17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
572eff6e2Smcpowers * Common Development and Distribution License (the "License").
672eff6e2Smcpowers * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*9b009fc1SValerie Bubb Fenwick * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
247c478bd9Sstevel@tonic-gate
257c478bd9Sstevel@tonic-gate #include <sys/errno.h>
267c478bd9Sstevel@tonic-gate #include <sys/types.h>
277c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
28894b2776Smcpowers #include <sys/sysmacros.h>
297c478bd9Sstevel@tonic-gate #include <sys/crypto/common.h>
307c478bd9Sstevel@tonic-gate #include <sys/crypto/impl.h>
317c478bd9Sstevel@tonic-gate #include <sys/crypto/api.h>
327c478bd9Sstevel@tonic-gate #include <sys/crypto/spi.h>
337c478bd9Sstevel@tonic-gate #include <sys/crypto/sched_impl.h>
347c478bd9Sstevel@tonic-gate
35894b2776Smcpowers #define CRYPTO_OPS_OFFSET(f) offsetof(crypto_ops_t, co_##f)
36894b2776Smcpowers #define CRYPTO_CIPHER_OFFSET(f) offsetof(crypto_cipher_ops_t, f)
37894b2776Smcpowers
387c478bd9Sstevel@tonic-gate /*
397c478bd9Sstevel@tonic-gate * Encryption and decryption routines.
407c478bd9Sstevel@tonic-gate */
417c478bd9Sstevel@tonic-gate
427c478bd9Sstevel@tonic-gate /*
437c478bd9Sstevel@tonic-gate * The following are the possible returned values common to all the routines
447c478bd9Sstevel@tonic-gate * below. The applicability of some of these return values depends on the
457c478bd9Sstevel@tonic-gate * presence of the arguments.
467c478bd9Sstevel@tonic-gate *
477c478bd9Sstevel@tonic-gate * CRYPTO_SUCCESS: The operation completed successfully.
487c478bd9Sstevel@tonic-gate * CRYPTO_QUEUED: A request was submitted successfully. The callback
497c478bd9Sstevel@tonic-gate * routine will be called when the operation is done.
507c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_MECH_NUMBER, CRYPTO_INVALID_MECH_PARAM, or
517c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_MECH for problems with the 'mech'.
527c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_DATA for bogus 'data'
537c478bd9Sstevel@tonic-gate * CRYPTO_HOST_MEMORY for failure to allocate memory to handle this work.
547c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_CONTEXT: Not a valid context.
557c478bd9Sstevel@tonic-gate * CRYPTO_BUSY: Cannot process the request now. Schedule a
567c478bd9Sstevel@tonic-gate * crypto_bufcall(), or try later.
577c478bd9Sstevel@tonic-gate * CRYPTO_NOT_SUPPORTED and CRYPTO_MECH_NOT_SUPPORTED: No provider is
587c478bd9Sstevel@tonic-gate * capable of a function or a mechanism.
597c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_KEY: bogus 'key' argument.
607c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_PLAINTEXT: bogus 'plaintext' argument.
617c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_CIPHERTEXT: bogus 'ciphertext' argument.
627c478bd9Sstevel@tonic-gate */
637c478bd9Sstevel@tonic-gate
647c478bd9Sstevel@tonic-gate /*
657c478bd9Sstevel@tonic-gate * crypto_cipher_init_prov()
667c478bd9Sstevel@tonic-gate *
677c478bd9Sstevel@tonic-gate * Arguments:
687c478bd9Sstevel@tonic-gate *
697c478bd9Sstevel@tonic-gate * pd: provider descriptor
707c478bd9Sstevel@tonic-gate * sid: session id
717c478bd9Sstevel@tonic-gate * mech: crypto_mechanism_t pointer.
727c478bd9Sstevel@tonic-gate * mech_type is a valid value previously returned by
737c478bd9Sstevel@tonic-gate * crypto_mech2id();
747c478bd9Sstevel@tonic-gate * When the mech's parameter is not NULL, its definition depends
757c478bd9Sstevel@tonic-gate * on the standard definition of the mechanism.
767c478bd9Sstevel@tonic-gate * key: pointer to a crypto_key_t structure.
777c478bd9Sstevel@tonic-gate * tmpl: a crypto_ctx_template_t, opaque template of a context of an
787c478bd9Sstevel@tonic-gate * encryption or decryption with the 'mech' using 'key'.
797c478bd9Sstevel@tonic-gate * 'tmpl' is created by a previous call to
807c478bd9Sstevel@tonic-gate * crypto_create_ctx_template().
817c478bd9Sstevel@tonic-gate * ctxp: Pointer to a crypto_context_t.
827c478bd9Sstevel@tonic-gate * func: CRYPTO_FG_ENCRYPT or CRYPTO_FG_DECRYPT.
837c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
847c478bd9Sstevel@tonic-gate *
857c478bd9Sstevel@tonic-gate * Description:
867c478bd9Sstevel@tonic-gate * This is a common function invoked internally by both
877c478bd9Sstevel@tonic-gate * crypto_encrypt_init() and crypto_decrypt_init().
887c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs the
897c478bd9Sstevel@tonic-gate * initialization of an encryption or a decryption operation.
907c478bd9Sstevel@tonic-gate * When possible and applicable, will internally use the pre-expanded key
917c478bd9Sstevel@tonic-gate * schedule from the context template, tmpl.
927c478bd9Sstevel@tonic-gate * When complete and successful, 'ctxp' will contain a crypto_context_t
937c478bd9Sstevel@tonic-gate * valid for later calls to encrypt_update() and encrypt_final(), or
947c478bd9Sstevel@tonic-gate * decrypt_update() and decrypt_final().
957c478bd9Sstevel@tonic-gate * The caller should hold a reference on the specified provider
967c478bd9Sstevel@tonic-gate * descriptor before calling this function.
977c478bd9Sstevel@tonic-gate *
987c478bd9Sstevel@tonic-gate * Context:
997c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
1007c478bd9Sstevel@tonic-gate *
1017c478bd9Sstevel@tonic-gate * Returns:
1027c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
1037c478bd9Sstevel@tonic-gate */
1047c478bd9Sstevel@tonic-gate static int
crypto_cipher_init_prov(crypto_provider_t provider,crypto_session_id_t sid,crypto_mechanism_t * mech,crypto_key_t * key,crypto_spi_ctx_template_t tmpl,crypto_context_t * ctxp,crypto_call_req_t * crq,crypto_func_group_t func)105894b2776Smcpowers crypto_cipher_init_prov(crypto_provider_t provider, crypto_session_id_t sid,
1067c478bd9Sstevel@tonic-gate crypto_mechanism_t *mech, crypto_key_t *key,
1077c478bd9Sstevel@tonic-gate crypto_spi_ctx_template_t tmpl, crypto_context_t *ctxp,
1087c478bd9Sstevel@tonic-gate crypto_call_req_t *crq, crypto_func_group_t func)
1097c478bd9Sstevel@tonic-gate {
1107c478bd9Sstevel@tonic-gate int error;
1117c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx;
1127c478bd9Sstevel@tonic-gate kcf_req_params_t params;
113894b2776Smcpowers kcf_provider_desc_t *pd = provider;
114894b2776Smcpowers kcf_provider_desc_t *real_provider = pd;
1157c478bd9Sstevel@tonic-gate
1167c478bd9Sstevel@tonic-gate ASSERT(KCF_PROV_REFHELD(pd));
1177c478bd9Sstevel@tonic-gate
118894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
119894b2776Smcpowers if (func == CRYPTO_FG_ENCRYPT) {
120436935a1SVladimir Kotal error = kcf_get_hardware_provider(mech->cm_type, key,
121*9b009fc1SValerie Bubb Fenwick CRYPTO_MECH_INVALID, NULL, pd, &real_provider,
122*9b009fc1SValerie Bubb Fenwick CRYPTO_FG_ENCRYPT);
123894b2776Smcpowers } else {
124436935a1SVladimir Kotal error = kcf_get_hardware_provider(mech->cm_type, key,
125*9b009fc1SValerie Bubb Fenwick CRYPTO_MECH_INVALID, NULL, pd, &real_provider,
126*9b009fc1SValerie Bubb Fenwick CRYPTO_FG_DECRYPT);
127894b2776Smcpowers }
128894b2776Smcpowers
129894b2776Smcpowers if (error != CRYPTO_SUCCESS)
130894b2776Smcpowers return (error);
131894b2776Smcpowers }
132894b2776Smcpowers
133894b2776Smcpowers /* Allocate and initialize the canonical context */
134894b2776Smcpowers if ((ctx = kcf_new_ctx(crq, real_provider, sid)) == NULL) {
135894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)
136894b2776Smcpowers KCF_PROV_REFRELE(real_provider);
1377c478bd9Sstevel@tonic-gate return (CRYPTO_HOST_MEMORY);
138894b2776Smcpowers }
1397c478bd9Sstevel@tonic-gate
1407c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
1417c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(crq, pd)) {
1427c478bd9Sstevel@tonic-gate crypto_mechanism_t lmech;
1437c478bd9Sstevel@tonic-gate
1447c478bd9Sstevel@tonic-gate lmech = *mech;
145894b2776Smcpowers KCF_SET_PROVIDER_MECHNUM(mech->cm_type, real_provider, &lmech);
1467c478bd9Sstevel@tonic-gate
1477c478bd9Sstevel@tonic-gate if (func == CRYPTO_FG_ENCRYPT)
148894b2776Smcpowers error = KCF_PROV_ENCRYPT_INIT(real_provider, ctx,
149894b2776Smcpowers &lmech, key, tmpl, KCF_SWFP_RHNDL(crq));
1507c478bd9Sstevel@tonic-gate else {
1517c478bd9Sstevel@tonic-gate ASSERT(func == CRYPTO_FG_DECRYPT);
1527c478bd9Sstevel@tonic-gate
153894b2776Smcpowers error = KCF_PROV_DECRYPT_INIT(real_provider, ctx,
154894b2776Smcpowers &lmech, key, tmpl, KCF_SWFP_RHNDL(crq));
1557c478bd9Sstevel@tonic-gate }
1567c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
1576a1073f8Skrishna
1586a1073f8Skrishna goto done;
1596a1073f8Skrishna }
1606a1073f8Skrishna
1616a1073f8Skrishna /* Check if context sharing is possible */
1626a1073f8Skrishna if (pd->pd_prov_type == CRYPTO_HW_PROVIDER &&
1636a1073f8Skrishna key->ck_format == CRYPTO_KEY_RAW &&
1646a1073f8Skrishna KCF_CAN_SHARE_OPSTATE(pd, mech->cm_type)) {
1656a1073f8Skrishna kcf_context_t *tctxp = (kcf_context_t *)ctx;
1666a1073f8Skrishna kcf_provider_desc_t *tpd = NULL;
1676a1073f8Skrishna crypto_mech_info_t *sinfo;
1686a1073f8Skrishna
1696a1073f8Skrishna if ((kcf_get_sw_prov(mech->cm_type, &tpd, &tctxp->kc_mech,
1706a1073f8Skrishna B_FALSE) == CRYPTO_SUCCESS)) {
1716a1073f8Skrishna int tlen;
1726a1073f8Skrishna
1736a1073f8Skrishna sinfo = &(KCF_TO_PROV_MECHINFO(tpd, mech->cm_type));
1746a1073f8Skrishna /*
1756a1073f8Skrishna * key->ck_length from the consumer is always in bits.
1766a1073f8Skrishna * We convert it to be in the same unit registered by
1776a1073f8Skrishna * the provider in order to do a comparison.
1786a1073f8Skrishna */
1796a1073f8Skrishna if (sinfo->cm_mech_flags & CRYPTO_KEYSIZE_UNIT_IN_BYTES)
18095014fbbSDan OpenSolaris Anderson tlen = CRYPTO_BITS2BYTES(key->ck_length);
1816a1073f8Skrishna else
1826a1073f8Skrishna tlen = key->ck_length;
1836a1073f8Skrishna /*
1846a1073f8Skrishna * Check if the software provider can support context
1856a1073f8Skrishna * sharing and support this key length.
1866a1073f8Skrishna */
1876a1073f8Skrishna if ((sinfo->cm_mech_flags & CRYPTO_CAN_SHARE_OPSTATE) &&
1886a1073f8Skrishna (tlen >= sinfo->cm_min_key_length) &&
1896a1073f8Skrishna (tlen <= sinfo->cm_max_key_length)) {
1906a1073f8Skrishna ctx->cc_flags = CRYPTO_INIT_OPSTATE;
1916a1073f8Skrishna tctxp->kc_sw_prov_desc = tpd;
1926a1073f8Skrishna } else
1936a1073f8Skrishna KCF_PROV_REFRELE(tpd);
1947c478bd9Sstevel@tonic-gate }
1956a1073f8Skrishna }
1967c478bd9Sstevel@tonic-gate
1976a1073f8Skrishna if (func == CRYPTO_FG_ENCRYPT) {
1986a1073f8Skrishna KCF_WRAP_ENCRYPT_OPS_PARAMS(¶ms, KCF_OP_INIT, sid,
1996a1073f8Skrishna mech, key, NULL, NULL, tmpl);
2006a1073f8Skrishna } else {
2016a1073f8Skrishna ASSERT(func == CRYPTO_FG_DECRYPT);
2026a1073f8Skrishna KCF_WRAP_DECRYPT_OPS_PARAMS(¶ms, KCF_OP_INIT, sid,
2036a1073f8Skrishna mech, key, NULL, NULL, tmpl);
2047c478bd9Sstevel@tonic-gate }
2057c478bd9Sstevel@tonic-gate
2066a1073f8Skrishna error = kcf_submit_request(real_provider, ctx, crq, ¶ms,
2076a1073f8Skrishna B_FALSE);
2086a1073f8Skrishna
209894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)
210894b2776Smcpowers KCF_PROV_REFRELE(real_provider);
211894b2776Smcpowers
2126a1073f8Skrishna done:
2137c478bd9Sstevel@tonic-gate if ((error == CRYPTO_SUCCESS) || (error == CRYPTO_QUEUED))
2147c478bd9Sstevel@tonic-gate *ctxp = (crypto_context_t)ctx;
2157c478bd9Sstevel@tonic-gate else {
2167c478bd9Sstevel@tonic-gate /* Release the hold done in kcf_new_ctx(). */
2177c478bd9Sstevel@tonic-gate KCF_CONTEXT_REFRELE((kcf_context_t *)ctx->cc_framework_private);
2187c478bd9Sstevel@tonic-gate }
2197c478bd9Sstevel@tonic-gate
2207c478bd9Sstevel@tonic-gate return (error);
2217c478bd9Sstevel@tonic-gate }
2227c478bd9Sstevel@tonic-gate
2237c478bd9Sstevel@tonic-gate /*
2247c478bd9Sstevel@tonic-gate * Same as crypto_cipher_init_prov(), but relies on the scheduler to pick
2257c478bd9Sstevel@tonic-gate * an appropriate provider. See crypto_cipher_init_prov() comments for more
2267c478bd9Sstevel@tonic-gate * details.
2277c478bd9Sstevel@tonic-gate */
2287c478bd9Sstevel@tonic-gate static int
crypto_cipher_init(crypto_mechanism_t * mech,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_context_t * ctxp,crypto_call_req_t * crq,crypto_func_group_t func)2297c478bd9Sstevel@tonic-gate crypto_cipher_init(crypto_mechanism_t *mech, crypto_key_t *key,
2307c478bd9Sstevel@tonic-gate crypto_ctx_template_t tmpl, crypto_context_t *ctxp,
2317c478bd9Sstevel@tonic-gate crypto_call_req_t *crq, crypto_func_group_t func)
2327c478bd9Sstevel@tonic-gate {
2337c478bd9Sstevel@tonic-gate int error;
2347c478bd9Sstevel@tonic-gate kcf_mech_entry_t *me;
2357c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
2367c478bd9Sstevel@tonic-gate kcf_ctx_template_t *ctx_tmpl;
2377c478bd9Sstevel@tonic-gate crypto_spi_ctx_template_t spi_ctx_tmpl = NULL;
2387c478bd9Sstevel@tonic-gate kcf_prov_tried_t *list = NULL;
2397c478bd9Sstevel@tonic-gate
2407c478bd9Sstevel@tonic-gate retry:
2417c478bd9Sstevel@tonic-gate /* pd is returned held */
242436935a1SVladimir Kotal if ((pd = kcf_get_mech_provider(mech->cm_type, key, &me, &error,
243*9b009fc1SValerie Bubb Fenwick list, func, 0)) == NULL) {
2447c478bd9Sstevel@tonic-gate if (list != NULL)
2457c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
2467c478bd9Sstevel@tonic-gate return (error);
2477c478bd9Sstevel@tonic-gate }
2487c478bd9Sstevel@tonic-gate
2497c478bd9Sstevel@tonic-gate /*
2507c478bd9Sstevel@tonic-gate * For SW providers, check the validity of the context template
2517c478bd9Sstevel@tonic-gate * It is very rare that the generation number mis-matches, so
2527c478bd9Sstevel@tonic-gate * is acceptable to fail here, and let the consumer recover by
2537c478bd9Sstevel@tonic-gate * freeing this tmpl and create a new one for the key and new SW
2547c478bd9Sstevel@tonic-gate * provider
2557c478bd9Sstevel@tonic-gate */
2567c478bd9Sstevel@tonic-gate if ((pd->pd_prov_type == CRYPTO_SW_PROVIDER) &&
2577c478bd9Sstevel@tonic-gate ((ctx_tmpl = (kcf_ctx_template_t *)tmpl) != NULL)) {
2587c478bd9Sstevel@tonic-gate if (ctx_tmpl->ct_generation != me->me_gen_swprov) {
2597c478bd9Sstevel@tonic-gate if (list != NULL)
2607c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
2617c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
2627c478bd9Sstevel@tonic-gate return (CRYPTO_OLD_CTX_TEMPLATE);
2637c478bd9Sstevel@tonic-gate } else {
2647c478bd9Sstevel@tonic-gate spi_ctx_tmpl = ctx_tmpl->ct_prov_tmpl;
2657c478bd9Sstevel@tonic-gate }
2667c478bd9Sstevel@tonic-gate }
2677c478bd9Sstevel@tonic-gate
2687c478bd9Sstevel@tonic-gate error = crypto_cipher_init_prov(pd, pd->pd_sid, mech, key,
2697c478bd9Sstevel@tonic-gate spi_ctx_tmpl, ctxp, crq, func);
2707c478bd9Sstevel@tonic-gate if (error != CRYPTO_SUCCESS && error != CRYPTO_QUEUED &&
2717c478bd9Sstevel@tonic-gate IS_RECOVERABLE(error)) {
2727c478bd9Sstevel@tonic-gate /* Add pd to the linked list of providers tried. */
2737c478bd9Sstevel@tonic-gate if (kcf_insert_triedlist(&list, pd, KCF_KMFLAG(crq)) != NULL)
2747c478bd9Sstevel@tonic-gate goto retry;
2757c478bd9Sstevel@tonic-gate }
2767c478bd9Sstevel@tonic-gate
2777c478bd9Sstevel@tonic-gate if (list != NULL)
2787c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
2797c478bd9Sstevel@tonic-gate
2807c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
2817c478bd9Sstevel@tonic-gate return (error);
2827c478bd9Sstevel@tonic-gate }
2837c478bd9Sstevel@tonic-gate
2847c478bd9Sstevel@tonic-gate /*
2857c478bd9Sstevel@tonic-gate * crypto_encrypt_prov()
2867c478bd9Sstevel@tonic-gate *
2877c478bd9Sstevel@tonic-gate * Arguments:
2887c478bd9Sstevel@tonic-gate * pd: provider descriptor
2897c478bd9Sstevel@tonic-gate * sid: session id
2907c478bd9Sstevel@tonic-gate * mech: crypto_mechanism_t pointer.
2917c478bd9Sstevel@tonic-gate * mech_type is a valid value previously returned by
2927c478bd9Sstevel@tonic-gate * crypto_mech2id();
2937c478bd9Sstevel@tonic-gate * When the mech's parameter is not NULL, its definition depends
2947c478bd9Sstevel@tonic-gate * on the standard definition of the mechanism.
2957c478bd9Sstevel@tonic-gate * key: pointer to a crypto_key_t structure.
2967c478bd9Sstevel@tonic-gate * plaintext: The message to be encrypted
2977c478bd9Sstevel@tonic-gate * ciphertext: Storage for the encrypted message. The length needed
2987c478bd9Sstevel@tonic-gate * depends on the mechanism, and the plaintext's size.
2997c478bd9Sstevel@tonic-gate * tmpl: a crypto_ctx_template_t, opaque template of a context of an
3007c478bd9Sstevel@tonic-gate * encryption with the 'mech' using 'key'. 'tmpl' is created by
3017c478bd9Sstevel@tonic-gate * a previous call to crypto_create_ctx_template().
3027c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
3037c478bd9Sstevel@tonic-gate *
3047c478bd9Sstevel@tonic-gate * Description:
3057c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs a
3067c478bd9Sstevel@tonic-gate * single-part encryption of 'plaintext' with the mechanism 'mech', using
3077c478bd9Sstevel@tonic-gate * the key 'key'.
3087c478bd9Sstevel@tonic-gate * When complete and successful, 'ciphertext' will contain the encrypted
3097c478bd9Sstevel@tonic-gate * message.
3107c478bd9Sstevel@tonic-gate *
3117c478bd9Sstevel@tonic-gate * Context:
3127c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
3137c478bd9Sstevel@tonic-gate *
3147c478bd9Sstevel@tonic-gate * Returns:
3157c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
3167c478bd9Sstevel@tonic-gate */
3177c478bd9Sstevel@tonic-gate int
crypto_encrypt_prov(crypto_provider_t provider,crypto_session_id_t sid,crypto_mechanism_t * mech,crypto_data_t * plaintext,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_data_t * ciphertext,crypto_call_req_t * crq)318894b2776Smcpowers crypto_encrypt_prov(crypto_provider_t provider, crypto_session_id_t sid,
319894b2776Smcpowers crypto_mechanism_t *mech, crypto_data_t *plaintext, crypto_key_t *key,
320894b2776Smcpowers crypto_ctx_template_t tmpl, crypto_data_t *ciphertext,
321894b2776Smcpowers crypto_call_req_t *crq)
3227c478bd9Sstevel@tonic-gate {
3237c478bd9Sstevel@tonic-gate kcf_req_params_t params;
324894b2776Smcpowers kcf_provider_desc_t *pd = provider;
325894b2776Smcpowers kcf_provider_desc_t *real_provider = pd;
326894b2776Smcpowers int error;
3277c478bd9Sstevel@tonic-gate
3287c478bd9Sstevel@tonic-gate ASSERT(KCF_PROV_REFHELD(pd));
329894b2776Smcpowers
330894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
331436935a1SVladimir Kotal error = kcf_get_hardware_provider(mech->cm_type, key,
332*9b009fc1SValerie Bubb Fenwick CRYPTO_MECH_INVALID, NULL, pd, &real_provider,
333*9b009fc1SValerie Bubb Fenwick CRYPTO_FG_ENCRYPT_ATOMIC);
334894b2776Smcpowers
335894b2776Smcpowers if (error != CRYPTO_SUCCESS)
336894b2776Smcpowers return (error);
337894b2776Smcpowers }
338894b2776Smcpowers
3397c478bd9Sstevel@tonic-gate KCF_WRAP_ENCRYPT_OPS_PARAMS(¶ms, KCF_OP_ATOMIC, sid, mech, key,
3407c478bd9Sstevel@tonic-gate plaintext, ciphertext, tmpl);
3417c478bd9Sstevel@tonic-gate
342894b2776Smcpowers error = kcf_submit_request(real_provider, NULL, crq, ¶ms, B_FALSE);
343894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)
344894b2776Smcpowers KCF_PROV_REFRELE(real_provider);
345894b2776Smcpowers
346894b2776Smcpowers return (error);
3477c478bd9Sstevel@tonic-gate }
3487c478bd9Sstevel@tonic-gate
3497c478bd9Sstevel@tonic-gate /*
3507c478bd9Sstevel@tonic-gate * Same as crypto_encrypt_prov(), but relies on the scheduler to pick
3517c478bd9Sstevel@tonic-gate * a provider. See crypto_encrypt_prov() for more details.
3527c478bd9Sstevel@tonic-gate */
3537c478bd9Sstevel@tonic-gate int
crypto_encrypt(crypto_mechanism_t * mech,crypto_data_t * plaintext,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_data_t * ciphertext,crypto_call_req_t * crq)3547c478bd9Sstevel@tonic-gate crypto_encrypt(crypto_mechanism_t *mech, crypto_data_t *plaintext,
3557c478bd9Sstevel@tonic-gate crypto_key_t *key, crypto_ctx_template_t tmpl, crypto_data_t *ciphertext,
3567c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
3577c478bd9Sstevel@tonic-gate {
3587c478bd9Sstevel@tonic-gate int error;
3597c478bd9Sstevel@tonic-gate kcf_mech_entry_t *me;
3607c478bd9Sstevel@tonic-gate kcf_req_params_t params;
3617c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
3627c478bd9Sstevel@tonic-gate kcf_ctx_template_t *ctx_tmpl;
3637c478bd9Sstevel@tonic-gate crypto_spi_ctx_template_t spi_ctx_tmpl = NULL;
3647c478bd9Sstevel@tonic-gate kcf_prov_tried_t *list = NULL;
3657c478bd9Sstevel@tonic-gate
3667c478bd9Sstevel@tonic-gate retry:
3677c478bd9Sstevel@tonic-gate /* pd is returned held */
368436935a1SVladimir Kotal if ((pd = kcf_get_mech_provider(mech->cm_type, key, &me, &error,
369*9b009fc1SValerie Bubb Fenwick list, CRYPTO_FG_ENCRYPT_ATOMIC, plaintext->cd_length)) == NULL) {
3707c478bd9Sstevel@tonic-gate if (list != NULL)
3717c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
3727c478bd9Sstevel@tonic-gate return (error);
3737c478bd9Sstevel@tonic-gate }
3747c478bd9Sstevel@tonic-gate
3757c478bd9Sstevel@tonic-gate /*
3767c478bd9Sstevel@tonic-gate * For SW providers, check the validity of the context template
3777c478bd9Sstevel@tonic-gate * It is very rare that the generation number mis-matches, so
3787c478bd9Sstevel@tonic-gate * is acceptable to fail here, and let the consumer recover by
3797c478bd9Sstevel@tonic-gate * freeing this tmpl and create a new one for the key and new SW
3807c478bd9Sstevel@tonic-gate * provider
3817c478bd9Sstevel@tonic-gate */
3827c478bd9Sstevel@tonic-gate if ((pd->pd_prov_type == CRYPTO_SW_PROVIDER) &&
3837c478bd9Sstevel@tonic-gate ((ctx_tmpl = (kcf_ctx_template_t *)tmpl) != NULL)) {
3847c478bd9Sstevel@tonic-gate if (ctx_tmpl->ct_generation != me->me_gen_swprov) {
3857c478bd9Sstevel@tonic-gate if (list != NULL)
3867c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
3877c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
3887c478bd9Sstevel@tonic-gate return (CRYPTO_OLD_CTX_TEMPLATE);
3897c478bd9Sstevel@tonic-gate } else {
3907c478bd9Sstevel@tonic-gate spi_ctx_tmpl = ctx_tmpl->ct_prov_tmpl;
3917c478bd9Sstevel@tonic-gate }
3927c478bd9Sstevel@tonic-gate }
3937c478bd9Sstevel@tonic-gate
3947c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
3957c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(crq, pd)) {
3967c478bd9Sstevel@tonic-gate crypto_mechanism_t lmech;
3977c478bd9Sstevel@tonic-gate
3987c478bd9Sstevel@tonic-gate lmech = *mech;
3997c478bd9Sstevel@tonic-gate KCF_SET_PROVIDER_MECHNUM(mech->cm_type, pd, &lmech);
4007c478bd9Sstevel@tonic-gate
4017c478bd9Sstevel@tonic-gate error = KCF_PROV_ENCRYPT_ATOMIC(pd, pd->pd_sid, &lmech, key,
4027c478bd9Sstevel@tonic-gate plaintext, ciphertext, spi_ctx_tmpl, KCF_SWFP_RHNDL(crq));
4037c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
4047c478bd9Sstevel@tonic-gate } else {
4057c478bd9Sstevel@tonic-gate KCF_WRAP_ENCRYPT_OPS_PARAMS(¶ms, KCF_OP_ATOMIC, pd->pd_sid,
4067c478bd9Sstevel@tonic-gate mech, key, plaintext, ciphertext, spi_ctx_tmpl);
4077c478bd9Sstevel@tonic-gate error = kcf_submit_request(pd, NULL, crq, ¶ms, B_FALSE);
4087c478bd9Sstevel@tonic-gate }
4097c478bd9Sstevel@tonic-gate
4107c478bd9Sstevel@tonic-gate if (error != CRYPTO_SUCCESS && error != CRYPTO_QUEUED &&
4117c478bd9Sstevel@tonic-gate IS_RECOVERABLE(error)) {
4127c478bd9Sstevel@tonic-gate /* Add pd to the linked list of providers tried. */
4137c478bd9Sstevel@tonic-gate if (kcf_insert_triedlist(&list, pd, KCF_KMFLAG(crq)) != NULL)
4147c478bd9Sstevel@tonic-gate goto retry;
4157c478bd9Sstevel@tonic-gate }
4167c478bd9Sstevel@tonic-gate
4177c478bd9Sstevel@tonic-gate if (list != NULL)
4187c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
4197c478bd9Sstevel@tonic-gate
4207c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
4217c478bd9Sstevel@tonic-gate return (error);
4227c478bd9Sstevel@tonic-gate }
4237c478bd9Sstevel@tonic-gate
4247c478bd9Sstevel@tonic-gate /*
4257c478bd9Sstevel@tonic-gate * crypto_encrypt_init_prov()
4267c478bd9Sstevel@tonic-gate *
4277c478bd9Sstevel@tonic-gate * Calls crypto_cipher_init_prov() to initialize an encryption operation.
4287c478bd9Sstevel@tonic-gate */
4297c478bd9Sstevel@tonic-gate int
crypto_encrypt_init_prov(crypto_provider_t pd,crypto_session_id_t sid,crypto_mechanism_t * mech,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_context_t * ctxp,crypto_call_req_t * crq)430894b2776Smcpowers crypto_encrypt_init_prov(crypto_provider_t pd, crypto_session_id_t sid,
4317c478bd9Sstevel@tonic-gate crypto_mechanism_t *mech, crypto_key_t *key,
4327c478bd9Sstevel@tonic-gate crypto_ctx_template_t tmpl, crypto_context_t *ctxp,
4337c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
4347c478bd9Sstevel@tonic-gate {
4357c478bd9Sstevel@tonic-gate return (crypto_cipher_init_prov(pd, sid, mech, key, tmpl, ctxp, crq,
4367c478bd9Sstevel@tonic-gate CRYPTO_FG_ENCRYPT));
4377c478bd9Sstevel@tonic-gate }
4387c478bd9Sstevel@tonic-gate
4397c478bd9Sstevel@tonic-gate /*
4407c478bd9Sstevel@tonic-gate * crypto_encrypt_init()
4417c478bd9Sstevel@tonic-gate *
4427c478bd9Sstevel@tonic-gate * Calls crypto_cipher_init() to initialize an encryption operation
4437c478bd9Sstevel@tonic-gate */
4447c478bd9Sstevel@tonic-gate int
crypto_encrypt_init(crypto_mechanism_t * mech,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_context_t * ctxp,crypto_call_req_t * crq)4457c478bd9Sstevel@tonic-gate crypto_encrypt_init(crypto_mechanism_t *mech, crypto_key_t *key,
4467c478bd9Sstevel@tonic-gate crypto_ctx_template_t tmpl, crypto_context_t *ctxp,
4477c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
4487c478bd9Sstevel@tonic-gate {
4497c478bd9Sstevel@tonic-gate return (crypto_cipher_init(mech, key, tmpl, ctxp, crq,
4507c478bd9Sstevel@tonic-gate CRYPTO_FG_ENCRYPT));
4517c478bd9Sstevel@tonic-gate }
4527c478bd9Sstevel@tonic-gate
4537c478bd9Sstevel@tonic-gate /*
4547c478bd9Sstevel@tonic-gate * crypto_encrypt_update()
4557c478bd9Sstevel@tonic-gate *
4567c478bd9Sstevel@tonic-gate * Arguments:
4577c478bd9Sstevel@tonic-gate * context: A crypto_context_t initialized by encrypt_init().
4587c478bd9Sstevel@tonic-gate * plaintext: The message part to be encrypted
4597c478bd9Sstevel@tonic-gate * ciphertext: Storage for the encrypted message part.
4607c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
4617c478bd9Sstevel@tonic-gate *
4627c478bd9Sstevel@tonic-gate * Description:
4637c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs a
4647c478bd9Sstevel@tonic-gate * part of an encryption operation.
4657c478bd9Sstevel@tonic-gate *
4667c478bd9Sstevel@tonic-gate * Context:
4677c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
4687c478bd9Sstevel@tonic-gate *
4697c478bd9Sstevel@tonic-gate * Returns:
4707c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
4717c478bd9Sstevel@tonic-gate */
4727c478bd9Sstevel@tonic-gate int
crypto_encrypt_update(crypto_context_t context,crypto_data_t * plaintext,crypto_data_t * ciphertext,crypto_call_req_t * cr)4737c478bd9Sstevel@tonic-gate crypto_encrypt_update(crypto_context_t context, crypto_data_t *plaintext,
4747c478bd9Sstevel@tonic-gate crypto_data_t *ciphertext, crypto_call_req_t *cr)
4757c478bd9Sstevel@tonic-gate {
4767c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
4777c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
4787c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
4797c478bd9Sstevel@tonic-gate int error;
4807c478bd9Sstevel@tonic-gate kcf_req_params_t params;
4817c478bd9Sstevel@tonic-gate
4827c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
4837c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
4847c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
4857c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
4867c478bd9Sstevel@tonic-gate }
4877c478bd9Sstevel@tonic-gate
488894b2776Smcpowers ASSERT(pd->pd_prov_type != CRYPTO_LOGICAL_PROVIDER);
4897c478bd9Sstevel@tonic-gate
4907c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
4917c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
4927c478bd9Sstevel@tonic-gate error = KCF_PROV_ENCRYPT_UPDATE(pd, ctx, plaintext,
4937c478bd9Sstevel@tonic-gate ciphertext, NULL);
4947c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
4956a1073f8Skrishna return (error);
4967c478bd9Sstevel@tonic-gate }
4977c478bd9Sstevel@tonic-gate
4986a1073f8Skrishna /* Check if we should use a software provider for small jobs */
4996a1073f8Skrishna if ((ctx->cc_flags & CRYPTO_USE_OPSTATE) && cr == NULL) {
5006a1073f8Skrishna if (plaintext->cd_length < kcf_ctx->kc_mech->me_threshold &&
5016a1073f8Skrishna kcf_ctx->kc_sw_prov_desc != NULL &&
5026a1073f8Skrishna KCF_IS_PROV_USABLE(kcf_ctx->kc_sw_prov_desc)) {
5036a1073f8Skrishna pd = kcf_ctx->kc_sw_prov_desc;
5046a1073f8Skrishna }
5056a1073f8Skrishna }
5066a1073f8Skrishna
5076a1073f8Skrishna KCF_WRAP_ENCRYPT_OPS_PARAMS(¶ms, KCF_OP_UPDATE,
5086a1073f8Skrishna ctx->cc_session, NULL, NULL, plaintext, ciphertext, NULL);
5096a1073f8Skrishna error = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
5106a1073f8Skrishna
5117c478bd9Sstevel@tonic-gate return (error);
5127c478bd9Sstevel@tonic-gate }
5137c478bd9Sstevel@tonic-gate
5147c478bd9Sstevel@tonic-gate /*
5157c478bd9Sstevel@tonic-gate * crypto_encrypt_final()
5167c478bd9Sstevel@tonic-gate *
5177c478bd9Sstevel@tonic-gate * Arguments:
5187c478bd9Sstevel@tonic-gate * context: A crypto_context_t initialized by encrypt_init().
5197c478bd9Sstevel@tonic-gate * ciphertext: Storage for the last part of encrypted message
5207c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
5217c478bd9Sstevel@tonic-gate *
5227c478bd9Sstevel@tonic-gate * Description:
5237c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs the
5247c478bd9Sstevel@tonic-gate * final part of an encryption operation.
5257c478bd9Sstevel@tonic-gate *
5267c478bd9Sstevel@tonic-gate * Context:
5277c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
5287c478bd9Sstevel@tonic-gate *
5297c478bd9Sstevel@tonic-gate * Returns:
5307c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
5317c478bd9Sstevel@tonic-gate */
5327c478bd9Sstevel@tonic-gate int
crypto_encrypt_final(crypto_context_t context,crypto_data_t * ciphertext,crypto_call_req_t * cr)5337c478bd9Sstevel@tonic-gate crypto_encrypt_final(crypto_context_t context, crypto_data_t *ciphertext,
5347c478bd9Sstevel@tonic-gate crypto_call_req_t *cr)
5357c478bd9Sstevel@tonic-gate {
5367c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
5377c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
5387c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
5397c478bd9Sstevel@tonic-gate int error;
5407c478bd9Sstevel@tonic-gate kcf_req_params_t params;
5417c478bd9Sstevel@tonic-gate
5427c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
5437c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
5447c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
5457c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
5467c478bd9Sstevel@tonic-gate }
5477c478bd9Sstevel@tonic-gate
548894b2776Smcpowers ASSERT(pd->pd_prov_type != CRYPTO_LOGICAL_PROVIDER);
5497c478bd9Sstevel@tonic-gate
5507c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
5517c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
5527c478bd9Sstevel@tonic-gate error = KCF_PROV_ENCRYPT_FINAL(pd, ctx, ciphertext, NULL);
5537c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
5547c478bd9Sstevel@tonic-gate } else {
555894b2776Smcpowers KCF_WRAP_ENCRYPT_OPS_PARAMS(¶ms, KCF_OP_FINAL,
556894b2776Smcpowers ctx->cc_session, NULL, NULL, NULL, ciphertext, NULL);
5577c478bd9Sstevel@tonic-gate error = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
5587c478bd9Sstevel@tonic-gate }
5597c478bd9Sstevel@tonic-gate
5607c478bd9Sstevel@tonic-gate /* Release the hold done in kcf_new_ctx() during init step. */
5617c478bd9Sstevel@tonic-gate KCF_CONTEXT_COND_RELEASE(error, kcf_ctx);
5627c478bd9Sstevel@tonic-gate return (error);
5637c478bd9Sstevel@tonic-gate }
5647c478bd9Sstevel@tonic-gate
5657c478bd9Sstevel@tonic-gate /*
5667c478bd9Sstevel@tonic-gate * crypto_decrypt_prov()
5677c478bd9Sstevel@tonic-gate *
5687c478bd9Sstevel@tonic-gate * Arguments:
5697c478bd9Sstevel@tonic-gate * pd: provider descriptor
5707c478bd9Sstevel@tonic-gate * sid: session id
5717c478bd9Sstevel@tonic-gate * mech: crypto_mechanism_t pointer.
5727c478bd9Sstevel@tonic-gate * mech_type is a valid value previously returned by
5737c478bd9Sstevel@tonic-gate * crypto_mech2id();
5747c478bd9Sstevel@tonic-gate * When the mech's parameter is not NULL, its definition depends
5757c478bd9Sstevel@tonic-gate * on the standard definition of the mechanism.
5767c478bd9Sstevel@tonic-gate * key: pointer to a crypto_key_t structure.
5777c478bd9Sstevel@tonic-gate * ciphertext: The message to be encrypted
5787c478bd9Sstevel@tonic-gate * plaintext: Storage for the encrypted message. The length needed
5797c478bd9Sstevel@tonic-gate * depends on the mechanism, and the plaintext's size.
5807c478bd9Sstevel@tonic-gate * tmpl: a crypto_ctx_template_t, opaque template of a context of an
5817c478bd9Sstevel@tonic-gate * encryption with the 'mech' using 'key'. 'tmpl' is created by
5827c478bd9Sstevel@tonic-gate * a previous call to crypto_create_ctx_template().
5837c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
5847c478bd9Sstevel@tonic-gate *
5857c478bd9Sstevel@tonic-gate * Description:
5867c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs a
5877c478bd9Sstevel@tonic-gate * single-part decryption of 'ciphertext' with the mechanism 'mech', using
5887c478bd9Sstevel@tonic-gate * the key 'key'.
5897c478bd9Sstevel@tonic-gate * When complete and successful, 'plaintext' will contain the decrypted
5907c478bd9Sstevel@tonic-gate * message.
5917c478bd9Sstevel@tonic-gate *
5927c478bd9Sstevel@tonic-gate * Context:
5937c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
5947c478bd9Sstevel@tonic-gate *
5957c478bd9Sstevel@tonic-gate * Returns:
5967c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
5977c478bd9Sstevel@tonic-gate */
5987c478bd9Sstevel@tonic-gate int
crypto_decrypt_prov(crypto_provider_t provider,crypto_session_id_t sid,crypto_mechanism_t * mech,crypto_data_t * ciphertext,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_data_t * plaintext,crypto_call_req_t * crq)599894b2776Smcpowers crypto_decrypt_prov(crypto_provider_t provider, crypto_session_id_t sid,
600894b2776Smcpowers crypto_mechanism_t *mech, crypto_data_t *ciphertext, crypto_key_t *key,
601894b2776Smcpowers crypto_ctx_template_t tmpl, crypto_data_t *plaintext,
602894b2776Smcpowers crypto_call_req_t *crq)
6037c478bd9Sstevel@tonic-gate {
6047c478bd9Sstevel@tonic-gate kcf_req_params_t params;
605894b2776Smcpowers kcf_provider_desc_t *pd = provider;
606894b2776Smcpowers kcf_provider_desc_t *real_provider = pd;
607894b2776Smcpowers int rv;
6087c478bd9Sstevel@tonic-gate
6097c478bd9Sstevel@tonic-gate ASSERT(KCF_PROV_REFHELD(pd));
610894b2776Smcpowers
611894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
612436935a1SVladimir Kotal rv = kcf_get_hardware_provider(mech->cm_type, key,
613*9b009fc1SValerie Bubb Fenwick CRYPTO_MECH_INVALID, NULL, pd, &real_provider,
614*9b009fc1SValerie Bubb Fenwick CRYPTO_FG_DECRYPT_ATOMIC);
615894b2776Smcpowers
616894b2776Smcpowers if (rv != CRYPTO_SUCCESS)
617894b2776Smcpowers return (rv);
618894b2776Smcpowers }
619894b2776Smcpowers
6207c478bd9Sstevel@tonic-gate KCF_WRAP_DECRYPT_OPS_PARAMS(¶ms, KCF_OP_ATOMIC, sid, mech, key,
6217c478bd9Sstevel@tonic-gate ciphertext, plaintext, tmpl);
6227c478bd9Sstevel@tonic-gate
623894b2776Smcpowers rv = kcf_submit_request(real_provider, NULL, crq, ¶ms, B_FALSE);
624894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)
625894b2776Smcpowers KCF_PROV_REFRELE(real_provider);
626894b2776Smcpowers
627894b2776Smcpowers return (rv);
6287c478bd9Sstevel@tonic-gate }
6297c478bd9Sstevel@tonic-gate
6307c478bd9Sstevel@tonic-gate /*
6317c478bd9Sstevel@tonic-gate * Same as crypto_decrypt_prov(), but relies on the KCF scheduler to
6327c478bd9Sstevel@tonic-gate * choose a provider. See crypto_decrypt_prov() comments for more
6337c478bd9Sstevel@tonic-gate * information.
6347c478bd9Sstevel@tonic-gate */
6357c478bd9Sstevel@tonic-gate int
crypto_decrypt(crypto_mechanism_t * mech,crypto_data_t * ciphertext,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_data_t * plaintext,crypto_call_req_t * crq)6367c478bd9Sstevel@tonic-gate crypto_decrypt(crypto_mechanism_t *mech, crypto_data_t *ciphertext,
6377c478bd9Sstevel@tonic-gate crypto_key_t *key, crypto_ctx_template_t tmpl, crypto_data_t *plaintext,
6387c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
6397c478bd9Sstevel@tonic-gate {
6407c478bd9Sstevel@tonic-gate int error;
6417c478bd9Sstevel@tonic-gate kcf_mech_entry_t *me;
6427c478bd9Sstevel@tonic-gate kcf_req_params_t params;
6437c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
6447c478bd9Sstevel@tonic-gate kcf_ctx_template_t *ctx_tmpl;
6457c478bd9Sstevel@tonic-gate crypto_spi_ctx_template_t spi_ctx_tmpl = NULL;
6467c478bd9Sstevel@tonic-gate kcf_prov_tried_t *list = NULL;
6477c478bd9Sstevel@tonic-gate
6487c478bd9Sstevel@tonic-gate retry:
6497c478bd9Sstevel@tonic-gate /* pd is returned held */
650436935a1SVladimir Kotal if ((pd = kcf_get_mech_provider(mech->cm_type, key, &me, &error,
651*9b009fc1SValerie Bubb Fenwick list, CRYPTO_FG_DECRYPT_ATOMIC, ciphertext->cd_length)) == NULL) {
6527c478bd9Sstevel@tonic-gate if (list != NULL)
6537c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
6547c478bd9Sstevel@tonic-gate return (error);
6557c478bd9Sstevel@tonic-gate }
6567c478bd9Sstevel@tonic-gate
6577c478bd9Sstevel@tonic-gate /*
6587c478bd9Sstevel@tonic-gate * For SW providers, check the validity of the context template
6597c478bd9Sstevel@tonic-gate * It is very rare that the generation number mis-matches, so
6607c478bd9Sstevel@tonic-gate * is acceptable to fail here, and let the consumer recover by
6617c478bd9Sstevel@tonic-gate * freeing this tmpl and create a new one for the key and new SW
6627c478bd9Sstevel@tonic-gate * provider
6637c478bd9Sstevel@tonic-gate */
6647c478bd9Sstevel@tonic-gate if ((pd->pd_prov_type == CRYPTO_SW_PROVIDER) &&
6657c478bd9Sstevel@tonic-gate ((ctx_tmpl = (kcf_ctx_template_t *)tmpl) != NULL)) {
6667c478bd9Sstevel@tonic-gate if (ctx_tmpl->ct_generation != me->me_gen_swprov) {
6677c478bd9Sstevel@tonic-gate if (list != NULL)
6687c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
6697c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
6707c478bd9Sstevel@tonic-gate return (CRYPTO_OLD_CTX_TEMPLATE);
6717c478bd9Sstevel@tonic-gate } else {
6727c478bd9Sstevel@tonic-gate spi_ctx_tmpl = ctx_tmpl->ct_prov_tmpl;
6737c478bd9Sstevel@tonic-gate }
6747c478bd9Sstevel@tonic-gate }
6757c478bd9Sstevel@tonic-gate
6767c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
6777c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(crq, pd)) {
6787c478bd9Sstevel@tonic-gate crypto_mechanism_t lmech;
6797c478bd9Sstevel@tonic-gate
6807c478bd9Sstevel@tonic-gate lmech = *mech;
6817c478bd9Sstevel@tonic-gate KCF_SET_PROVIDER_MECHNUM(mech->cm_type, pd, &lmech);
6827c478bd9Sstevel@tonic-gate
6837c478bd9Sstevel@tonic-gate error = KCF_PROV_DECRYPT_ATOMIC(pd, pd->pd_sid, &lmech, key,
6847c478bd9Sstevel@tonic-gate ciphertext, plaintext, spi_ctx_tmpl, KCF_SWFP_RHNDL(crq));
6857c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
6867c478bd9Sstevel@tonic-gate } else {
6877c478bd9Sstevel@tonic-gate KCF_WRAP_DECRYPT_OPS_PARAMS(¶ms, KCF_OP_ATOMIC, pd->pd_sid,
6887c478bd9Sstevel@tonic-gate mech, key, ciphertext, plaintext, spi_ctx_tmpl);
6897c478bd9Sstevel@tonic-gate error = kcf_submit_request(pd, NULL, crq, ¶ms, B_FALSE);
6907c478bd9Sstevel@tonic-gate }
6917c478bd9Sstevel@tonic-gate
6927c478bd9Sstevel@tonic-gate if (error != CRYPTO_SUCCESS && error != CRYPTO_QUEUED &&
6937c478bd9Sstevel@tonic-gate IS_RECOVERABLE(error)) {
6947c478bd9Sstevel@tonic-gate /* Add pd to the linked list of providers tried. */
6957c478bd9Sstevel@tonic-gate if (kcf_insert_triedlist(&list, pd, KCF_KMFLAG(crq)) != NULL)
6967c478bd9Sstevel@tonic-gate goto retry;
6977c478bd9Sstevel@tonic-gate }
6987c478bd9Sstevel@tonic-gate
6997c478bd9Sstevel@tonic-gate if (list != NULL)
7007c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
7017c478bd9Sstevel@tonic-gate
7027c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
7037c478bd9Sstevel@tonic-gate return (error);
7047c478bd9Sstevel@tonic-gate }
7057c478bd9Sstevel@tonic-gate
7067c478bd9Sstevel@tonic-gate /*
7077c478bd9Sstevel@tonic-gate * crypto_decrypt_init_prov()
7087c478bd9Sstevel@tonic-gate *
7097c478bd9Sstevel@tonic-gate * Calls crypto_cipher_init_prov() to initialize a decryption operation
7107c478bd9Sstevel@tonic-gate */
7117c478bd9Sstevel@tonic-gate int
crypto_decrypt_init_prov(crypto_provider_t pd,crypto_session_id_t sid,crypto_mechanism_t * mech,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_context_t * ctxp,crypto_call_req_t * crq)712894b2776Smcpowers crypto_decrypt_init_prov(crypto_provider_t pd, crypto_session_id_t sid,
7137c478bd9Sstevel@tonic-gate crypto_mechanism_t *mech, crypto_key_t *key,
7147c478bd9Sstevel@tonic-gate crypto_ctx_template_t tmpl, crypto_context_t *ctxp,
7157c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
7167c478bd9Sstevel@tonic-gate {
7177c478bd9Sstevel@tonic-gate return (crypto_cipher_init_prov(pd, sid, mech, key, tmpl, ctxp, crq,
7187c478bd9Sstevel@tonic-gate CRYPTO_FG_DECRYPT));
7197c478bd9Sstevel@tonic-gate }
7207c478bd9Sstevel@tonic-gate
7217c478bd9Sstevel@tonic-gate /*
7227c478bd9Sstevel@tonic-gate * crypto_decrypt_init()
7237c478bd9Sstevel@tonic-gate *
7247c478bd9Sstevel@tonic-gate * Calls crypto_cipher_init() to initialize a decryption operation
7257c478bd9Sstevel@tonic-gate */
7267c478bd9Sstevel@tonic-gate int
crypto_decrypt_init(crypto_mechanism_t * mech,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_context_t * ctxp,crypto_call_req_t * crq)7277c478bd9Sstevel@tonic-gate crypto_decrypt_init(crypto_mechanism_t *mech, crypto_key_t *key,
7287c478bd9Sstevel@tonic-gate crypto_ctx_template_t tmpl, crypto_context_t *ctxp,
7297c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
7307c478bd9Sstevel@tonic-gate {
7317c478bd9Sstevel@tonic-gate return (crypto_cipher_init(mech, key, tmpl, ctxp, crq,
7327c478bd9Sstevel@tonic-gate CRYPTO_FG_DECRYPT));
7337c478bd9Sstevel@tonic-gate }
7347c478bd9Sstevel@tonic-gate
7357c478bd9Sstevel@tonic-gate /*
7367c478bd9Sstevel@tonic-gate * crypto_decrypt_update()
7377c478bd9Sstevel@tonic-gate *
7387c478bd9Sstevel@tonic-gate * Arguments:
7397c478bd9Sstevel@tonic-gate * context: A crypto_context_t initialized by decrypt_init().
7407c478bd9Sstevel@tonic-gate * ciphertext: The message part to be decrypted
7417c478bd9Sstevel@tonic-gate * plaintext: Storage for the decrypted message part.
7427c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
7437c478bd9Sstevel@tonic-gate *
7447c478bd9Sstevel@tonic-gate * Description:
7457c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs a
7467c478bd9Sstevel@tonic-gate * part of an decryption operation.
7477c478bd9Sstevel@tonic-gate *
7487c478bd9Sstevel@tonic-gate * Context:
7497c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
7507c478bd9Sstevel@tonic-gate *
7517c478bd9Sstevel@tonic-gate * Returns:
7527c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
7537c478bd9Sstevel@tonic-gate */
7547c478bd9Sstevel@tonic-gate int
crypto_decrypt_update(crypto_context_t context,crypto_data_t * ciphertext,crypto_data_t * plaintext,crypto_call_req_t * cr)7557c478bd9Sstevel@tonic-gate crypto_decrypt_update(crypto_context_t context, crypto_data_t *ciphertext,
7567c478bd9Sstevel@tonic-gate crypto_data_t *plaintext, crypto_call_req_t *cr)
7577c478bd9Sstevel@tonic-gate {
7587c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
7597c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
7607c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
7617c478bd9Sstevel@tonic-gate int error;
7627c478bd9Sstevel@tonic-gate kcf_req_params_t params;
7637c478bd9Sstevel@tonic-gate
7647c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
7657c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
7667c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
7677c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
7687c478bd9Sstevel@tonic-gate }
7697c478bd9Sstevel@tonic-gate
770894b2776Smcpowers ASSERT(pd->pd_prov_type != CRYPTO_LOGICAL_PROVIDER);
7717c478bd9Sstevel@tonic-gate
7727c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
7737c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
7747c478bd9Sstevel@tonic-gate error = KCF_PROV_DECRYPT_UPDATE(pd, ctx, ciphertext,
7757c478bd9Sstevel@tonic-gate plaintext, NULL);
7767c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
7776a1073f8Skrishna return (error);
7787c478bd9Sstevel@tonic-gate }
7797c478bd9Sstevel@tonic-gate
7806a1073f8Skrishna /* Check if we should use a software provider for small jobs */
7816a1073f8Skrishna if ((ctx->cc_flags & CRYPTO_USE_OPSTATE) && cr == NULL) {
7826a1073f8Skrishna if (ciphertext->cd_length < kcf_ctx->kc_mech->me_threshold &&
7836a1073f8Skrishna kcf_ctx->kc_sw_prov_desc != NULL &&
7846a1073f8Skrishna KCF_IS_PROV_USABLE(kcf_ctx->kc_sw_prov_desc)) {
7856a1073f8Skrishna pd = kcf_ctx->kc_sw_prov_desc;
7866a1073f8Skrishna }
7876a1073f8Skrishna }
7886a1073f8Skrishna
7896a1073f8Skrishna KCF_WRAP_DECRYPT_OPS_PARAMS(¶ms, KCF_OP_UPDATE,
7906a1073f8Skrishna ctx->cc_session, NULL, NULL, ciphertext, plaintext, NULL);
7916a1073f8Skrishna error = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
7926a1073f8Skrishna
7937c478bd9Sstevel@tonic-gate return (error);
7947c478bd9Sstevel@tonic-gate }
7957c478bd9Sstevel@tonic-gate
7967c478bd9Sstevel@tonic-gate /*
7977c478bd9Sstevel@tonic-gate * crypto_decrypt_final()
7987c478bd9Sstevel@tonic-gate *
7997c478bd9Sstevel@tonic-gate * Arguments:
8007c478bd9Sstevel@tonic-gate * context: A crypto_context_t initialized by decrypt_init().
8017c478bd9Sstevel@tonic-gate * plaintext: Storage for the last part of the decrypted message
8027c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
8037c478bd9Sstevel@tonic-gate *
8047c478bd9Sstevel@tonic-gate * Description:
8057c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs the
8067c478bd9Sstevel@tonic-gate * final part of a decryption operation.
8077c478bd9Sstevel@tonic-gate *
8087c478bd9Sstevel@tonic-gate * Context:
8097c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
8107c478bd9Sstevel@tonic-gate *
8117c478bd9Sstevel@tonic-gate * Returns:
8127c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
8137c478bd9Sstevel@tonic-gate */
8147c478bd9Sstevel@tonic-gate int
crypto_decrypt_final(crypto_context_t context,crypto_data_t * plaintext,crypto_call_req_t * cr)8157c478bd9Sstevel@tonic-gate crypto_decrypt_final(crypto_context_t context, crypto_data_t *plaintext,
8167c478bd9Sstevel@tonic-gate crypto_call_req_t *cr)
8177c478bd9Sstevel@tonic-gate {
8187c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
8197c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
8207c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
8217c478bd9Sstevel@tonic-gate int error;
8227c478bd9Sstevel@tonic-gate kcf_req_params_t params;
8237c478bd9Sstevel@tonic-gate
8247c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
8257c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
8267c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
8277c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
8287c478bd9Sstevel@tonic-gate }
8297c478bd9Sstevel@tonic-gate
830894b2776Smcpowers ASSERT(pd->pd_prov_type != CRYPTO_LOGICAL_PROVIDER);
8317c478bd9Sstevel@tonic-gate
8327c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
8337c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
834894b2776Smcpowers error = KCF_PROV_DECRYPT_FINAL(pd, ctx, plaintext,
835894b2776Smcpowers NULL);
8367c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
8377c478bd9Sstevel@tonic-gate } else {
838894b2776Smcpowers KCF_WRAP_DECRYPT_OPS_PARAMS(¶ms, KCF_OP_FINAL,
839894b2776Smcpowers ctx->cc_session, NULL, NULL, NULL, plaintext, NULL);
8407c478bd9Sstevel@tonic-gate error = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
8417c478bd9Sstevel@tonic-gate }
8427c478bd9Sstevel@tonic-gate
8437c478bd9Sstevel@tonic-gate /* Release the hold done in kcf_new_ctx() during init step. */
8447c478bd9Sstevel@tonic-gate KCF_CONTEXT_COND_RELEASE(error, kcf_ctx);
8457c478bd9Sstevel@tonic-gate return (error);
8467c478bd9Sstevel@tonic-gate }
8477c478bd9Sstevel@tonic-gate
8487c478bd9Sstevel@tonic-gate /*
8497c478bd9Sstevel@tonic-gate * See comments for crypto_encrypt_update().
8507c478bd9Sstevel@tonic-gate */
8517c478bd9Sstevel@tonic-gate int
crypto_encrypt_single(crypto_context_t context,crypto_data_t * plaintext,crypto_data_t * ciphertext,crypto_call_req_t * cr)8527c478bd9Sstevel@tonic-gate crypto_encrypt_single(crypto_context_t context, crypto_data_t *plaintext,
8537c478bd9Sstevel@tonic-gate crypto_data_t *ciphertext, crypto_call_req_t *cr)
8547c478bd9Sstevel@tonic-gate {
8557c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
8567c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
8577c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
8587c478bd9Sstevel@tonic-gate int error;
8597c478bd9Sstevel@tonic-gate kcf_req_params_t params;
8607c478bd9Sstevel@tonic-gate
8617c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
8627c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
8637c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
8647c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
8657c478bd9Sstevel@tonic-gate }
8667c478bd9Sstevel@tonic-gate
8677c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
8687c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
8697c478bd9Sstevel@tonic-gate error = KCF_PROV_ENCRYPT(pd, ctx, plaintext,
8707c478bd9Sstevel@tonic-gate ciphertext, NULL);
8717c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
8727c478bd9Sstevel@tonic-gate } else {
8737c478bd9Sstevel@tonic-gate KCF_WRAP_ENCRYPT_OPS_PARAMS(¶ms, KCF_OP_SINGLE, pd->pd_sid,
8747c478bd9Sstevel@tonic-gate NULL, NULL, plaintext, ciphertext, NULL);
8757c478bd9Sstevel@tonic-gate error = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
8767c478bd9Sstevel@tonic-gate }
8777c478bd9Sstevel@tonic-gate
8787c478bd9Sstevel@tonic-gate /* Release the hold done in kcf_new_ctx() during init step. */
8797c478bd9Sstevel@tonic-gate KCF_CONTEXT_COND_RELEASE(error, kcf_ctx);
8807c478bd9Sstevel@tonic-gate return (error);
8817c478bd9Sstevel@tonic-gate }
8827c478bd9Sstevel@tonic-gate
8837c478bd9Sstevel@tonic-gate /*
8847c478bd9Sstevel@tonic-gate * See comments for crypto_decrypt_update().
8857c478bd9Sstevel@tonic-gate */
8867c478bd9Sstevel@tonic-gate int
crypto_decrypt_single(crypto_context_t context,crypto_data_t * ciphertext,crypto_data_t * plaintext,crypto_call_req_t * cr)8877c478bd9Sstevel@tonic-gate crypto_decrypt_single(crypto_context_t context, crypto_data_t *ciphertext,
8887c478bd9Sstevel@tonic-gate crypto_data_t *plaintext, crypto_call_req_t *cr)
8897c478bd9Sstevel@tonic-gate {
8907c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
8917c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
8927c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
8937c478bd9Sstevel@tonic-gate int error;
8947c478bd9Sstevel@tonic-gate kcf_req_params_t params;
8957c478bd9Sstevel@tonic-gate
8967c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
8977c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
8987c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
8997c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
9007c478bd9Sstevel@tonic-gate }
9017c478bd9Sstevel@tonic-gate
9027c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
9037c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
9047c478bd9Sstevel@tonic-gate error = KCF_PROV_DECRYPT(pd, ctx, ciphertext,
9057c478bd9Sstevel@tonic-gate plaintext, NULL);
9067c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
9077c478bd9Sstevel@tonic-gate } else {
9087c478bd9Sstevel@tonic-gate KCF_WRAP_DECRYPT_OPS_PARAMS(¶ms, KCF_OP_SINGLE, pd->pd_sid,
9097c478bd9Sstevel@tonic-gate NULL, NULL, ciphertext, plaintext, NULL);
9107c478bd9Sstevel@tonic-gate error = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
9117c478bd9Sstevel@tonic-gate }
9127c478bd9Sstevel@tonic-gate
9137c478bd9Sstevel@tonic-gate /* Release the hold done in kcf_new_ctx() during init step. */
9147c478bd9Sstevel@tonic-gate KCF_CONTEXT_COND_RELEASE(error, kcf_ctx);
9157c478bd9Sstevel@tonic-gate return (error);
9167c478bd9Sstevel@tonic-gate }
917