activate();
1418 
1419 #endif	/* _KERNEL */
1420 
1421 #ifdef	__cplusplus
1422 }
1423 #endif
1424 
1425 #endif	/* _SYS_CRYPTO_IMPL_H */
1426