17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
572eff6e2Smcpowers * Common Development and Distribution License (the "License").
672eff6e2Smcpowers * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*9b009fc1SValerie Bubb Fenwick * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
247c478bd9Sstevel@tonic-gate
257c478bd9Sstevel@tonic-gate #include <sys/errno.h>
267c478bd9Sstevel@tonic-gate #include <sys/types.h>
277c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
28894b2776Smcpowers #include <sys/sysmacros.h>
297c478bd9Sstevel@tonic-gate #include <sys/crypto/common.h>
307c478bd9Sstevel@tonic-gate #include <sys/crypto/impl.h>
317c478bd9Sstevel@tonic-gate #include <sys/crypto/api.h>
327c478bd9Sstevel@tonic-gate #include <sys/crypto/spi.h>
337c478bd9Sstevel@tonic-gate #include <sys/crypto/sched_impl.h>
347c478bd9Sstevel@tonic-gate
35894b2776Smcpowers #define CRYPTO_OPS_OFFSET(f) offsetof(crypto_ops_t, co_##f)
36894b2776Smcpowers #define CRYPTO_MAC_OFFSET(f) offsetof(crypto_mac_ops_t, f)
37894b2776Smcpowers
387c478bd9Sstevel@tonic-gate /*
397c478bd9Sstevel@tonic-gate * Message authentication codes routines.
407c478bd9Sstevel@tonic-gate */
417c478bd9Sstevel@tonic-gate
427c478bd9Sstevel@tonic-gate /*
437c478bd9Sstevel@tonic-gate * The following are the possible returned values common to all the routines
447c478bd9Sstevel@tonic-gate * below. The applicability of some of these return values depends on the
457c478bd9Sstevel@tonic-gate * presence of the arguments.
467c478bd9Sstevel@tonic-gate *
477c478bd9Sstevel@tonic-gate * CRYPTO_SUCCESS: The operation completed successfully.
487c478bd9Sstevel@tonic-gate * CRYPTO_QUEUED: A request was submitted successfully. The callback
497c478bd9Sstevel@tonic-gate * routine will be called when the operation is done.
507c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_MECH_NUMBER, CRYPTO_INVALID_MECH_PARAM, or
517c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_MECH for problems with the 'mech'.
527c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_DATA for bogus 'data'
537c478bd9Sstevel@tonic-gate * CRYPTO_HOST_MEMORY for failure to allocate memory to handle this work.
547c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_CONTEXT: Not a valid context.
557c478bd9Sstevel@tonic-gate * CRYPTO_BUSY: Cannot process the request now. Schedule a
567c478bd9Sstevel@tonic-gate * crypto_bufcall(), or try later.
577c478bd9Sstevel@tonic-gate * CRYPTO_NOT_SUPPORTED and CRYPTO_MECH_NOT_SUPPORTED: No provider is
587c478bd9Sstevel@tonic-gate * capable of a function or a mechanism.
597c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_KEY: bogus 'key' argument.
607c478bd9Sstevel@tonic-gate * CRYPTO_INVALID_MAC: bogus 'mac' argument.
617c478bd9Sstevel@tonic-gate */
627c478bd9Sstevel@tonic-gate
637c478bd9Sstevel@tonic-gate /*
647c478bd9Sstevel@tonic-gate * crypto_mac_prov()
657c478bd9Sstevel@tonic-gate *
667c478bd9Sstevel@tonic-gate * Arguments:
677c478bd9Sstevel@tonic-gate * mech: crypto_mechanism_t pointer.
687c478bd9Sstevel@tonic-gate * mech_type is a valid value previously returned by
697c478bd9Sstevel@tonic-gate * crypto_mech2id();
707c478bd9Sstevel@tonic-gate * When the mech's parameter is not NULL, its definition depends
717c478bd9Sstevel@tonic-gate * on the standard definition of the mechanism.
727c478bd9Sstevel@tonic-gate * key: pointer to a crypto_key_t structure.
737c478bd9Sstevel@tonic-gate * data: The message to compute the MAC for.
747c478bd9Sstevel@tonic-gate * mac: Storage for the MAC. The length needed depends on the mechanism.
757c478bd9Sstevel@tonic-gate * tmpl: a crypto_ctx_template_t, opaque template of a context of a
767c478bd9Sstevel@tonic-gate * MAC with the 'mech' using 'key'. 'tmpl' is created by
777c478bd9Sstevel@tonic-gate * a previous call to crypto_create_ctx_template().
787c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
797c478bd9Sstevel@tonic-gate *
807c478bd9Sstevel@tonic-gate * Description:
817c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs a
827c478bd9Sstevel@tonic-gate * single-part message authentication of 'data' with the mechanism
837c478bd9Sstevel@tonic-gate * 'mech', using * the key 'key', on the specified provider with
847c478bd9Sstevel@tonic-gate * the specified session id.
857c478bd9Sstevel@tonic-gate * When complete and successful, 'mac' will contain the message
867c478bd9Sstevel@tonic-gate * authentication code.
877c478bd9Sstevel@tonic-gate *
887c478bd9Sstevel@tonic-gate * Context:
897c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'crq'.
907c478bd9Sstevel@tonic-gate *
917c478bd9Sstevel@tonic-gate * Returns:
927c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
937c478bd9Sstevel@tonic-gate */
947c478bd9Sstevel@tonic-gate int
crypto_mac_prov(crypto_provider_t provider,crypto_session_id_t sid,crypto_mechanism_t * mech,crypto_data_t * data,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_data_t * mac,crypto_call_req_t * crq)95894b2776Smcpowers crypto_mac_prov(crypto_provider_t provider, crypto_session_id_t sid,
96894b2776Smcpowers crypto_mechanism_t *mech, crypto_data_t *data, crypto_key_t *key,
97894b2776Smcpowers crypto_ctx_template_t tmpl, crypto_data_t *mac, crypto_call_req_t *crq)
987c478bd9Sstevel@tonic-gate {
997c478bd9Sstevel@tonic-gate kcf_req_params_t params;
100894b2776Smcpowers kcf_provider_desc_t *pd = provider;
101894b2776Smcpowers kcf_provider_desc_t *real_provider = pd;
102894b2776Smcpowers int rv;
1037c478bd9Sstevel@tonic-gate
1047c478bd9Sstevel@tonic-gate ASSERT(KCF_PROV_REFHELD(pd));
105894b2776Smcpowers
106894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
107436935a1SVladimir Kotal rv = kcf_get_hardware_provider(mech->cm_type, key,
108*9b009fc1SValerie Bubb Fenwick CRYPTO_MECH_INVALID, NULL, pd, &real_provider,
109*9b009fc1SValerie Bubb Fenwick CRYPTO_FG_MAC_ATOMIC);
110894b2776Smcpowers
111894b2776Smcpowers if (rv != CRYPTO_SUCCESS)
112894b2776Smcpowers return (rv);
113894b2776Smcpowers }
114894b2776Smcpowers
1157c478bd9Sstevel@tonic-gate KCF_WRAP_MAC_OPS_PARAMS(¶ms, KCF_OP_ATOMIC, sid, mech, key,
1167c478bd9Sstevel@tonic-gate data, mac, tmpl);
117894b2776Smcpowers rv = kcf_submit_request(real_provider, NULL, crq, ¶ms, B_FALSE);
118894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)
119894b2776Smcpowers KCF_PROV_REFRELE(real_provider);
1207c478bd9Sstevel@tonic-gate
121894b2776Smcpowers return (rv);
1227c478bd9Sstevel@tonic-gate }
1237c478bd9Sstevel@tonic-gate
1247c478bd9Sstevel@tonic-gate /*
1257c478bd9Sstevel@tonic-gate * Same as crypto_mac_prov(), but relies on the KCF scheduler to choose
1267c478bd9Sstevel@tonic-gate * a provider. See crypto_mac() comments for more information.
1277c478bd9Sstevel@tonic-gate */
1287c478bd9Sstevel@tonic-gate int
crypto_mac(crypto_mechanism_t * mech,crypto_data_t * data,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_data_t * mac,crypto_call_req_t * crq)1297c478bd9Sstevel@tonic-gate crypto_mac(crypto_mechanism_t *mech, crypto_data_t *data,
1307c478bd9Sstevel@tonic-gate crypto_key_t *key, crypto_ctx_template_t tmpl, crypto_data_t *mac,
1317c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
1327c478bd9Sstevel@tonic-gate {
1337c478bd9Sstevel@tonic-gate int error;
1347c478bd9Sstevel@tonic-gate kcf_mech_entry_t *me;
1357c478bd9Sstevel@tonic-gate kcf_req_params_t params;
1367c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
1377c478bd9Sstevel@tonic-gate kcf_ctx_template_t *ctx_tmpl;
1387c478bd9Sstevel@tonic-gate crypto_spi_ctx_template_t spi_ctx_tmpl = NULL;
1397c478bd9Sstevel@tonic-gate kcf_prov_tried_t *list = NULL;
1407c478bd9Sstevel@tonic-gate
1417c478bd9Sstevel@tonic-gate retry:
1427c478bd9Sstevel@tonic-gate /* The pd is returned held */
143436935a1SVladimir Kotal if ((pd = kcf_get_mech_provider(mech->cm_type, key, &me, &error,
144*9b009fc1SValerie Bubb Fenwick list, CRYPTO_FG_MAC_ATOMIC, data->cd_length)) == NULL) {
1457c478bd9Sstevel@tonic-gate if (list != NULL)
1467c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
1477c478bd9Sstevel@tonic-gate return (error);
1487c478bd9Sstevel@tonic-gate }
1497c478bd9Sstevel@tonic-gate
1507c478bd9Sstevel@tonic-gate /*
1517c478bd9Sstevel@tonic-gate * For SW providers, check the validity of the context template
1527c478bd9Sstevel@tonic-gate * It is very rare that the generation number mis-matches, so
1537c478bd9Sstevel@tonic-gate * is acceptable to fail here, and let the consumer recover by
1547c478bd9Sstevel@tonic-gate * freeing this tmpl and create a new one for the key and new SW
1557c478bd9Sstevel@tonic-gate * provider
1567c478bd9Sstevel@tonic-gate */
1577c478bd9Sstevel@tonic-gate if ((pd->pd_prov_type == CRYPTO_SW_PROVIDER) &&
1587c478bd9Sstevel@tonic-gate ((ctx_tmpl = (kcf_ctx_template_t *)tmpl) != NULL)) {
1597c478bd9Sstevel@tonic-gate if (ctx_tmpl->ct_generation != me->me_gen_swprov) {
1607c478bd9Sstevel@tonic-gate if (list != NULL)
1617c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
1627c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
1637c478bd9Sstevel@tonic-gate return (CRYPTO_OLD_CTX_TEMPLATE);
1647c478bd9Sstevel@tonic-gate } else {
1657c478bd9Sstevel@tonic-gate spi_ctx_tmpl = ctx_tmpl->ct_prov_tmpl;
1667c478bd9Sstevel@tonic-gate }
1677c478bd9Sstevel@tonic-gate }
1687c478bd9Sstevel@tonic-gate
1697c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
1707c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(crq, pd)) {
1717c478bd9Sstevel@tonic-gate crypto_mechanism_t lmech;
1727c478bd9Sstevel@tonic-gate
1737c478bd9Sstevel@tonic-gate lmech = *mech;
1747c478bd9Sstevel@tonic-gate KCF_SET_PROVIDER_MECHNUM(mech->cm_type, pd, &lmech);
1757c478bd9Sstevel@tonic-gate
1767c478bd9Sstevel@tonic-gate error = KCF_PROV_MAC_ATOMIC(pd, pd->pd_sid, &lmech, key, data,
1777c478bd9Sstevel@tonic-gate mac, spi_ctx_tmpl, KCF_SWFP_RHNDL(crq));
1787c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
1797c478bd9Sstevel@tonic-gate } else {
180ba5f469cSkrishna if (pd->pd_prov_type == CRYPTO_HW_PROVIDER &&
1814df55fdeSJanie Lu (pd->pd_flags & CRYPTO_HMAC_NO_UPDATE) &&
1824df55fdeSJanie Lu (data->cd_length > pd->pd_hmac_limit)) {
183ba5f469cSkrishna /*
184ba5f469cSkrishna * XXX - We need a check to see if this is indeed
185ba5f469cSkrishna * a HMAC. So far, all kernel clients use
186ba5f469cSkrishna * this interface only for HMAC. So, this is fine
187ba5f469cSkrishna * for now.
188ba5f469cSkrishna */
189ba5f469cSkrishna error = CRYPTO_BUFFER_TOO_BIG;
190ba5f469cSkrishna } else {
191ba5f469cSkrishna KCF_WRAP_MAC_OPS_PARAMS(¶ms, KCF_OP_ATOMIC,
192ba5f469cSkrishna pd->pd_sid, mech, key, data, mac, spi_ctx_tmpl);
1937c478bd9Sstevel@tonic-gate
194ba5f469cSkrishna error = kcf_submit_request(pd, NULL, crq, ¶ms,
195ba5f469cSkrishna KCF_ISDUALREQ(crq));
196ba5f469cSkrishna }
1977c478bd9Sstevel@tonic-gate }
1987c478bd9Sstevel@tonic-gate
1997c478bd9Sstevel@tonic-gate if (error != CRYPTO_SUCCESS && error != CRYPTO_QUEUED &&
2007c478bd9Sstevel@tonic-gate IS_RECOVERABLE(error)) {
2017c478bd9Sstevel@tonic-gate /* Add pd to the linked list of providers tried. */
2027c478bd9Sstevel@tonic-gate if (kcf_insert_triedlist(&list, pd, KCF_KMFLAG(crq)) != NULL)
2037c478bd9Sstevel@tonic-gate goto retry;
2047c478bd9Sstevel@tonic-gate }
2057c478bd9Sstevel@tonic-gate
2067c478bd9Sstevel@tonic-gate if (list != NULL)
2077c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
2087c478bd9Sstevel@tonic-gate
2097c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
2107c478bd9Sstevel@tonic-gate return (error);
2117c478bd9Sstevel@tonic-gate }
2127c478bd9Sstevel@tonic-gate
2137c478bd9Sstevel@tonic-gate /*
2147c478bd9Sstevel@tonic-gate * Single part operation to compute the MAC corresponding to the specified
2157c478bd9Sstevel@tonic-gate * 'data' and to verify that it matches the MAC specified by 'mac'.
2167c478bd9Sstevel@tonic-gate * The other arguments are the same as the function crypto_mac_prov().
2177c478bd9Sstevel@tonic-gate */
2187c478bd9Sstevel@tonic-gate int
crypto_mac_verify_prov(crypto_provider_t provider,crypto_session_id_t sid,crypto_mechanism_t * mech,crypto_data_t * data,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_data_t * mac,crypto_call_req_t * crq)219894b2776Smcpowers crypto_mac_verify_prov(crypto_provider_t provider, crypto_session_id_t sid,
220894b2776Smcpowers crypto_mechanism_t *mech, crypto_data_t *data, crypto_key_t *key,
221894b2776Smcpowers crypto_ctx_template_t tmpl, crypto_data_t *mac, crypto_call_req_t *crq)
2227c478bd9Sstevel@tonic-gate {
2237c478bd9Sstevel@tonic-gate kcf_req_params_t params;
224894b2776Smcpowers kcf_provider_desc_t *pd = provider;
225894b2776Smcpowers kcf_provider_desc_t *real_provider = pd;
226894b2776Smcpowers int rv;
2277c478bd9Sstevel@tonic-gate
2287c478bd9Sstevel@tonic-gate ASSERT(KCF_PROV_REFHELD(pd));
229894b2776Smcpowers
230894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
231436935a1SVladimir Kotal rv = kcf_get_hardware_provider(mech->cm_type, key,
232*9b009fc1SValerie Bubb Fenwick CRYPTO_MECH_INVALID, NULL, pd, &real_provider,
233*9b009fc1SValerie Bubb Fenwick CRYPTO_FG_MAC_ATOMIC);
234894b2776Smcpowers
235894b2776Smcpowers if (rv != CRYPTO_SUCCESS)
236894b2776Smcpowers return (rv);
237894b2776Smcpowers }
238894b2776Smcpowers
2397c478bd9Sstevel@tonic-gate KCF_WRAP_MAC_OPS_PARAMS(¶ms, KCF_OP_MAC_VERIFY_ATOMIC, sid, mech,
2407c478bd9Sstevel@tonic-gate key, data, mac, tmpl);
241894b2776Smcpowers rv = kcf_submit_request(real_provider, NULL, crq, ¶ms, B_FALSE);
242894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)
243894b2776Smcpowers KCF_PROV_REFRELE(real_provider);
2447c478bd9Sstevel@tonic-gate
245894b2776Smcpowers return (rv);
2467c478bd9Sstevel@tonic-gate }
2477c478bd9Sstevel@tonic-gate
2487c478bd9Sstevel@tonic-gate /*
2497c478bd9Sstevel@tonic-gate * Same as crypto_mac_verify_prov(), but relies on the KCF scheduler to choose
2507c478bd9Sstevel@tonic-gate * a provider. See crypto_mac_verify_prov() comments for more information.
2517c478bd9Sstevel@tonic-gate */
2527c478bd9Sstevel@tonic-gate int
crypto_mac_verify(crypto_mechanism_t * mech,crypto_data_t * data,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_data_t * mac,crypto_call_req_t * crq)2537c478bd9Sstevel@tonic-gate crypto_mac_verify(crypto_mechanism_t *mech, crypto_data_t *data,
2547c478bd9Sstevel@tonic-gate crypto_key_t *key, crypto_ctx_template_t tmpl, crypto_data_t *mac,
2557c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
2567c478bd9Sstevel@tonic-gate {
2577c478bd9Sstevel@tonic-gate int error;
2587c478bd9Sstevel@tonic-gate kcf_mech_entry_t *me;
2597c478bd9Sstevel@tonic-gate kcf_req_params_t params;
2607c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
2617c478bd9Sstevel@tonic-gate kcf_ctx_template_t *ctx_tmpl;
2627c478bd9Sstevel@tonic-gate crypto_spi_ctx_template_t spi_ctx_tmpl = NULL;
2637c478bd9Sstevel@tonic-gate kcf_prov_tried_t *list = NULL;
2647c478bd9Sstevel@tonic-gate
2657c478bd9Sstevel@tonic-gate retry:
2667c478bd9Sstevel@tonic-gate /* The pd is returned held */
267436935a1SVladimir Kotal if ((pd = kcf_get_mech_provider(mech->cm_type, key, &me, &error,
268*9b009fc1SValerie Bubb Fenwick list, CRYPTO_FG_MAC_ATOMIC, data->cd_length)) == NULL) {
2697c478bd9Sstevel@tonic-gate if (list != NULL)
2707c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
2717c478bd9Sstevel@tonic-gate return (error);
2727c478bd9Sstevel@tonic-gate }
2737c478bd9Sstevel@tonic-gate
2747c478bd9Sstevel@tonic-gate /*
2757c478bd9Sstevel@tonic-gate * For SW providers, check the validity of the context template
2767c478bd9Sstevel@tonic-gate * It is very rare that the generation number mis-matches, so
2777c478bd9Sstevel@tonic-gate * is acceptable to fail here, and let the consumer recover by
2787c478bd9Sstevel@tonic-gate * freeing this tmpl and create a new one for the key and new SW
2797c478bd9Sstevel@tonic-gate * provider
2807c478bd9Sstevel@tonic-gate */
2817c478bd9Sstevel@tonic-gate if ((pd->pd_prov_type == CRYPTO_SW_PROVIDER) &&
2827c478bd9Sstevel@tonic-gate ((ctx_tmpl = (kcf_ctx_template_t *)tmpl) != NULL)) {
2837c478bd9Sstevel@tonic-gate if (ctx_tmpl->ct_generation != me->me_gen_swprov) {
2847c478bd9Sstevel@tonic-gate if (list != NULL)
2857c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
2867c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
2877c478bd9Sstevel@tonic-gate return (CRYPTO_OLD_CTX_TEMPLATE);
2887c478bd9Sstevel@tonic-gate } else {
2897c478bd9Sstevel@tonic-gate spi_ctx_tmpl = ctx_tmpl->ct_prov_tmpl;
2907c478bd9Sstevel@tonic-gate }
2917c478bd9Sstevel@tonic-gate }
2927c478bd9Sstevel@tonic-gate
2937c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
2947c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(crq, pd)) {
2957c478bd9Sstevel@tonic-gate crypto_mechanism_t lmech;
2967c478bd9Sstevel@tonic-gate
2977c478bd9Sstevel@tonic-gate lmech = *mech;
2987c478bd9Sstevel@tonic-gate KCF_SET_PROVIDER_MECHNUM(mech->cm_type, pd, &lmech);
2997c478bd9Sstevel@tonic-gate
3007c478bd9Sstevel@tonic-gate error = KCF_PROV_MAC_VERIFY_ATOMIC(pd, pd->pd_sid, &lmech, key,
3017c478bd9Sstevel@tonic-gate data, mac, spi_ctx_tmpl, KCF_SWFP_RHNDL(crq));
3027c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
3037c478bd9Sstevel@tonic-gate } else {
304ba5f469cSkrishna if (pd->pd_prov_type == CRYPTO_HW_PROVIDER &&
3054df55fdeSJanie Lu (pd->pd_flags & CRYPTO_HMAC_NO_UPDATE) &&
3064df55fdeSJanie Lu (data->cd_length > pd->pd_hmac_limit)) {
307ba5f469cSkrishna /* see comments in crypto_mac() */
308ba5f469cSkrishna error = CRYPTO_BUFFER_TOO_BIG;
309ba5f469cSkrishna } else {
310ba5f469cSkrishna KCF_WRAP_MAC_OPS_PARAMS(¶ms,
311ba5f469cSkrishna KCF_OP_MAC_VERIFY_ATOMIC, pd->pd_sid, mech,
312ba5f469cSkrishna key, data, mac, spi_ctx_tmpl);
3137c478bd9Sstevel@tonic-gate
314ba5f469cSkrishna error = kcf_submit_request(pd, NULL, crq, ¶ms,
315ba5f469cSkrishna KCF_ISDUALREQ(crq));
316ba5f469cSkrishna }
3177c478bd9Sstevel@tonic-gate }
3187c478bd9Sstevel@tonic-gate
3197c478bd9Sstevel@tonic-gate if (error != CRYPTO_SUCCESS && error != CRYPTO_QUEUED &&
3207c478bd9Sstevel@tonic-gate IS_RECOVERABLE(error)) {
3217c478bd9Sstevel@tonic-gate /* Add pd to the linked list of providers tried. */
3227c478bd9Sstevel@tonic-gate if (kcf_insert_triedlist(&list, pd, KCF_KMFLAG(crq)) != NULL)
3237c478bd9Sstevel@tonic-gate goto retry;
3247c478bd9Sstevel@tonic-gate }
3257c478bd9Sstevel@tonic-gate
3267c478bd9Sstevel@tonic-gate if (list != NULL)
3277c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
3287c478bd9Sstevel@tonic-gate
3297c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
3307c478bd9Sstevel@tonic-gate return (error);
3317c478bd9Sstevel@tonic-gate }
3327c478bd9Sstevel@tonic-gate
3337c478bd9Sstevel@tonic-gate
3347c478bd9Sstevel@tonic-gate /*
3357c478bd9Sstevel@tonic-gate * crypto_mac_init_prov()
3367c478bd9Sstevel@tonic-gate *
3377c478bd9Sstevel@tonic-gate * Arguments:
3387c478bd9Sstevel@tonic-gate * pd: pointer to the descriptor of the provider to use for this
3397c478bd9Sstevel@tonic-gate * operation.
3407c478bd9Sstevel@tonic-gate * sid: provider session id.
3417c478bd9Sstevel@tonic-gate * mech: crypto_mechanism_t pointer.
3427c478bd9Sstevel@tonic-gate * mech_type is a valid value previously returned by
3437c478bd9Sstevel@tonic-gate * crypto_mech2id();
3447c478bd9Sstevel@tonic-gate * When the mech's parameter is not NULL, its definition depends
3457c478bd9Sstevel@tonic-gate * on the standard definition of the mechanism.
3467c478bd9Sstevel@tonic-gate * key: pointer to a crypto_key_t structure.
3477c478bd9Sstevel@tonic-gate * tmpl: a crypto_ctx_template_t, opaque template of a context of a
3487c478bd9Sstevel@tonic-gate * MAC with the 'mech' using 'key'. 'tmpl' is created by
3497c478bd9Sstevel@tonic-gate * a previous call to crypto_create_ctx_template().
3507c478bd9Sstevel@tonic-gate * ctxp: Pointer to a crypto_context_t.
3517c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
3527c478bd9Sstevel@tonic-gate *
3537c478bd9Sstevel@tonic-gate * Description:
3547c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs the
3557c478bd9Sstevel@tonic-gate * initialization of a MAC operation on the specified provider with
3567c478bd9Sstevel@tonic-gate * the specified session.
3577c478bd9Sstevel@tonic-gate * When possible and applicable, will internally use the pre-computed MAC
3587c478bd9Sstevel@tonic-gate * context from the context template, tmpl.
3597c478bd9Sstevel@tonic-gate * When complete and successful, 'ctxp' will contain a crypto_context_t
3607c478bd9Sstevel@tonic-gate * valid for later calls to mac_update() and mac_final().
3617c478bd9Sstevel@tonic-gate * The caller should hold a reference on the specified provider
3627c478bd9Sstevel@tonic-gate * descriptor before calling this function.
3637c478bd9Sstevel@tonic-gate *
3647c478bd9Sstevel@tonic-gate * Context:
3657c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
3667c478bd9Sstevel@tonic-gate *
3677c478bd9Sstevel@tonic-gate * Returns:
3687c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
3697c478bd9Sstevel@tonic-gate */
3707c478bd9Sstevel@tonic-gate int
crypto_mac_init_prov(crypto_provider_t provider,crypto_session_id_t sid,crypto_mechanism_t * mech,crypto_key_t * key,crypto_spi_ctx_template_t tmpl,crypto_context_t * ctxp,crypto_call_req_t * crq)371894b2776Smcpowers crypto_mac_init_prov(crypto_provider_t provider, crypto_session_id_t sid,
3727c478bd9Sstevel@tonic-gate crypto_mechanism_t *mech, crypto_key_t *key, crypto_spi_ctx_template_t tmpl,
3737c478bd9Sstevel@tonic-gate crypto_context_t *ctxp, crypto_call_req_t *crq)
3747c478bd9Sstevel@tonic-gate {
375894b2776Smcpowers int rv;
3767c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx;
3777c478bd9Sstevel@tonic-gate kcf_req_params_t params;
378894b2776Smcpowers kcf_provider_desc_t *pd = provider;
379894b2776Smcpowers kcf_provider_desc_t *real_provider = pd;
3807c478bd9Sstevel@tonic-gate
3817c478bd9Sstevel@tonic-gate ASSERT(KCF_PROV_REFHELD(pd));
3827c478bd9Sstevel@tonic-gate
383894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
384436935a1SVladimir Kotal rv = kcf_get_hardware_provider(mech->cm_type, key,
385*9b009fc1SValerie Bubb Fenwick CRYPTO_MECH_INVALID, NULL, pd, &real_provider,
386*9b009fc1SValerie Bubb Fenwick CRYPTO_FG_MAC);
387894b2776Smcpowers
388894b2776Smcpowers if (rv != CRYPTO_SUCCESS)
389894b2776Smcpowers return (rv);
390894b2776Smcpowers }
391894b2776Smcpowers
392894b2776Smcpowers /* Allocate and initialize the canonical context */
393894b2776Smcpowers if ((ctx = kcf_new_ctx(crq, real_provider, sid)) == NULL) {
394894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)
395894b2776Smcpowers KCF_PROV_REFRELE(real_provider);
3967c478bd9Sstevel@tonic-gate return (CRYPTO_HOST_MEMORY);
397894b2776Smcpowers }
3987c478bd9Sstevel@tonic-gate
3997c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
4007c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(crq, pd)) {
4017c478bd9Sstevel@tonic-gate crypto_mechanism_t lmech;
4027c478bd9Sstevel@tonic-gate
4037c478bd9Sstevel@tonic-gate lmech = *mech;
404894b2776Smcpowers KCF_SET_PROVIDER_MECHNUM(mech->cm_type, real_provider, &lmech);
405894b2776Smcpowers rv = KCF_PROV_MAC_INIT(real_provider, ctx, &lmech, key, tmpl,
4067c478bd9Sstevel@tonic-gate KCF_SWFP_RHNDL(crq));
407894b2776Smcpowers KCF_PROV_INCRSTATS(pd, rv);
4087c478bd9Sstevel@tonic-gate } else {
4097c478bd9Sstevel@tonic-gate KCF_WRAP_MAC_OPS_PARAMS(¶ms, KCF_OP_INIT, sid, mech, key,
4107c478bd9Sstevel@tonic-gate NULL, NULL, tmpl);
411894b2776Smcpowers rv = kcf_submit_request(real_provider, ctx, crq, ¶ms,
412894b2776Smcpowers B_FALSE);
4137c478bd9Sstevel@tonic-gate }
4147c478bd9Sstevel@tonic-gate
415894b2776Smcpowers if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)
416894b2776Smcpowers KCF_PROV_REFRELE(real_provider);
417894b2776Smcpowers
418894b2776Smcpowers if ((rv == CRYPTO_SUCCESS) || (rv == CRYPTO_QUEUED))
4197c478bd9Sstevel@tonic-gate *ctxp = (crypto_context_t)ctx;
4207c478bd9Sstevel@tonic-gate else {
4217c478bd9Sstevel@tonic-gate /* Release the hold done in kcf_new_ctx(). */
4227c478bd9Sstevel@tonic-gate KCF_CONTEXT_REFRELE((kcf_context_t *)ctx->cc_framework_private);
4237c478bd9Sstevel@tonic-gate }
4247c478bd9Sstevel@tonic-gate
425894b2776Smcpowers return (rv);
4267c478bd9Sstevel@tonic-gate }
4277c478bd9Sstevel@tonic-gate
4287c478bd9Sstevel@tonic-gate /*
4297c478bd9Sstevel@tonic-gate * Same as crypto_mac_init_prov(), but relies on the KCF scheduler to
4307c478bd9Sstevel@tonic-gate * choose a provider. See crypto_mac_init_prov() comments for more
4317c478bd9Sstevel@tonic-gate * information.
4327c478bd9Sstevel@tonic-gate */
4337c478bd9Sstevel@tonic-gate int
crypto_mac_init(crypto_mechanism_t * mech,crypto_key_t * key,crypto_ctx_template_t tmpl,crypto_context_t * ctxp,crypto_call_req_t * crq)4347c478bd9Sstevel@tonic-gate crypto_mac_init(crypto_mechanism_t *mech, crypto_key_t *key,
4357c478bd9Sstevel@tonic-gate crypto_ctx_template_t tmpl, crypto_context_t *ctxp,
4367c478bd9Sstevel@tonic-gate crypto_call_req_t *crq)
4377c478bd9Sstevel@tonic-gate {
4387c478bd9Sstevel@tonic-gate int error;
4397c478bd9Sstevel@tonic-gate kcf_mech_entry_t *me;
4407c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
4417c478bd9Sstevel@tonic-gate kcf_ctx_template_t *ctx_tmpl;
4427c478bd9Sstevel@tonic-gate crypto_spi_ctx_template_t spi_ctx_tmpl = NULL;
4437c478bd9Sstevel@tonic-gate kcf_prov_tried_t *list = NULL;
4447c478bd9Sstevel@tonic-gate
4457c478bd9Sstevel@tonic-gate retry:
4467c478bd9Sstevel@tonic-gate /* The pd is returned held */
447436935a1SVladimir Kotal if ((pd = kcf_get_mech_provider(mech->cm_type, key, &me, &error,
448*9b009fc1SValerie Bubb Fenwick list, CRYPTO_FG_MAC, 0)) == NULL) {
4497c478bd9Sstevel@tonic-gate if (list != NULL)
4507c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
4517c478bd9Sstevel@tonic-gate return (error);
4527c478bd9Sstevel@tonic-gate }
4537c478bd9Sstevel@tonic-gate
4547c478bd9Sstevel@tonic-gate /*
4557c478bd9Sstevel@tonic-gate * For SW providers, check the validity of the context template
4567c478bd9Sstevel@tonic-gate * It is very rare that the generation number mis-matches, so
4577c478bd9Sstevel@tonic-gate * is acceptable to fail here, and let the consumer recover by
4587c478bd9Sstevel@tonic-gate * freeing this tmpl and create a new one for the key and new SW
4597c478bd9Sstevel@tonic-gate * provider
4607c478bd9Sstevel@tonic-gate */
4617c478bd9Sstevel@tonic-gate
4627c478bd9Sstevel@tonic-gate if ((pd->pd_prov_type == CRYPTO_SW_PROVIDER) &&
4637c478bd9Sstevel@tonic-gate ((ctx_tmpl = (kcf_ctx_template_t *)tmpl) != NULL)) {
4647c478bd9Sstevel@tonic-gate if (ctx_tmpl->ct_generation != me->me_gen_swprov) {
4657c478bd9Sstevel@tonic-gate if (list != NULL)
4667c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
4677c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
4687c478bd9Sstevel@tonic-gate return (CRYPTO_OLD_CTX_TEMPLATE);
4697c478bd9Sstevel@tonic-gate } else {
4707c478bd9Sstevel@tonic-gate spi_ctx_tmpl = ctx_tmpl->ct_prov_tmpl;
4717c478bd9Sstevel@tonic-gate }
4727c478bd9Sstevel@tonic-gate }
4737c478bd9Sstevel@tonic-gate
474ba5f469cSkrishna if (pd->pd_prov_type == CRYPTO_HW_PROVIDER &&
4754df55fdeSJanie Lu (pd->pd_flags & CRYPTO_HMAC_NO_UPDATE)) {
476ba5f469cSkrishna /*
477ba5f469cSkrishna * The hardware provider has limited HMAC support.
478ba5f469cSkrishna * So, we fallback early here to using a software provider.
479ba5f469cSkrishna *
480ba5f469cSkrishna * XXX - need to enhance to do the fallback later in
481ba5f469cSkrishna * crypto_mac_update() if the size of accumulated input data
482ba5f469cSkrishna * exceeds the maximum size digestable by hardware provider.
483ba5f469cSkrishna */
484ba5f469cSkrishna error = CRYPTO_BUFFER_TOO_BIG;
485ba5f469cSkrishna } else {
486ba5f469cSkrishna error = crypto_mac_init_prov(pd, pd->pd_sid, mech, key,
487ba5f469cSkrishna spi_ctx_tmpl, ctxp, crq);
488ba5f469cSkrishna }
4897c478bd9Sstevel@tonic-gate if (error != CRYPTO_SUCCESS && error != CRYPTO_QUEUED &&
4907c478bd9Sstevel@tonic-gate IS_RECOVERABLE(error)) {
4917c478bd9Sstevel@tonic-gate /* Add pd to the linked list of providers tried. */
4927c478bd9Sstevel@tonic-gate if (kcf_insert_triedlist(&list, pd, KCF_KMFLAG(crq)) != NULL)
4937c478bd9Sstevel@tonic-gate goto retry;
4947c478bd9Sstevel@tonic-gate }
4957c478bd9Sstevel@tonic-gate
4967c478bd9Sstevel@tonic-gate if (list != NULL)
4977c478bd9Sstevel@tonic-gate kcf_free_triedlist(list);
4987c478bd9Sstevel@tonic-gate
4997c478bd9Sstevel@tonic-gate KCF_PROV_REFRELE(pd);
5007c478bd9Sstevel@tonic-gate return (error);
5017c478bd9Sstevel@tonic-gate }
5027c478bd9Sstevel@tonic-gate
5037c478bd9Sstevel@tonic-gate /*
5047c478bd9Sstevel@tonic-gate * crypto_mac_update()
5057c478bd9Sstevel@tonic-gate *
5067c478bd9Sstevel@tonic-gate * Arguments:
5077c478bd9Sstevel@tonic-gate * context: A crypto_context_t initialized by mac_init().
5087c478bd9Sstevel@tonic-gate * data: The message part to be MAC'ed
5097c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
5107c478bd9Sstevel@tonic-gate *
5117c478bd9Sstevel@tonic-gate * Description:
5127c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs a
5137c478bd9Sstevel@tonic-gate * part of a MAC operation.
5147c478bd9Sstevel@tonic-gate *
5157c478bd9Sstevel@tonic-gate * Context:
5167c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
5177c478bd9Sstevel@tonic-gate *
5187c478bd9Sstevel@tonic-gate * Returns:
5197c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
5207c478bd9Sstevel@tonic-gate */
5217c478bd9Sstevel@tonic-gate int
crypto_mac_update(crypto_context_t context,crypto_data_t * data,crypto_call_req_t * cr)5227c478bd9Sstevel@tonic-gate crypto_mac_update(crypto_context_t context, crypto_data_t *data,
5237c478bd9Sstevel@tonic-gate crypto_call_req_t *cr)
5247c478bd9Sstevel@tonic-gate {
5257c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
5267c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
5277c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
5287c478bd9Sstevel@tonic-gate kcf_req_params_t params;
529894b2776Smcpowers int rv;
5307c478bd9Sstevel@tonic-gate
5317c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
5327c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
5337c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
5347c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
5357c478bd9Sstevel@tonic-gate }
5367c478bd9Sstevel@tonic-gate
537894b2776Smcpowers ASSERT(pd->pd_prov_type != CRYPTO_LOGICAL_PROVIDER);
5387c478bd9Sstevel@tonic-gate
5397c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
5407c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
541894b2776Smcpowers rv = KCF_PROV_MAC_UPDATE(pd, ctx, data, NULL);
542894b2776Smcpowers KCF_PROV_INCRSTATS(pd, rv);
5437c478bd9Sstevel@tonic-gate } else {
544894b2776Smcpowers KCF_WRAP_MAC_OPS_PARAMS(¶ms, KCF_OP_UPDATE,
545894b2776Smcpowers ctx->cc_session, NULL, NULL, data, NULL, NULL);
546894b2776Smcpowers rv = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
5477c478bd9Sstevel@tonic-gate }
5487c478bd9Sstevel@tonic-gate
549894b2776Smcpowers return (rv);
5507c478bd9Sstevel@tonic-gate }
5517c478bd9Sstevel@tonic-gate
5527c478bd9Sstevel@tonic-gate /*
5537c478bd9Sstevel@tonic-gate * crypto_mac_final()
5547c478bd9Sstevel@tonic-gate *
5557c478bd9Sstevel@tonic-gate * Arguments:
5567c478bd9Sstevel@tonic-gate * context: A crypto_context_t initialized by mac_init().
5577c478bd9Sstevel@tonic-gate * mac: Storage for the message authentication code.
5587c478bd9Sstevel@tonic-gate * cr: crypto_call_req_t calling conditions and call back info.
5597c478bd9Sstevel@tonic-gate *
5607c478bd9Sstevel@tonic-gate * Description:
5617c478bd9Sstevel@tonic-gate * Asynchronously submits a request for, or synchronously performs a
5627c478bd9Sstevel@tonic-gate * part of a message authentication operation.
5637c478bd9Sstevel@tonic-gate *
5647c478bd9Sstevel@tonic-gate * Context:
5657c478bd9Sstevel@tonic-gate * Process or interrupt, according to the semantics dictated by the 'cr'.
5667c478bd9Sstevel@tonic-gate *
5677c478bd9Sstevel@tonic-gate * Returns:
5687c478bd9Sstevel@tonic-gate * See comment in the beginning of the file.
5697c478bd9Sstevel@tonic-gate */
5707c478bd9Sstevel@tonic-gate int
crypto_mac_final(crypto_context_t context,crypto_data_t * mac,crypto_call_req_t * cr)5717c478bd9Sstevel@tonic-gate crypto_mac_final(crypto_context_t context, crypto_data_t *mac,
5727c478bd9Sstevel@tonic-gate crypto_call_req_t *cr)
5737c478bd9Sstevel@tonic-gate {
5747c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
5757c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
5767c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
5777c478bd9Sstevel@tonic-gate kcf_req_params_t params;
578894b2776Smcpowers int rv;
5797c478bd9Sstevel@tonic-gate
5807c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
5817c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
5827c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
5837c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
5847c478bd9Sstevel@tonic-gate }
5857c478bd9Sstevel@tonic-gate
586894b2776Smcpowers ASSERT(pd->pd_prov_type != CRYPTO_LOGICAL_PROVIDER);
5877c478bd9Sstevel@tonic-gate
5887c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
5897c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
590894b2776Smcpowers rv = KCF_PROV_MAC_FINAL(pd, ctx, mac, NULL);
591894b2776Smcpowers KCF_PROV_INCRSTATS(pd, rv);
5927c478bd9Sstevel@tonic-gate } else {
593894b2776Smcpowers KCF_WRAP_MAC_OPS_PARAMS(¶ms, KCF_OP_FINAL,
594894b2776Smcpowers ctx->cc_session, NULL, NULL, NULL, mac, NULL);
595894b2776Smcpowers rv = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
5967c478bd9Sstevel@tonic-gate }
5977c478bd9Sstevel@tonic-gate
5987c478bd9Sstevel@tonic-gate /* Release the hold done in kcf_new_ctx() during init step. */
599894b2776Smcpowers KCF_CONTEXT_COND_RELEASE(rv, kcf_ctx);
600894b2776Smcpowers return (rv);
6017c478bd9Sstevel@tonic-gate }
6027c478bd9Sstevel@tonic-gate
6037c478bd9Sstevel@tonic-gate /*
6047c478bd9Sstevel@tonic-gate * See comments for crypto_mac_update() and crypto_mac_final().
6057c478bd9Sstevel@tonic-gate */
6067c478bd9Sstevel@tonic-gate int
crypto_mac_single(crypto_context_t context,crypto_data_t * data,crypto_data_t * mac,crypto_call_req_t * cr)6077c478bd9Sstevel@tonic-gate crypto_mac_single(crypto_context_t context, crypto_data_t *data,
6087c478bd9Sstevel@tonic-gate crypto_data_t *mac, crypto_call_req_t *cr)
6097c478bd9Sstevel@tonic-gate {
6107c478bd9Sstevel@tonic-gate crypto_ctx_t *ctx = (crypto_ctx_t *)context;
6117c478bd9Sstevel@tonic-gate kcf_context_t *kcf_ctx;
6127c478bd9Sstevel@tonic-gate kcf_provider_desc_t *pd;
6137c478bd9Sstevel@tonic-gate int error;
6147c478bd9Sstevel@tonic-gate kcf_req_params_t params;
6157c478bd9Sstevel@tonic-gate
6167c478bd9Sstevel@tonic-gate
6177c478bd9Sstevel@tonic-gate if ((ctx == NULL) ||
6187c478bd9Sstevel@tonic-gate ((kcf_ctx = (kcf_context_t *)ctx->cc_framework_private) == NULL) ||
6197c478bd9Sstevel@tonic-gate ((pd = kcf_ctx->kc_prov_desc) == NULL)) {
6207c478bd9Sstevel@tonic-gate return (CRYPTO_INVALID_CONTEXT);
6217c478bd9Sstevel@tonic-gate }
6227c478bd9Sstevel@tonic-gate
6237c478bd9Sstevel@tonic-gate
6247c478bd9Sstevel@tonic-gate /* The fast path for SW providers. */
6257c478bd9Sstevel@tonic-gate if (CHECK_FASTPATH(cr, pd)) {
6267c478bd9Sstevel@tonic-gate error = KCF_PROV_MAC(pd, ctx, data, mac, NULL);
6277c478bd9Sstevel@tonic-gate KCF_PROV_INCRSTATS(pd, error);
6287c478bd9Sstevel@tonic-gate } else {
6297c478bd9Sstevel@tonic-gate KCF_WRAP_MAC_OPS_PARAMS(¶ms, KCF_OP_SINGLE, pd->pd_sid,
6307c478bd9Sstevel@tonic-gate NULL, NULL, data, mac, NULL);
6317c478bd9Sstevel@tonic-gate error = kcf_submit_request(pd, ctx, cr, ¶ms, B_FALSE);
6327c478bd9Sstevel@tonic-gate }
6337c478bd9Sstevel@tonic-gate
6347c478bd9Sstevel@tonic-gate /* Release the hold done in kcf_new_ctx() during init step. */
6357c478bd9Sstevel@tonic-gate KCF_CONTEXT_COND_RELEASE(error, kcf_ctx);
6367c478bd9Sstevel@tonic-gate return (error);
6377c478bd9Sstevel@tonic-gate }
638