1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _SYS_CRYPTO_IMPL_H 27 #define _SYS_CRYPTO_IMPL_H 28 29 /* 30 * Kernel Cryptographic Framework private implementation definitions. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 36 #ifdef _KERNEL 37 #include <sys/crypto/common.h> 38 #include <sys/crypto/api.h> 39 #include <sys/crypto/spi.h> 40 #include <sys/crypto/ioctl.h> 41 #include <sys/tnf_probe.h> 42 #include <sys/atomic.h> 43 #include <sys/project.h> 44 #include <sys/taskq.h> 45 #include <sys/rctl.h> 46 #include <sys/cpuvar.h> 47 #endif /* _KERNEL */ 48 49 #ifdef __cplusplus 50 extern "C" { 51 #endif 52 53 #ifdef _KERNEL 54 55 /* 56 * Prefixes convention: structures internal to the kernel cryptographic 57 * framework start with 'kcf_'. Exposed structure start with 'crypto_'. 58 */ 59 60 /* Provider stats. Not protected. */ 61 typedef struct kcf_prov_stats { 62 kstat_named_t ps_ops_total; 63 kstat_named_t ps_ops_passed; 64 kstat_named_t ps_ops_failed; 65 kstat_named_t ps_ops_busy_rval; 66 } kcf_prov_stats_t; 67 68 /* Various kcf stats. Not protected. */ 69 typedef struct kcf_stats { 70 kstat_named_t ks_thrs_in_pool; 71 kstat_named_t ks_idle_thrs; 72 kstat_named_t ks_minthrs; 73 kstat_named_t ks_maxthrs; 74 kstat_named_t ks_swq_njobs; 75 kstat_named_t ks_swq_maxjobs; 76 kstat_named_t ks_taskq_threads; 77 kstat_named_t ks_taskq_minalloc; 78 kstat_named_t ks_taskq_maxalloc; 79 } kcf_stats_t; 80 81 #define CPU_SEQID (CPU->cpu_seqid) 82 83 typedef struct kcf_lock_withpad { 84 kmutex_t kl_lock; 85 uint8_t kl_pad[64 - sizeof (kmutex_t)]; 86 } kcf_lock_withpad_t; 87 88 /* 89 * Per-CPU structure used by a provider to keep track of 90 * various counters. 91 */ 92 typedef struct kcf_prov_cpu { 93 kmutex_t kp_lock; 94 int kp_holdcnt; /* can go negative! */ 95 uint_t kp_jobcnt; 96 97 uint64_t kp_ndispatches; 98 uint64_t kp_nfails; 99 uint64_t kp_nbusy_rval; 100 kcondvar_t kp_cv; 101 102 uint8_t kp_pad[64 - sizeof (kmutex_t) - 2 * sizeof (int) - 103 3 * sizeof (uint64_t) - sizeof (kcondvar_t)]; 104 } kcf_prov_cpu_t; 105 106 /* 107 * kcf_get_refcnt(pd) is the number of inflight requests to the 108 * provider. So, it is a good measure of the load on a provider when 109 * it is not in a busy state. Once a provider notifies it is busy, requests 110 * backup in the taskq. So, we use tq_nalloc in that case which gives 111 * the number of task entries in the task queue. Note that we do not 112 * acquire any locks here as it is not critical to get the exact number 113 * and the lock contention is too costly for this code path. 114 */ 115 #define KCF_PROV_LOAD(pd) ((pd)->pd_state != KCF_PROV_BUSY ? \ 116 kcf_get_refcnt(pd, B_FALSE) : (pd)->pd_taskq->tq_nalloc) 117 118 119 /* 120 * The following two macros should be 121 * #define KCF_OPS_CLASSSIZE (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2) 122 * #define KCF_MAXMECHTAB KCF_MAXCIPHER 123 * 124 * However, doing that would involve reorganizing the header file a bit. 125 * When impl.h is broken up (bug# 4703218), this will be done. For now, 126 * we hardcode these values. 127 */ 128 #define KCF_OPS_CLASSSIZE 8 129 #define KCF_MAXMECHTAB 32 130 131 /* 132 * Valid values for the state of a provider. The order of 133 * the elements is important. 134 * 135 * Routines which get a provider or the list of providers 136 * should pick only those that are either in KCF_PROV_READY state 137 * or in KCF_PROV_BUSY state. 138 */ 139 typedef enum { 140 KCF_PROV_ALLOCATED = 1, 141 KCF_PROV_UNVERIFIED, 142 KCF_PROV_UNVERIFIED_FIPS140, 143 KCF_PROV_VERIFICATION_FAILED, 144 /* 145 * state < KCF_PROV_READY means the provider can not 146 * be used at all. 147 */ 148 KCF_PROV_READY, 149 KCF_PROV_BUSY, 150 /* 151 * state > KCF_PROV_BUSY means the provider can not 152 * be used for new requests. 153 */ 154 KCF_PROV_FAILED, 155 /* 156 * Threads setting the following two states should do so only 157 * if the current state < KCF_PROV_DISABLED. 158 */ 159 KCF_PROV_DISABLED, 160 KCF_PROV_UNREGISTERING, 161 KCF_PROV_UNREGISTERED 162 } kcf_prov_state_t; 163 164 #define KCF_IS_PROV_UNVERIFIED(pd) ((pd)->pd_state == KCF_PROV_UNVERIFIED) 165 #define KCF_IS_PROV_USABLE(pd) ((pd)->pd_state == KCF_PROV_READY || \ 166 (pd)->pd_state == KCF_PROV_BUSY) 167 #define KCF_IS_PROV_REMOVED(pd) ((pd)->pd_state >= KCF_PROV_UNREGISTERING) 168 169 /* Internal flags valid for pd_flags field */ 170 #define KCF_PROV_RESTRICTED 0x40000000 171 #define KCF_LPROV_MEMBER 0x80000000 /* is member of a logical provider */ 172 173 /* 174 * A provider descriptor structure. There is one such structure per 175 * provider. It is allocated and initialized at registration time and 176 * freed when the provider unregisters. 177 * 178 * pd_prov_type: Provider type, hardware or software 179 * pd_sid: Session ID of the provider used by kernel clients. 180 * This is valid only for session-oriented providers. 181 * pd_taskq: taskq used to dispatch crypto requests 182 * pd_nbins: number of bins in pd_percpu_bins 183 * pd_percpu_bins: Pointer to an array of per-CPU structures 184 * containing a lock, a cv and various counters. 185 * pd_lock: lock protects pd_state and pd_provider_list 186 * pd_state: State value of the provider 187 * pd_provider_list: Used to cross-reference logical providers and their 188 * members. Not used for software providers. 189 * pd_resume_cv: cv to wait for state to change from KCF_PROV_BUSY 190 * pd_prov_handle: Provider handle specified by provider 191 * pd_ops_vector: The ops vector specified by Provider 192 * pd_mech_indx: Lookup table which maps a core framework mechanism 193 * number to an index in pd_mechanisms array 194 * pd_mechanisms: Array of mechanisms supported by the provider, specified 195 * by the provider during registration 196 * pd_mech_list_count: The number of entries in pi_mechanisms, specified 197 * by the provider during registration 198 * pd_name: Device name or module name 199 * pd_instance: Device instance 200 * pd_module_id: Module ID returned by modload 201 * pd_mctlp: Pointer to modctl structure for this provider 202 * pd_description: Provider description string 203 * pd_flags: bitwise OR of pi_flags from crypto_provider_info_t 204 * and other internal flags defined above. 205 * pd_hash_limit: Maximum data size that hash mechanisms of this provider 206 * can support. 207 * pd_hmac_limit: Maximum data size that HMAC mechanisms of this provider 208 * can support. 209 * pd_kcf_prov_handle: KCF-private handle assigned by KCF 210 * pd_prov_id: Identification # assigned by KCF to provider 211 * pd_kstat: kstat associated with the provider 212 * pd_ks_data: kstat data 213 */ 214 typedef struct kcf_provider_desc { 215 crypto_provider_type_t pd_prov_type; 216 crypto_session_id_t pd_sid; 217 taskq_t *pd_taskq; 218 uint_t pd_nbins; 219 kcf_prov_cpu_t *pd_percpu_bins; 220 kmutex_t pd_lock; 221 kcf_prov_state_t pd_state; 222 struct kcf_provider_list *pd_provider_list; 223 kcondvar_t pd_resume_cv; 224 crypto_provider_handle_t pd_prov_handle; 225 crypto_ops_t *pd_ops_vector; 226 ushort_t pd_mech_indx[KCF_OPS_CLASSSIZE]\ 227 [KCF_MAXMECHTAB]; 228 crypto_mech_info_t *pd_mechanisms; 229 uint_t pd_mech_list_count; 230 char *pd_name; 231 uint_t pd_instance; 232 int pd_module_id; 233 struct modctl *pd_mctlp; 234 char *pd_description; 235 uint_t pd_flags; 236 uint_t pd_hash_limit; 237 uint_t pd_hmac_limit; 238 crypto_kcf_provider_handle_t pd_kcf_prov_handle; 239 crypto_provider_id_t pd_prov_id; 240 kstat_t *pd_kstat; 241 kcf_prov_stats_t pd_ks_data; 242 } kcf_provider_desc_t; 243 244 /* useful for making a list of providers */ 245 typedef struct kcf_provider_list { 246 struct kcf_provider_list *pl_next; 247 struct kcf_provider_desc *pl_provider; 248 } kcf_provider_list_t; 249 250 /* 251 * If a component has a reference to a kcf_provider_desc_t, 252 * it REFHOLD()s. A new provider descriptor which is referenced only 253 * by the providers table has a reference counter of one. 254 */ 255 #define KCF_PROV_REFHOLD(desc) { \ 256 kcf_prov_cpu_t *mp; \ 257 \ 258 mp = &((desc)->pd_percpu_bins[CPU_SEQID]); \ 259 mutex_enter(&mp->kp_lock); \ 260 mp->kp_holdcnt++; \ 261 mutex_exit(&mp->kp_lock); \ 262 } 263 264 #define KCF_PROV_REFRELE(desc) { \ 265 kcf_prov_cpu_t *mp; \ 266 \ 267 mp = &((desc)->pd_percpu_bins[CPU_SEQID]); \ 268 mutex_enter(&mp->kp_lock); \ 269 mp->kp_holdcnt--; \ 270 mutex_exit(&mp->kp_lock); \ 271 } 272 273 #define KCF_PROV_REFHELD(desc) (kcf_get_refcnt(desc, B_TRUE) >= 1) 274 275 /* 276 * The JOB macros are used only for a hardware provider. 277 * Hardware providers can have holds that stay forever. 278 * So, the job counter is used to check if it is safe to 279 * unregister a provider. 280 */ 281 #define KCF_PROV_JOB_HOLD(mp) { \ 282 mutex_enter(&(mp)->kp_lock); \ 283 (mp)->kp_jobcnt++; \ 284 mutex_exit(&(mp)->kp_lock); \ 285 } 286 287 #define KCF_PROV_JOB_RELE(mp) { \ 288 mutex_enter(&(mp)->kp_lock); \ 289 (mp)->kp_jobcnt--; \ 290 if ((mp)->kp_jobcnt == 0) \ 291 cv_signal(&(mp)->kp_cv); \ 292 mutex_exit(&(mp)->kp_lock); \ 293 } 294 295 #define KCF_PROV_JOB_RELE_STAT(mp, doincr) { \ 296 if (doincr) \ 297 (mp)->kp_nfails++; \ 298 KCF_PROV_JOB_RELE(mp); \ 299 } 300 301 #define KCF_PROV_INCRSTATS(pd, error) { \ 302 kcf_prov_cpu_t *mp; \ 303 \ 304 mp = &((pd)->pd_percpu_bins[CPU_SEQID]); \ 305 mp->kp_ndispatches++; \ 306 if ((error) == CRYPTO_BUSY) \ 307 mp->kp_nbusy_rval++; \ 308 else if ((error) != CRYPTO_SUCCESS && (error) != CRYPTO_QUEUED) \ 309 mp->kp_nfails++; \ 310 } 311 312 /* list of crypto_mech_info_t valid as the second mech in a dual operation */ 313 314 typedef struct crypto_mech_info_list { 315 struct crypto_mech_info_list *ml_next; 316 crypto_mech_type_t ml_kcf_mechid; /* KCF's id */ 317 crypto_mech_info_t ml_mech_info; 318 } crypto_mech_info_list_t; 319 320 /* 321 * An element in a mechanism provider descriptors chain. 322 * The kcf_prov_mech_desc_t is duplicated in every chain the provider belongs 323 * to. This is a small tradeoff memory vs mutex spinning time to access the 324 * common provider field. 325 */ 326 327 typedef struct kcf_prov_mech_desc { 328 struct kcf_mech_entry *pm_me; /* Back to the head */ 329 struct kcf_prov_mech_desc *pm_next; /* Next in the chain */ 330 crypto_mech_info_t pm_mech_info; /* Provider mech info */ 331 crypto_mech_info_list_t *pm_mi_list; /* list for duals */ 332 kcf_provider_desc_t *pm_prov_desc; /* Common desc. */ 333 } kcf_prov_mech_desc_t; 334 335 /* and the notation shortcuts ... */ 336 #define pm_provider_type pm_prov_desc.pd_provider_type 337 #define pm_provider_handle pm_prov_desc.pd_provider_handle 338 #define pm_ops_vector pm_prov_desc.pd_ops_vector 339 340 extern kcf_lock_withpad_t *me_mutexes; 341 342 #define KCF_CPU_PAD (128 - sizeof (crypto_mech_name_t) - \ 343 sizeof (crypto_mech_type_t) - \ 344 2 * sizeof (kcf_prov_mech_desc_t *) - \ 345 sizeof (int) - sizeof (uint32_t) - sizeof (size_t)) 346 347 /* 348 * A mechanism entry in an xxx_mech_tab[]. KCF_CPU_PAD needs 349 * to be adjusted if this structure is changed. 350 */ 351 typedef struct kcf_mech_entry { 352 crypto_mech_name_t me_name; /* mechanism name */ 353 crypto_mech_type_t me_mechid; /* Internal id for mechanism */ 354 kcf_prov_mech_desc_t *me_hw_prov_chain; /* list of HW providers */ 355 kcf_prov_mech_desc_t *me_sw_prov; /* SW provider */ 356 /* 357 * Number of HW providers in the chain. There is only one 358 * SW provider. So, we need only a count of HW providers. 359 */ 360 int me_num_hwprov; 361 /* 362 * When a SW provider is present, this is the generation number that 363 * ensures no objects from old SW providers are used in the new one 364 */ 365 uint32_t me_gen_swprov; 366 /* 367 * threshold for using hardware providers for this mech 368 */ 369 size_t me_threshold; 370 uint8_t me_pad[KCF_CPU_PAD]; 371 } kcf_mech_entry_t; 372 373 /* 374 * A policy descriptor structure. It is allocated and initialized 375 * when administrative ioctls load disabled mechanisms. 376 * 377 * pd_prov_type: Provider type, hardware or software 378 * pd_name: Device name or module name. 379 * pd_instance: Device instance. 380 * pd_refcnt: Reference counter for this policy descriptor 381 * pd_mutex: Protects array and count of disabled mechanisms. 382 * pd_disabled_count: Count of disabled mechanisms. 383 * pd_disabled_mechs: Array of disabled mechanisms. 384 */ 385 typedef struct kcf_policy_desc { 386 crypto_provider_type_t pd_prov_type; 387 char *pd_name; 388 uint_t pd_instance; 389 uint_t pd_refcnt; 390 kmutex_t pd_mutex; 391 uint_t pd_disabled_count; 392 crypto_mech_name_t *pd_disabled_mechs; 393 } kcf_policy_desc_t; 394 395 /* 396 * If a component has a reference to a kcf_policy_desc_t, 397 * it REFHOLD()s. A new policy descriptor which is referenced only 398 * by the policy table has a reference count of one. 399 */ 400 #define KCF_POLICY_REFHOLD(desc) { \ 401 atomic_add_32(&(desc)->pd_refcnt, 1); \ 402 ASSERT((desc)->pd_refcnt != 0); \ 403 } 404 405 /* 406 * Releases a reference to a policy descriptor. When the last 407 * reference is released, the descriptor is freed. 408 */ 409 #define KCF_POLICY_REFRELE(desc) { \ 410 ASSERT((desc)->pd_refcnt != 0); \ 411 membar_exit(); \ 412 if (atomic_add_32_nv(&(desc)->pd_refcnt, -1) == 0) \ 413 kcf_policy_free_desc(desc); \ 414 } 415 416 /* 417 * This entry stores the name of a software module and its 418 * mechanisms. The mechanisms are 'hints' that are used to 419 * trigger loading of the module. 420 */ 421 typedef struct kcf_soft_conf_entry { 422 struct kcf_soft_conf_entry *ce_next; 423 char *ce_name; 424 crypto_mech_name_t *ce_mechs; 425 uint_t ce_count; 426 } kcf_soft_conf_entry_t; 427 428 extern kmutex_t soft_config_mutex; 429 extern kcf_soft_conf_entry_t *soft_config_list; 430 431 /* 432 * Global tables. The sizes are from the predefined PKCS#11 v2.20 mechanisms, 433 * with a margin of few extra empty entry points 434 */ 435 436 #define KCF_MAXDIGEST 16 /* Digests */ 437 #define KCF_MAXCIPHER 64 /* Ciphers */ 438 #define KCF_MAXMAC 40 /* Message authentication codes */ 439 #define KCF_MAXSIGN 24 /* Sign/Verify */ 440 #define KCF_MAXKEYOPS 116 /* Key generation and derivation */ 441 #define KCF_MAXMISC 16 /* Others ... */ 442 443 #define KCF_MAXMECHS KCF_MAXDIGEST + KCF_MAXCIPHER + KCF_MAXMAC + \ 444 KCF_MAXSIGN + KCF_MAXKEYOPS + \ 445 KCF_MAXMISC 446 447 extern kcf_mech_entry_t kcf_digest_mechs_tab[]; 448 extern kcf_mech_entry_t kcf_cipher_mechs_tab[]; 449 extern kcf_mech_entry_t kcf_mac_mechs_tab[]; 450 extern kcf_mech_entry_t kcf_sign_mechs_tab[]; 451 extern kcf_mech_entry_t kcf_keyops_mechs_tab[]; 452 extern kcf_mech_entry_t kcf_misc_mechs_tab[]; 453 454 extern kmutex_t kcf_mech_tabs_lock; 455 456 typedef enum { 457 KCF_DIGEST_CLASS = 1, 458 KCF_CIPHER_CLASS, 459 KCF_MAC_CLASS, 460 KCF_SIGN_CLASS, 461 KCF_KEYOPS_CLASS, 462 KCF_MISC_CLASS 463 } kcf_ops_class_t; 464 465 #define KCF_FIRST_OPSCLASS KCF_DIGEST_CLASS 466 #define KCF_LAST_OPSCLASS KCF_MISC_CLASS 467 468 /* The table of all the kcf_xxx_mech_tab[]s, indexed by kcf_ops_class */ 469 470 typedef struct kcf_mech_entry_tab { 471 int met_size; /* Size of the met_tab[] */ 472 kcf_mech_entry_t *met_tab; /* the table */ 473 } kcf_mech_entry_tab_t; 474 475 extern kcf_mech_entry_tab_t kcf_mech_tabs_tab[]; 476 477 #define KCF_MECHID(class, index) \ 478 (((crypto_mech_type_t)(class) << 32) | (crypto_mech_type_t)(index)) 479 480 #define KCF_MECH2CLASS(mech_type) ((kcf_ops_class_t)((mech_type) >> 32)) 481 482 #define KCF_MECH2INDEX(mech_type) ((int)(mech_type)) 483 484 #define KCF_TO_PROV_MECH_INDX(pd, mech_type) \ 485 ((pd)->pd_mech_indx[KCF_MECH2CLASS(mech_type)] \ 486 [KCF_MECH2INDEX(mech_type)]) 487 488 #define KCF_TO_PROV_MECHINFO(pd, mech_type) \ 489 ((pd)->pd_mechanisms[KCF_TO_PROV_MECH_INDX(pd, mech_type)]) 490 491 #define KCF_TO_PROV_MECHNUM(pd, mech_type) \ 492 (KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_number) 493 494 #define KCF_CAN_SHARE_OPSTATE(pd, mech_type) \ 495 ((KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_flags) & \ 496 CRYPTO_CAN_SHARE_OPSTATE) 497 498 /* ps_refcnt is protected by cm_lock in the crypto_minor structure */ 499 typedef struct crypto_provider_session { 500 struct crypto_provider_session *ps_next; 501 crypto_session_id_t ps_session; 502 kcf_provider_desc_t *ps_provider; 503 kcf_provider_desc_t *ps_real_provider; 504 uint_t ps_refcnt; 505 } crypto_provider_session_t; 506 507 typedef struct crypto_session_data { 508 kmutex_t sd_lock; 509 kcondvar_t sd_cv; 510 uint32_t sd_flags; 511 int sd_pre_approved_amount; 512 crypto_ctx_t *sd_digest_ctx; 513 crypto_ctx_t *sd_encr_ctx; 514 crypto_ctx_t *sd_decr_ctx; 515 crypto_ctx_t *sd_sign_ctx; 516 crypto_ctx_t *sd_verify_ctx; 517 crypto_ctx_t *sd_sign_recover_ctx; 518 crypto_ctx_t *sd_verify_recover_ctx; 519 kcf_provider_desc_t *sd_provider; 520 void *sd_find_init_cookie; 521 crypto_provider_session_t *sd_provider_session; 522 } crypto_session_data_t; 523 524 #define CRYPTO_SESSION_IN_USE 0x00000001 525 #define CRYPTO_SESSION_IS_BUSY 0x00000002 526 #define CRYPTO_SESSION_IS_CLOSED 0x00000004 527 528 #define KCF_MAX_PIN_LEN 1024 529 530 /* Global FIPS 140 mode variable */ 531 extern uint32_t global_fips140_mode; 532 /* Global FIPS 140 mode lock */ 533 extern kmutex_t fips140_mode_lock; 534 /* Conditional variable for kcf to wait until kcfd tells the FIPS mode status */ 535 extern kcondvar_t cv_fips140; 536 537 /* 538 * Per-minor info. 539 * 540 * cm_lock protects everything in this structure except for cm_refcnt. 541 */ 542 typedef struct crypto_minor { 543 uint_t cm_refcnt; 544 kmutex_t cm_lock; 545 kcondvar_t cm_cv; 546 crypto_session_data_t **cm_session_table; 547 uint_t cm_session_table_count; 548 kcf_provider_desc_t **cm_provider_array; 549 uint_t cm_provider_count; 550 crypto_provider_session_t *cm_provider_session; 551 } crypto_minor_t; 552 553 /* resource control framework handle used by /dev/crypto */ 554 extern rctl_hndl_t rc_project_crypto_mem; 555 /* 556 * Return codes for internal functions 557 */ 558 #define KCF_SUCCESS 0x0 /* Successful call */ 559 #define KCF_INVALID_MECH_NUMBER 0x1 /* invalid mechanism number */ 560 #define KCF_INVALID_MECH_NAME 0x2 /* invalid mechanism name */ 561 #define KCF_INVALID_MECH_CLASS 0x3 /* invalid mechanism class */ 562 #define KCF_MECH_TAB_FULL 0x4 /* Need more room in the mech tabs. */ 563 #define KCF_INVALID_INDX ((ushort_t)-1) 564 565 /* 566 * kCF internal mechanism and function group for tracking RNG providers. 567 */ 568 #define SUN_RANDOM "random" 569 #define CRYPTO_FG_RANDOM 0x80000000 /* generate_random() */ 570 571 /* 572 * Wrappers for ops vectors. In the wrapper definitions below, the pd 573 * argument always corresponds to a pointer to a provider descriptor 574 * of type kcf_prov_desc_t. 575 */ 576 577 #define KCF_PROV_CONTROL_OPS(pd) ((pd)->pd_ops_vector->co_control_ops) 578 #define KCF_PROV_CTX_OPS(pd) ((pd)->pd_ops_vector->co_ctx_ops) 579 #define KCF_PROV_DIGEST_OPS(pd) ((pd)->pd_ops_vector->co_digest_ops) 580 #define KCF_PROV_CIPHER_OPS(pd) ((pd)->pd_ops_vector->co_cipher_ops) 581 #define KCF_PROV_MAC_OPS(pd) ((pd)->pd_ops_vector->co_mac_ops) 582 #define KCF_PROV_SIGN_OPS(pd) ((pd)->pd_ops_vector->co_sign_ops) 583 #define KCF_PROV_VERIFY_OPS(pd) ((pd)->pd_ops_vector->co_verify_ops) 584 #define KCF_PROV_DUAL_OPS(pd) ((pd)->pd_ops_vector->co_dual_ops) 585 #define KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) \ 586 ((pd)->pd_ops_vector->co_dual_cipher_mac_ops) 587 #define KCF_PROV_RANDOM_OPS(pd) ((pd)->pd_ops_vector->co_random_ops) 588 #define KCF_PROV_SESSION_OPS(pd) ((pd)->pd_ops_vector->co_session_ops) 589 #define KCF_PROV_OBJECT_OPS(pd) ((pd)->pd_ops_vector->co_object_ops) 590 #define KCF_PROV_KEY_OPS(pd) ((pd)->pd_ops_vector->co_key_ops) 591 #define KCF_PROV_PROVIDER_OPS(pd) ((pd)->pd_ops_vector->co_provider_ops) 592 #define KCF_PROV_MECH_OPS(pd) ((pd)->pd_ops_vector->co_mech_ops) 593 #define KCF_PROV_NOSTORE_KEY_OPS(pd) \ 594 ((pd)->pd_ops_vector->co_nostore_key_ops) 595 #define KCF_PROV_FIPS140_OPS(pd) ((pd)->pd_ops_vector->co_fips140_ops) 596 #define KCF_PROV_PROVMGMT_OPS(pd) ((pd)->pd_ops_vector->co_provider_ops) 597 598 /* 599 * Wrappers for crypto_control_ops(9S) entry points. 600 */ 601 602 #define KCF_PROV_STATUS(pd, status) ( \ 603 (KCF_PROV_CONTROL_OPS(pd) && \ 604 KCF_PROV_CONTROL_OPS(pd)->provider_status) ? \ 605 KCF_PROV_CONTROL_OPS(pd)->provider_status( \ 606 (pd)->pd_prov_handle, status) : \ 607 CRYPTO_NOT_SUPPORTED) 608 609 /* 610 * Wrappers for crypto_ctx_ops(9S) entry points. 611 */ 612 613 #define KCF_PROV_CREATE_CTX_TEMPLATE(pd, mech, key, template, size, req) ( \ 614 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->create_ctx_template) ? \ 615 KCF_PROV_CTX_OPS(pd)->create_ctx_template( \ 616 (pd)->pd_prov_handle, mech, key, template, size, req) : \ 617 CRYPTO_NOT_SUPPORTED) 618 619 #define KCF_PROV_FREE_CONTEXT(pd, ctx) ( \ 620 (KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->free_context) ? \ 621 KCF_PROV_CTX_OPS(pd)->free_context(ctx) : CRYPTO_NOT_SUPPORTED) 622 623 #define KCF_PROV_COPYIN_MECH(pd, umech, kmech, errorp, mode) ( \ 624 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyin_mechanism) ? \ 625 KCF_PROV_MECH_OPS(pd)->copyin_mechanism( \ 626 (pd)->pd_prov_handle, umech, kmech, errorp, mode) : \ 627 CRYPTO_NOT_SUPPORTED) 628 629 #define KCF_PROV_COPYOUT_MECH(pd, kmech, umech, errorp, mode) ( \ 630 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyout_mechanism) ? \ 631 KCF_PROV_MECH_OPS(pd)->copyout_mechanism( \ 632 (pd)->pd_prov_handle, kmech, umech, errorp, mode) : \ 633 CRYPTO_NOT_SUPPORTED) 634 635 #define KCF_PROV_FREE_MECH(pd, prov_mech) ( \ 636 (KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->free_mechanism) ? \ 637 KCF_PROV_MECH_OPS(pd)->free_mechanism( \ 638 (pd)->pd_prov_handle, prov_mech) : CRYPTO_NOT_SUPPORTED) 639 640 /* 641 * Wrappers for crypto_digest_ops(9S) entry points. 642 */ 643 644 #define KCF_PROV_DIGEST_INIT(pd, ctx, mech, req) ( \ 645 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_init) ? \ 646 KCF_PROV_DIGEST_OPS(pd)->digest_init(ctx, mech, req) : \ 647 CRYPTO_NOT_SUPPORTED) 648 649 /* 650 * The _ (underscore) in _digest is needed to avoid replacing the 651 * function digest(). 652 */ 653 #define KCF_PROV_DIGEST(pd, ctx, data, _digest, req) ( \ 654 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest) ? \ 655 KCF_PROV_DIGEST_OPS(pd)->digest(ctx, data, _digest, req) : \ 656 CRYPTO_NOT_SUPPORTED) 657 658 #define KCF_PROV_DIGEST_UPDATE(pd, ctx, data, req) ( \ 659 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_update) ? \ 660 KCF_PROV_DIGEST_OPS(pd)->digest_update(ctx, data, req) : \ 661 CRYPTO_NOT_SUPPORTED) 662 663 #define KCF_PROV_DIGEST_KEY(pd, ctx, key, req) ( \ 664 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_key) ? \ 665 KCF_PROV_DIGEST_OPS(pd)->digest_key(ctx, key, req) : \ 666 CRYPTO_NOT_SUPPORTED) 667 668 #define KCF_PROV_DIGEST_FINAL(pd, ctx, digest, req) ( \ 669 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_final) ? \ 670 KCF_PROV_DIGEST_OPS(pd)->digest_final(ctx, digest, req) : \ 671 CRYPTO_NOT_SUPPORTED) 672 673 #define KCF_PROV_DIGEST_ATOMIC(pd, session, mech, data, digest, req) ( \ 674 (KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_atomic) ? \ 675 KCF_PROV_DIGEST_OPS(pd)->digest_atomic( \ 676 (pd)->pd_prov_handle, session, mech, data, digest, req) : \ 677 CRYPTO_NOT_SUPPORTED) 678 679 /* 680 * Wrappers for crypto_cipher_ops(9S) entry points. 681 */ 682 683 #define KCF_PROV_ENCRYPT_INIT(pd, ctx, mech, key, template, req) ( \ 684 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_init) ? \ 685 KCF_PROV_CIPHER_OPS(pd)->encrypt_init(ctx, mech, key, template, \ 686 req) : \ 687 CRYPTO_NOT_SUPPORTED) 688 689 #define KCF_PROV_ENCRYPT(pd, ctx, plaintext, ciphertext, req) ( \ 690 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt) ? \ 691 KCF_PROV_CIPHER_OPS(pd)->encrypt(ctx, plaintext, ciphertext, req) : \ 692 CRYPTO_NOT_SUPPORTED) 693 694 #define KCF_PROV_ENCRYPT_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \ 695 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_update) ? \ 696 KCF_PROV_CIPHER_OPS(pd)->encrypt_update(ctx, plaintext, \ 697 ciphertext, req) : \ 698 CRYPTO_NOT_SUPPORTED) 699 700 #define KCF_PROV_ENCRYPT_FINAL(pd, ctx, ciphertext, req) ( \ 701 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_final) ? \ 702 KCF_PROV_CIPHER_OPS(pd)->encrypt_final(ctx, ciphertext, req) : \ 703 CRYPTO_NOT_SUPPORTED) 704 705 #define KCF_PROV_ENCRYPT_ATOMIC(pd, session, mech, key, plaintext, ciphertext, \ 706 template, req) ( \ 707 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic) ? \ 708 KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic( \ 709 (pd)->pd_prov_handle, session, mech, key, plaintext, ciphertext, \ 710 template, req) : \ 711 CRYPTO_NOT_SUPPORTED) 712 713 #define KCF_PROV_DECRYPT_INIT(pd, ctx, mech, key, template, req) ( \ 714 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_init) ? \ 715 KCF_PROV_CIPHER_OPS(pd)->decrypt_init(ctx, mech, key, template, \ 716 req) : \ 717 CRYPTO_NOT_SUPPORTED) 718 719 #define KCF_PROV_DECRYPT(pd, ctx, ciphertext, plaintext, req) ( \ 720 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt) ? \ 721 KCF_PROV_CIPHER_OPS(pd)->decrypt(ctx, ciphertext, plaintext, req) : \ 722 CRYPTO_NOT_SUPPORTED) 723 724 #define KCF_PROV_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \ 725 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_update) ? \ 726 KCF_PROV_CIPHER_OPS(pd)->decrypt_update(ctx, ciphertext, \ 727 plaintext, req) : \ 728 CRYPTO_NOT_SUPPORTED) 729 730 #define KCF_PROV_DECRYPT_FINAL(pd, ctx, plaintext, req) ( \ 731 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_final) ? \ 732 KCF_PROV_CIPHER_OPS(pd)->decrypt_final(ctx, plaintext, req) : \ 733 CRYPTO_NOT_SUPPORTED) 734 735 #define KCF_PROV_DECRYPT_ATOMIC(pd, session, mech, key, ciphertext, plaintext, \ 736 template, req) ( \ 737 (KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic) ? \ 738 KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic( \ 739 (pd)->pd_prov_handle, session, mech, key, ciphertext, plaintext, \ 740 template, req) : \ 741 CRYPTO_NOT_SUPPORTED) 742 743 /* 744 * Wrappers for crypto_mac_ops(9S) entry points. 745 */ 746 747 #define KCF_PROV_MAC_INIT(pd, ctx, mech, key, template, req) ( \ 748 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_init) ? \ 749 KCF_PROV_MAC_OPS(pd)->mac_init(ctx, mech, key, template, req) \ 750 : CRYPTO_NOT_SUPPORTED) 751 752 /* 753 * The _ (underscore) in _mac is needed to avoid replacing the 754 * function mac(). 755 */ 756 #define KCF_PROV_MAC(pd, ctx, data, _mac, req) ( \ 757 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac) ? \ 758 KCF_PROV_MAC_OPS(pd)->mac(ctx, data, _mac, req) : \ 759 CRYPTO_NOT_SUPPORTED) 760 761 #define KCF_PROV_MAC_UPDATE(pd, ctx, data, req) ( \ 762 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_update) ? \ 763 KCF_PROV_MAC_OPS(pd)->mac_update(ctx, data, req) : \ 764 CRYPTO_NOT_SUPPORTED) 765 766 #define KCF_PROV_MAC_FINAL(pd, ctx, mac, req) ( \ 767 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_final) ? \ 768 KCF_PROV_MAC_OPS(pd)->mac_final(ctx, mac, req) : \ 769 CRYPTO_NOT_SUPPORTED) 770 771 #define KCF_PROV_MAC_ATOMIC(pd, session, mech, key, data, mac, template, \ 772 req) ( \ 773 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_atomic) ? \ 774 KCF_PROV_MAC_OPS(pd)->mac_atomic( \ 775 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \ 776 req) : \ 777 CRYPTO_NOT_SUPPORTED) 778 779 #define KCF_PROV_MAC_VERIFY_ATOMIC(pd, session, mech, key, data, mac, \ 780 template, req) ( \ 781 (KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_verify_atomic) ? \ 782 KCF_PROV_MAC_OPS(pd)->mac_verify_atomic( \ 783 (pd)->pd_prov_handle, session, mech, key, data, mac, template, \ 784 req) : \ 785 CRYPTO_NOT_SUPPORTED) 786 787 /* 788 * Wrappers for crypto_sign_ops(9S) entry points. 789 */ 790 791 #define KCF_PROV_SIGN_INIT(pd, ctx, mech, key, template, req) ( \ 792 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_init) ? \ 793 KCF_PROV_SIGN_OPS(pd)->sign_init( \ 794 ctx, mech, key, template, req) : CRYPTO_NOT_SUPPORTED) 795 796 #define KCF_PROV_SIGN(pd, ctx, data, sig, req) ( \ 797 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign) ? \ 798 KCF_PROV_SIGN_OPS(pd)->sign(ctx, data, sig, req) : \ 799 CRYPTO_NOT_SUPPORTED) 800 801 #define KCF_PROV_SIGN_UPDATE(pd, ctx, data, req) ( \ 802 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_update) ? \ 803 KCF_PROV_SIGN_OPS(pd)->sign_update(ctx, data, req) : \ 804 CRYPTO_NOT_SUPPORTED) 805 806 #define KCF_PROV_SIGN_FINAL(pd, ctx, sig, req) ( \ 807 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_final) ? \ 808 KCF_PROV_SIGN_OPS(pd)->sign_final(ctx, sig, req) : \ 809 CRYPTO_NOT_SUPPORTED) 810 811 #define KCF_PROV_SIGN_ATOMIC(pd, session, mech, key, data, template, \ 812 sig, req) ( \ 813 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_atomic) ? \ 814 KCF_PROV_SIGN_OPS(pd)->sign_atomic( \ 815 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 816 req) : CRYPTO_NOT_SUPPORTED) 817 818 #define KCF_PROV_SIGN_RECOVER_INIT(pd, ctx, mech, key, template, \ 819 req) ( \ 820 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover_init) ? \ 821 KCF_PROV_SIGN_OPS(pd)->sign_recover_init(ctx, mech, key, template, \ 822 req) : CRYPTO_NOT_SUPPORTED) 823 824 #define KCF_PROV_SIGN_RECOVER(pd, ctx, data, sig, req) ( \ 825 (KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover) ? \ 826 KCF_PROV_SIGN_OPS(pd)->sign_recover(ctx, data, sig, req) : \ 827 CRYPTO_NOT_SUPPORTED) 828 829 #define KCF_PROV_SIGN_RECOVER_ATOMIC(pd, session, mech, key, data, template, \ 830 sig, req) ( \ 831 (KCF_PROV_SIGN_OPS(pd) && \ 832 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic) ? \ 833 KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic( \ 834 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 835 req) : CRYPTO_NOT_SUPPORTED) 836 837 /* 838 * Wrappers for crypto_verify_ops(9S) entry points. 839 */ 840 841 #define KCF_PROV_VERIFY_INIT(pd, ctx, mech, key, template, req) ( \ 842 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_init) ? \ 843 KCF_PROV_VERIFY_OPS(pd)->verify_init(ctx, mech, key, template, \ 844 req) : CRYPTO_NOT_SUPPORTED) 845 846 #define KCF_PROV_VERIFY(pd, ctx, data, sig, req) ( \ 847 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify) ? \ 848 KCF_PROV_VERIFY_OPS(pd)->verify(ctx, data, sig, req) : \ 849 CRYPTO_NOT_SUPPORTED) 850 851 #define KCF_PROV_VERIFY_UPDATE(pd, ctx, data, req) ( \ 852 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_update) ? \ 853 KCF_PROV_VERIFY_OPS(pd)->verify_update(ctx, data, req) : \ 854 CRYPTO_NOT_SUPPORTED) 855 856 #define KCF_PROV_VERIFY_FINAL(pd, ctx, sig, req) ( \ 857 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_final) ? \ 858 KCF_PROV_VERIFY_OPS(pd)->verify_final(ctx, sig, req) : \ 859 CRYPTO_NOT_SUPPORTED) 860 861 #define KCF_PROV_VERIFY_ATOMIC(pd, session, mech, key, data, template, sig, \ 862 req) ( \ 863 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_atomic) ? \ 864 KCF_PROV_VERIFY_OPS(pd)->verify_atomic( \ 865 (pd)->pd_prov_handle, session, mech, key, data, sig, template, \ 866 req) : CRYPTO_NOT_SUPPORTED) 867 868 #define KCF_PROV_VERIFY_RECOVER_INIT(pd, ctx, mech, key, template, \ 869 req) ( \ 870 (KCF_PROV_VERIFY_OPS(pd) && \ 871 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init) ? \ 872 KCF_PROV_VERIFY_OPS(pd)->verify_recover_init(ctx, mech, key, \ 873 template, req) : CRYPTO_NOT_SUPPORTED) 874 875 /* verify_recover() CSPI routine has different argument order than verify() */ 876 #define KCF_PROV_VERIFY_RECOVER(pd, ctx, sig, data, req) ( \ 877 (KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_recover) ? \ 878 KCF_PROV_VERIFY_OPS(pd)->verify_recover(ctx, sig, data, req) : \ 879 CRYPTO_NOT_SUPPORTED) 880 881 /* 882 * verify_recover_atomic() CSPI routine has different argument order 883 * than verify_atomic(). 884 */ 885 #define KCF_PROV_VERIFY_RECOVER_ATOMIC(pd, session, mech, key, sig, \ 886 template, data, req) ( \ 887 (KCF_PROV_VERIFY_OPS(pd) && \ 888 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic) ? \ 889 KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic( \ 890 (pd)->pd_prov_handle, session, mech, key, sig, data, template, \ 891 req) : CRYPTO_NOT_SUPPORTED) 892 893 /* 894 * Wrappers for crypto_dual_ops(9S) entry points. 895 */ 896 897 #define KCF_PROV_DIGEST_ENCRYPT_UPDATE(digest_ctx, encrypt_ctx, plaintext, \ 898 ciphertext, req) ( \ 899 (KCF_PROV_DUAL_OPS(pd) && \ 900 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update) ? \ 901 KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update( \ 902 digest_ctx, encrypt_ctx, plaintext, ciphertext, req) : \ 903 CRYPTO_NOT_SUPPORTED) 904 905 #define KCF_PROV_DECRYPT_DIGEST_UPDATE(decrypt_ctx, digest_ctx, ciphertext, \ 906 plaintext, req) ( \ 907 (KCF_PROV_DUAL_OPS(pd) && \ 908 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update) ? \ 909 KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update( \ 910 decrypt_ctx, digest_ctx, ciphertext, plaintext, req) : \ 911 CRYPTO_NOT_SUPPORTED) 912 913 #define KCF_PROV_SIGN_ENCRYPT_UPDATE(sign_ctx, encrypt_ctx, plaintext, \ 914 ciphertext, req) ( \ 915 (KCF_PROV_DUAL_OPS(pd) && \ 916 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update) ? \ 917 KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update( \ 918 sign_ctx, encrypt_ctx, plaintext, ciphertext, req) : \ 919 CRYPTO_NOT_SUPPORTED) 920 921 #define KCF_PROV_DECRYPT_VERIFY_UPDATE(decrypt_ctx, verify_ctx, ciphertext, \ 922 plaintext, req) ( \ 923 (KCF_PROV_DUAL_OPS(pd) && \ 924 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update) ? \ 925 KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update( \ 926 decrypt_ctx, verify_ctx, ciphertext, plaintext, req) : \ 927 CRYPTO_NOT_SUPPORTED) 928 929 /* 930 * Wrappers for crypto_dual_cipher_mac_ops(9S) entry points. 931 */ 932 933 #define KCF_PROV_ENCRYPT_MAC_INIT(pd, ctx, encr_mech, encr_key, mac_mech, \ 934 mac_key, encr_ctx_template, mac_ctx_template, req) ( \ 935 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 936 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init) ? \ 937 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init( \ 938 ctx, encr_mech, encr_key, mac_mech, mac_key, encr_ctx_template, \ 939 mac_ctx_template, req) : \ 940 CRYPTO_NOT_SUPPORTED) 941 942 #define KCF_PROV_ENCRYPT_MAC(pd, ctx, plaintext, ciphertext, mac, req) ( \ 943 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 944 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac) ? \ 945 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac( \ 946 ctx, plaintext, ciphertext, mac, req) : \ 947 CRYPTO_NOT_SUPPORTED) 948 949 #define KCF_PROV_ENCRYPT_MAC_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \ 950 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 951 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update) ? \ 952 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update( \ 953 ctx, plaintext, ciphertext, req) : \ 954 CRYPTO_NOT_SUPPORTED) 955 956 #define KCF_PROV_ENCRYPT_MAC_FINAL(pd, ctx, ciphertext, mac, req) ( \ 957 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 958 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final) ? \ 959 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final( \ 960 ctx, ciphertext, mac, req) : \ 961 CRYPTO_NOT_SUPPORTED) 962 963 #define KCF_PROV_ENCRYPT_MAC_ATOMIC(pd, session, encr_mech, encr_key, \ 964 mac_mech, mac_key, plaintext, ciphertext, mac, \ 965 encr_ctx_template, mac_ctx_template, req) ( \ 966 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 967 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic) ? \ 968 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic( \ 969 (pd)->pd_prov_handle, session, encr_mech, encr_key, \ 970 mac_mech, mac_key, plaintext, ciphertext, mac, \ 971 encr_ctx_template, mac_ctx_template, req) : \ 972 CRYPTO_NOT_SUPPORTED) 973 974 #define KCF_PROV_MAC_DECRYPT_INIT(pd, ctx, mac_mech, mac_key, decr_mech, \ 975 decr_key, mac_ctx_template, decr_ctx_template, req) ( \ 976 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 977 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init) ? \ 978 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init( \ 979 ctx, mac_mech, mac_key, decr_mech, decr_key, mac_ctx_template, \ 980 decr_ctx_template, req) : \ 981 CRYPTO_NOT_SUPPORTED) 982 983 #define KCF_PROV_MAC_DECRYPT(pd, ctx, ciphertext, mac, plaintext, req) ( \ 984 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 985 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt) ? \ 986 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt( \ 987 ctx, ciphertext, mac, plaintext, req) : \ 988 CRYPTO_NOT_SUPPORTED) 989 990 #define KCF_PROV_MAC_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \ 991 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 992 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update) ? \ 993 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update( \ 994 ctx, ciphertext, plaintext, req) : \ 995 CRYPTO_NOT_SUPPORTED) 996 997 #define KCF_PROV_MAC_DECRYPT_FINAL(pd, ctx, mac, plaintext, req) ( \ 998 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 999 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final) ? \ 1000 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final( \ 1001 ctx, mac, plaintext, req) : \ 1002 CRYPTO_NOT_SUPPORTED) 1003 1004 #define KCF_PROV_MAC_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \ 1005 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1006 mac_ctx_template, decr_ctx_template, req) ( \ 1007 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 1008 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic) ? \ 1009 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic( \ 1010 (pd)->pd_prov_handle, session, mac_mech, mac_key, \ 1011 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1012 mac_ctx_template, decr_ctx_template, req) : \ 1013 CRYPTO_NOT_SUPPORTED) 1014 1015 #define KCF_PROV_MAC_VERIFY_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \ 1016 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1017 mac_ctx_template, decr_ctx_template, req) ( \ 1018 (KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \ 1019 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic \ 1020 != NULL) ? \ 1021 KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic( \ 1022 (pd)->pd_prov_handle, session, mac_mech, mac_key, \ 1023 decr_mech, decr_key, ciphertext, mac, plaintext, \ 1024 mac_ctx_template, decr_ctx_template, req) : \ 1025 CRYPTO_NOT_SUPPORTED) 1026 1027 /* 1028 * Wrappers for crypto_random_number_ops(9S) entry points. 1029 */ 1030 1031 #define KCF_PROV_SEED_RANDOM(pd, session, buf, len, est, flags, req) ( \ 1032 (KCF_PROV_RANDOM_OPS(pd) && KCF_PROV_RANDOM_OPS(pd)->seed_random) ? \ 1033 KCF_PROV_RANDOM_OPS(pd)->seed_random((pd)->pd_prov_handle, \ 1034 session, buf, len, est, flags, req) : CRYPTO_NOT_SUPPORTED) 1035 1036 #define KCF_PROV_GENERATE_RANDOM(pd, session, buf, len, req) ( \ 1037 (KCF_PROV_RANDOM_OPS(pd) && \ 1038 KCF_PROV_RANDOM_OPS(pd)->generate_random) ? \ 1039 KCF_PROV_RANDOM_OPS(pd)->generate_random((pd)->pd_prov_handle, \ 1040 session, buf, len, req) : CRYPTO_NOT_SUPPORTED) 1041 1042 /* 1043 * Wrappers for crypto_session_ops(9S) entry points. 1044 * 1045 * ops_pd is the provider descriptor that supplies the ops_vector. 1046 * pd is the descriptor that supplies the provider handle. 1047 * Only session open/close needs two handles. 1048 */ 1049 1050 #define KCF_PROV_SESSION_OPEN(ops_pd, session, req, pd) ( \ 1051 (KCF_PROV_SESSION_OPS(ops_pd) && \ 1052 KCF_PROV_SESSION_OPS(ops_pd)->session_open) ? \ 1053 KCF_PROV_SESSION_OPS(ops_pd)->session_open((pd)->pd_prov_handle, \ 1054 session, req) : CRYPTO_NOT_SUPPORTED) 1055 1056 #define KCF_PROV_SESSION_CLOSE(ops_pd, session, req, pd) ( \ 1057 (KCF_PROV_SESSION_OPS(ops_pd) && \ 1058 KCF_PROV_SESSION_OPS(ops_pd)->session_close) ? \ 1059 KCF_PROV_SESSION_OPS(ops_pd)->session_close((pd)->pd_prov_handle, \ 1060 session, req) : CRYPTO_NOT_SUPPORTED) 1061 1062 #define KCF_PROV_SESSION_LOGIN(pd, session, user_type, pin, len, req) ( \ 1063 (KCF_PROV_SESSION_OPS(pd) && \ 1064 KCF_PROV_SESSION_OPS(pd)->session_login) ? \ 1065 KCF_PROV_SESSION_OPS(pd)->session_login((pd)->pd_prov_handle, \ 1066 session, user_type, pin, len, req) : CRYPTO_NOT_SUPPORTED) 1067 1068 #define KCF_PROV_SESSION_LOGOUT(pd, session, req) ( \ 1069 (KCF_PROV_SESSION_OPS(pd) && \ 1070 KCF_PROV_SESSION_OPS(pd)->session_logout) ? \ 1071 KCF_PROV_SESSION_OPS(pd)->session_logout((pd)->pd_prov_handle, \ 1072 session, req) : CRYPTO_NOT_SUPPORTED) 1073 1074 /* 1075 * Wrappers for crypto_object_ops(9S) entry points. 1076 */ 1077 1078 #define KCF_PROV_OBJECT_CREATE(pd, session, template, count, object, req) ( \ 1079 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_create) ? \ 1080 KCF_PROV_OBJECT_OPS(pd)->object_create((pd)->pd_prov_handle, \ 1081 session, template, count, object, req) : CRYPTO_NOT_SUPPORTED) 1082 1083 #define KCF_PROV_OBJECT_COPY(pd, session, object, template, count, \ 1084 new_object, req) ( \ 1085 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_copy) ? \ 1086 KCF_PROV_OBJECT_OPS(pd)->object_copy((pd)->pd_prov_handle, \ 1087 session, object, template, count, new_object, req) : \ 1088 CRYPTO_NOT_SUPPORTED) 1089 1090 #define KCF_PROV_OBJECT_DESTROY(pd, session, object, req) ( \ 1091 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_destroy) ? \ 1092 KCF_PROV_OBJECT_OPS(pd)->object_destroy((pd)->pd_prov_handle, \ 1093 session, object, req) : CRYPTO_NOT_SUPPORTED) 1094 1095 #define KCF_PROV_OBJECT_GET_SIZE(pd, session, object, size, req) ( \ 1096 (KCF_PROV_OBJECT_OPS(pd) && \ 1097 KCF_PROV_OBJECT_OPS(pd)->object_get_size) ? \ 1098 KCF_PROV_OBJECT_OPS(pd)->object_get_size((pd)->pd_prov_handle, \ 1099 session, object, size, req) : CRYPTO_NOT_SUPPORTED) 1100 1101 #define KCF_PROV_OBJECT_GET_ATTRIBUTE_VALUE(pd, session, object, template, \ 1102 count, req) ( \ 1103 (KCF_PROV_OBJECT_OPS(pd) && \ 1104 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value) ? \ 1105 KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value( \ 1106 (pd)->pd_prov_handle, session, object, template, count, req) : \ 1107 CRYPTO_NOT_SUPPORTED) 1108 1109 #define KCF_PROV_OBJECT_SET_ATTRIBUTE_VALUE(pd, session, object, template, \ 1110 count, req) ( \ 1111 (KCF_PROV_OBJECT_OPS(pd) && \ 1112 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value) ? \ 1113 KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value( \ 1114 (pd)->pd_prov_handle, session, object, template, count, req) : \ 1115 CRYPTO_NOT_SUPPORTED) 1116 1117 #define KCF_PROV_OBJECT_FIND_INIT(pd, session, template, count, ppriv, \ 1118 req) ( \ 1119 (KCF_PROV_OBJECT_OPS(pd) && \ 1120 KCF_PROV_OBJECT_OPS(pd)->object_find_init) ? \ 1121 KCF_PROV_OBJECT_OPS(pd)->object_find_init((pd)->pd_prov_handle, \ 1122 session, template, count, ppriv, req) : CRYPTO_NOT_SUPPORTED) 1123 1124 #define KCF_PROV_OBJECT_FIND(pd, ppriv, objects, max_objects, object_count, \ 1125 req) ( \ 1126 (KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_find) ? \ 1127 KCF_PROV_OBJECT_OPS(pd)->object_find( \ 1128 (pd)->pd_prov_handle, ppriv, objects, max_objects, object_count, \ 1129 req) : CRYPTO_NOT_SUPPORTED) 1130 1131 #define KCF_PROV_OBJECT_FIND_FINAL(pd, ppriv, req) ( \ 1132 (KCF_PROV_OBJECT_OPS(pd) && \ 1133 KCF_PROV_OBJECT_OPS(pd)->object_find_final) ? \ 1134 KCF_PROV_OBJECT_OPS(pd)->object_find_final( \ 1135 (pd)->pd_prov_handle, ppriv, req) : CRYPTO_NOT_SUPPORTED) 1136 1137 /* 1138 * Wrappers for crypto_key_ops(9S) entry points. 1139 */ 1140 1141 #define KCF_PROV_KEY_GENERATE(pd, session, mech, template, count, object, \ 1142 req) ( \ 1143 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate) ? \ 1144 KCF_PROV_KEY_OPS(pd)->key_generate((pd)->pd_prov_handle, \ 1145 session, mech, template, count, object, req) : \ 1146 CRYPTO_NOT_SUPPORTED) 1147 1148 #define KCF_PROV_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \ 1149 pub_count, priv_template, priv_count, pub_key, priv_key, req) ( \ 1150 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate_pair) ? \ 1151 KCF_PROV_KEY_OPS(pd)->key_generate_pair((pd)->pd_prov_handle, \ 1152 session, mech, pub_template, pub_count, priv_template, \ 1153 priv_count, pub_key, priv_key, req) : \ 1154 CRYPTO_NOT_SUPPORTED) 1155 1156 #define KCF_PROV_KEY_WRAP(pd, session, mech, wrapping_key, key, wrapped_key, \ 1157 wrapped_key_len, req) ( \ 1158 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_wrap) ? \ 1159 KCF_PROV_KEY_OPS(pd)->key_wrap((pd)->pd_prov_handle, \ 1160 session, mech, wrapping_key, key, wrapped_key, wrapped_key_len, \ 1161 req) : \ 1162 CRYPTO_NOT_SUPPORTED) 1163 1164 #define KCF_PROV_KEY_UNWRAP(pd, session, mech, unwrapping_key, wrapped_key, \ 1165 wrapped_key_len, template, count, key, req) ( \ 1166 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_unwrap) ? \ 1167 KCF_PROV_KEY_OPS(pd)->key_unwrap((pd)->pd_prov_handle, \ 1168 session, mech, unwrapping_key, wrapped_key, wrapped_key_len, \ 1169 template, count, key, req) : \ 1170 CRYPTO_NOT_SUPPORTED) 1171 1172 #define KCF_PROV_KEY_DERIVE(pd, session, mech, base_key, template, count, \ 1173 key, req) ( \ 1174 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_derive) ? \ 1175 KCF_PROV_KEY_OPS(pd)->key_derive((pd)->pd_prov_handle, \ 1176 session, mech, base_key, template, count, key, req) : \ 1177 CRYPTO_NOT_SUPPORTED) 1178 1179 #define KCF_PROV_KEY_CHECK(pd, mech, key) ( \ 1180 (KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_check) ? \ 1181 KCF_PROV_KEY_OPS(pd)->key_check((pd)->pd_prov_handle, mech, key) : \ 1182 CRYPTO_NOT_SUPPORTED) 1183 1184 /* 1185 * Wrappers for crypto_provider_management_ops(9S) entry points. 1186 * 1187 * ops_pd is the provider descriptor that supplies the ops_vector. 1188 * pd is the descriptor that supplies the provider handle. 1189 * Only ext_info needs two handles. 1190 */ 1191 1192 #define KCF_PROV_EXT_INFO(ops_pd, provext_info, req, pd) ( \ 1193 (KCF_PROV_PROVIDER_OPS(ops_pd) && \ 1194 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info) ? \ 1195 KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info((pd)->pd_prov_handle, \ 1196 provext_info, req) : CRYPTO_NOT_SUPPORTED) 1197 1198 #define KCF_PROV_INIT_TOKEN(pd, pin, pin_len, label, req) ( \ 1199 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_token) ? \ 1200 KCF_PROV_PROVIDER_OPS(pd)->init_token((pd)->pd_prov_handle, \ 1201 pin, pin_len, label, req) : CRYPTO_NOT_SUPPORTED) 1202 1203 #define KCF_PROV_INIT_PIN(pd, session, pin, pin_len, req) ( \ 1204 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_pin) ? \ 1205 KCF_PROV_PROVIDER_OPS(pd)->init_pin((pd)->pd_prov_handle, \ 1206 session, pin, pin_len, req) : CRYPTO_NOT_SUPPORTED) 1207 1208 #define KCF_PROV_SET_PIN(pd, session, old_pin, old_len, new_pin, new_len, \ 1209 req) ( \ 1210 (KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->set_pin) ? \ 1211 KCF_PROV_PROVIDER_OPS(pd)->set_pin((pd)->pd_prov_handle, \ 1212 session, old_pin, old_len, new_pin, new_len, req) : \ 1213 CRYPTO_NOT_SUPPORTED) 1214 1215 /* 1216 * Wrappers for crypto_nostore_key_ops(9S) entry points. 1217 */ 1218 1219 #define KCF_PROV_NOSTORE_KEY_GENERATE(pd, session, mech, template, count, \ 1220 out_template, out_count, req) ( \ 1221 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1222 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate) ? \ 1223 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate( \ 1224 (pd)->pd_prov_handle, session, mech, template, count, \ 1225 out_template, out_count, req) : CRYPTO_NOT_SUPPORTED) 1226 1227 #define KCF_PROV_NOSTORE_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \ 1228 pub_count, priv_template, priv_count, out_pub_template, \ 1229 out_pub_count, out_priv_template, out_priv_count, req) ( \ 1230 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1231 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair) ? \ 1232 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair( \ 1233 (pd)->pd_prov_handle, session, mech, pub_template, pub_count, \ 1234 priv_template, priv_count, out_pub_template, out_pub_count, \ 1235 out_priv_template, out_priv_count, req) : CRYPTO_NOT_SUPPORTED) 1236 1237 #define KCF_PROV_NOSTORE_KEY_DERIVE(pd, session, mech, base_key, template, \ 1238 count, out_template, out_count, req) ( \ 1239 (KCF_PROV_NOSTORE_KEY_OPS(pd) && \ 1240 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive) ? \ 1241 KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive( \ 1242 (pd)->pd_prov_handle, session, mech, base_key, template, count, \ 1243 out_template, out_count, req) : CRYPTO_NOT_SUPPORTED) 1244 1245 /* 1246 * The following routines are exported by the kcf module (/kernel/misc/kcf) 1247 * to the crypto and cryptoadmin modules. 1248 */ 1249 1250 /* Digest/mac/cipher entry points that take a provider descriptor and session */ 1251 extern int crypto_digest_single(crypto_context_t, crypto_data_t *, 1252 crypto_data_t *, crypto_call_req_t *); 1253 1254 extern int crypto_mac_single(crypto_context_t, crypto_data_t *, 1255 crypto_data_t *, crypto_call_req_t *); 1256 1257 extern int crypto_encrypt_single(crypto_context_t, crypto_data_t *, 1258 crypto_data_t *, crypto_call_req_t *); 1259 1260 extern int crypto_decrypt_single(crypto_context_t, crypto_data_t *, 1261 crypto_data_t *, crypto_call_req_t *); 1262 1263 1264 /* Other private digest/mac/cipher entry points not exported through k-API */ 1265 extern int crypto_digest_key_prov(crypto_context_t, crypto_key_t *, 1266 crypto_call_req_t *); 1267 1268 /* Private sign entry points exported by KCF */ 1269 extern int crypto_sign_single(crypto_context_t, crypto_data_t *, 1270 crypto_data_t *, crypto_call_req_t *); 1271 1272 extern int crypto_sign_recover_single(crypto_context_t, crypto_data_t *, 1273 crypto_data_t *, crypto_call_req_t *); 1274 1275 /* Private verify entry points exported by KCF */ 1276 extern int crypto_verify_single(crypto_context_t, crypto_data_t *, 1277 crypto_data_t *, crypto_call_req_t *); 1278 1279 extern int crypto_verify_recover_single(crypto_context_t, crypto_data_t *, 1280 crypto_data_t *, crypto_call_req_t *); 1281 1282 /* Private dual operations entry points exported by KCF */ 1283 extern int crypto_digest_encrypt_update(crypto_context_t, crypto_context_t, 1284 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1285 extern int crypto_decrypt_digest_update(crypto_context_t, crypto_context_t, 1286 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1287 extern int crypto_sign_encrypt_update(crypto_context_t, crypto_context_t, 1288 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1289 extern int crypto_decrypt_verify_update(crypto_context_t, crypto_context_t, 1290 crypto_data_t *, crypto_data_t *, crypto_call_req_t *); 1291 1292 /* Random Number Generation */ 1293 int crypto_seed_random(crypto_provider_handle_t provider, uchar_t *buf, 1294 size_t len, crypto_call_req_t *req); 1295 int crypto_generate_random(crypto_provider_handle_t provider, uchar_t *buf, 1296 size_t len, crypto_call_req_t *req); 1297 1298 /* Provider Management */ 1299 int crypto_get_provider_info(crypto_provider_id_t id, 1300 crypto_provider_info_t **info, crypto_call_req_t *req); 1301 int crypto_get_provider_mechanisms(crypto_minor_t *, crypto_provider_id_t id, 1302 uint_t *count, crypto_mech_name_t **list); 1303 int crypto_init_token(crypto_provider_handle_t provider, char *pin, 1304 size_t pin_len, char *label, crypto_call_req_t *); 1305 int crypto_init_pin(crypto_provider_handle_t provider, char *pin, 1306 size_t pin_len, crypto_call_req_t *req); 1307 int crypto_set_pin(crypto_provider_handle_t provider, char *old_pin, 1308 size_t old_len, char *new_pin, size_t new_len, crypto_call_req_t *req); 1309 void crypto_free_provider_list(crypto_provider_entry_t *list, uint_t count); 1310 void crypto_free_provider_info(crypto_provider_info_t *info); 1311 1312 /* Administrative */ 1313 int crypto_get_dev_list(uint_t *count, crypto_dev_list_entry_t **list); 1314 int crypto_get_soft_list(uint_t *count, char **list, size_t *len); 1315 int crypto_get_dev_info(char *name, uint_t instance, uint_t *count, 1316 crypto_mech_name_t **list); 1317 int crypto_get_soft_info(caddr_t name, uint_t *count, 1318 crypto_mech_name_t **list); 1319 int crypto_load_dev_disabled(char *name, uint_t instance, uint_t count, 1320 crypto_mech_name_t *list); 1321 int crypto_load_soft_disabled(caddr_t name, uint_t count, 1322 crypto_mech_name_t *list); 1323 int crypto_unload_soft_module(caddr_t path); 1324 int crypto_load_soft_config(caddr_t name, uint_t count, 1325 crypto_mech_name_t *list); 1326 int crypto_load_door(uint_t did); 1327 void crypto_free_mech_list(crypto_mech_name_t *list, uint_t count); 1328 void crypto_free_dev_list(crypto_dev_list_entry_t *list, uint_t count); 1329 extern void kcf_activate(); 1330 1331 /* Miscellaneous */ 1332 int crypto_get_mechanism_number(caddr_t name, crypto_mech_type_t *number); 1333 int crypto_get_function_list(crypto_provider_id_t id, 1334 crypto_function_list_t **list, int kmflag); 1335 void crypto_free_function_list(crypto_function_list_t *list); 1336 int crypto_build_permitted_mech_names(kcf_provider_desc_t *, 1337 crypto_mech_name_t **, uint_t *, int); 1338 extern void kcf_init_mech_tabs(void); 1339 extern int kcf_add_mech_provider(short, kcf_provider_desc_t *, 1340 kcf_prov_mech_desc_t **); 1341 extern void kcf_remove_mech_provider(char *, kcf_provider_desc_t *); 1342 extern int kcf_get_mech_entry(crypto_mech_type_t, kcf_mech_entry_t **); 1343 extern kcf_provider_desc_t *kcf_alloc_provider_desc(crypto_provider_info_t *); 1344 extern void kcf_free_provider_desc(kcf_provider_desc_t *); 1345 extern void kcf_soft_config_init(void); 1346 extern int get_sw_provider_for_mech(crypto_mech_name_t, char **); 1347 extern crypto_mech_type_t crypto_mech2id_common(char *, boolean_t); 1348 extern void undo_register_provider(kcf_provider_desc_t *, boolean_t); 1349 extern void redo_register_provider(kcf_provider_desc_t *); 1350 extern void kcf_rnd_init(); 1351 extern boolean_t kcf_rngprov_check(void); 1352 extern int kcf_rnd_get_pseudo_bytes(uint8_t *, size_t); 1353 extern int kcf_rnd_get_bytes(uint8_t *, size_t, boolean_t); 1354 extern int random_add_pseudo_entropy(uint8_t *, size_t, uint_t); 1355 extern void kcf_rnd_chpoll(short, int, short *, struct pollhead **); 1356 extern void kcf_rnd_schedule_timeout(boolean_t); 1357 extern int crypto_uio_data(crypto_data_t *, uchar_t *, int, cmd_type_t, 1358 void *, void (*update)()); 1359 extern int crypto_mblk_data(crypto_data_t *, uchar_t *, int, cmd_type_t, 1360 void *, void (*update)()); 1361 extern int crypto_put_output_data(uchar_t *, crypto_data_t *, int); 1362 extern int crypto_get_input_data(crypto_data_t *, uchar_t **, uchar_t *); 1363 extern int crypto_copy_key_to_ctx(crypto_key_t *, crypto_key_t **, size_t *, 1364 int kmflag); 1365 extern int crypto_digest_data(crypto_data_t *, void *, uchar_t *, 1366 void (*update)(), void (*final)(), uchar_t); 1367 extern int crypto_update_iov(void *, crypto_data_t *, crypto_data_t *, 1368 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1369 void (*copy_block)(uint8_t *, uint64_t *)); 1370 extern int crypto_update_uio(void *, crypto_data_t *, crypto_data_t *, 1371 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1372 void (*copy_block)(uint8_t *, uint64_t *)); 1373 extern int crypto_update_mp(void *, crypto_data_t *, crypto_data_t *, 1374 int (*cipher)(void *, caddr_t, size_t, crypto_data_t *), 1375 void (*copy_block)(uint8_t *, uint64_t *)); 1376 extern int crypto_get_key_attr(crypto_key_t *, crypto_attr_type_t, uchar_t **, 1377 ssize_t *); 1378 1379 /* Access to the provider's table */ 1380 extern void kcf_prov_tab_init(void); 1381 extern int kcf_prov_tab_add_provider(kcf_provider_desc_t *); 1382 extern int kcf_prov_tab_rem_provider(crypto_provider_id_t); 1383 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_name(char *); 1384 extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_dev(char *, uint_t); 1385 extern int kcf_get_hw_prov_tab(uint_t *, kcf_provider_desc_t ***, int, 1386 char *, uint_t, boolean_t); 1387 extern int kcf_get_slot_list(uint_t *, kcf_provider_desc_t ***, boolean_t); 1388 extern void kcf_free_provider_tab(uint_t, kcf_provider_desc_t **); 1389 extern kcf_provider_desc_t *kcf_prov_tab_lookup(crypto_provider_id_t); 1390 extern int kcf_get_sw_prov(crypto_mech_type_t, kcf_provider_desc_t **, 1391 kcf_mech_entry_t **, boolean_t); 1392 1393 extern kmutex_t prov_tab_mutex; 1394 extern boolean_t kcf_need_provtab_walk; 1395 extern int kcf_get_refcnt(kcf_provider_desc_t *, boolean_t); 1396 1397 /* Access to the policy table */ 1398 extern boolean_t is_mech_disabled(kcf_provider_desc_t *, crypto_mech_name_t); 1399 extern boolean_t is_mech_disabled_byname(crypto_provider_type_t, char *, 1400 uint_t, crypto_mech_name_t); 1401 extern void kcf_policy_tab_init(void); 1402 extern void kcf_policy_free_desc(kcf_policy_desc_t *); 1403 extern void kcf_policy_remove_by_name(char *, uint_t *, crypto_mech_name_t **); 1404 extern void kcf_policy_remove_by_dev(char *, uint_t, uint_t *, 1405 crypto_mech_name_t **); 1406 extern kcf_policy_desc_t *kcf_policy_lookup_by_name(char *); 1407 extern kcf_policy_desc_t *kcf_policy_lookup_by_dev(char *, uint_t); 1408 extern int kcf_policy_load_soft_disabled(char *, uint_t, crypto_mech_name_t *, 1409 uint_t *, crypto_mech_name_t **); 1410 extern int kcf_policy_load_dev_disabled(char *, uint_t, uint_t, 1411 crypto_mech_name_t *, uint_t *, crypto_mech_name_t **); 1412 extern void remove_soft_config(char *); 1413 1414 /* FIPS 140 functions */ 1415 extern int kcf_get_fips140_mode(void); 1416 extern void kcf_fips140_validate(); 1417 extern void kcf_activate(); 1418 1419 #endif /* _KERNEL */ 1420 1421 #ifdef __cplusplus 1422 } 1423 #endif 1424 1425 #endif /* _SYS_CRYPTO_IMPL_H */ 1426