sys/opencrypto/cryptodev.h

   1 /*      $NetBSD: cryptodev.h,v 1.16 2009/03/25 01:26:13 darran Exp $ */
   2 /*      $FreeBSD: src/sys/opencrypto/cryptodev.h,v 1.2.2.6 2003/07/02 17:04:50 sam Exp $        */
   3 /*      $OpenBSD: cryptodev.h,v 1.33 2002/07/17 23:52:39 art Exp $      */
   4
   5 /*-
   6  * Copyright (c) 2008 The NetBSD Foundation, Inc.
   7  * All rights reserved.
   8  *
   9  * This code is derived from software contributed to The NetBSD Foundation
  10  * by Coyote Point Systems, Inc.
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  31  * POSSIBILITY OF SUCH DAMAGE.
  32  */
  33
  34 /*
  35  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
  36  *
  37  * This code was written by Angelos D. Keromytis in Athens, Greece, in
  38  * February 2000. Network Security Technologies Inc. (NSTI) kindly
  39  * supported the development of this code.
  40  *
  41  * Copyright (c) 2000 Angelos D. Keromytis
  42  *
  43  * Permission to use, copy, and modify this software with or without fee
  44  * is hereby granted, provided that this entire notice is included in
  45  * all source code copies of any software which is or includes a copy or
  46  * modification of this software.
  47  *
  48  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  49  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  50  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  51  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  52  * PURPOSE.
  53  *
  54  * Copyright (c) 2001 Theo de Raadt
  55  *
  56  * Redistribution and use in source and binary forms, with or without
  57  * modification, are permitted provided that the following conditions
  58  * are met:
  59  *
  60  * 1. Redistributions of source code must retain the above copyright
  61  *   notice, this list of conditions and the following disclaimer.
  62  * 2. Redistributions in binary form must reproduce the above copyright
  63  *   notice, this list of conditions and the following disclaimer in the
  64  *   documentation and/or other materials provided with the distribution.
  65  * 3. The name of the author may not be used to endorse or promote products
  66  *   derived from this software without specific prior written permission.
  67  *
  68  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  69  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  70  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  71  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  72  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  73  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  74  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  75  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  76  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  77  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  78  *
  79  * Effort sponsored in part by the Defense Advanced Research Projects
  80  * Agency (DARPA) and Air Force Research Laboratory, Air Force
  81  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
  82  *
  83  */
  84
  85 #ifndef _CRYPTO_CRYPTO_H_
  86 #define _CRYPTO_CRYPTO_H_
  87
  88 #include <sys/ioccom.h>
  89 #include <sys/condvar.h>
  90
  91 /* Some initial values */
  92 #define CRYPTO_DRIVERS_INITIAL  4
  93 #define CRYPTO_SW_SESSIONS      32
  94
  95 /* HMAC values */
  96 #define HMAC_BLOCK_LEN          64
  97 #define HMAC_IPAD_VAL           0x36
  98 #define HMAC_OPAD_VAL           0x5C
  99
 100 /* Encryption algorithm block sizes */
 101 #define DES_BLOCK_LEN           8
 102 #define DES3_BLOCK_LEN          8
 103 #define BLOWFISH_BLOCK_LEN      8
 104 #define SKIPJACK_BLOCK_LEN      8
 105 #define CAST128_BLOCK_LEN       8
 106 #define RIJNDAEL128_BLOCK_LEN   16
 107 #define EALG_MAX_BLOCK_LEN      16 /* Keep this updated */
 108
 109 /* Maximum hash algorithm result length */
 110 #define AALG_MAX_RESULT_LEN     64 /* Keep this updated */
 111
 112 #define CRYPTO_ALGORITHM_MIN    1
 113 #define CRYPTO_DES_CBC          1
 114 #define CRYPTO_3DES_CBC         2
 115 #define CRYPTO_BLF_CBC          3
 116 #define CRYPTO_CAST_CBC         4
 117 #define CRYPTO_SKIPJACK_CBC     5
 118 #define CRYPTO_MD5_HMAC         6
 119 #define CRYPTO_SHA1_HMAC        7
 120 #define CRYPTO_RIPEMD160_HMAC   8
 121 #define CRYPTO_MD5_KPDK         9
 122 #define CRYPTO_SHA1_KPDK        10
 123 #define CRYPTO_RIJNDAEL128_CBC  11 /* 128 bit blocksize */
 124 #define CRYPTO_AES_CBC          11 /* 128 bit blocksize -- the same as above */
 125 #define CRYPTO_ARC4             12
 126 #define CRYPTO_MD5              13
 127 #define CRYPTO_SHA1             14
 128 #define CRYPTO_SHA2_HMAC        15
 129 #define CRYPTO_NULL_HMAC        16
 130 #define CRYPTO_NULL_CBC         17
 131 #define CRYPTO_DEFLATE_COMP     18 /* Deflate compression algorithm */
 132 #define CRYPTO_MD5_HMAC_96      19
 133 #define CRYPTO_SHA1_HMAC_96     20
 134 #define CRYPTO_RIPEMD160_HMAC_96        21
 135 #define CRYPTO_GZIP_COMP        22 /* Deflate compression algorithm */
 136 #define CRYPTO_ALGORITHM_MAX    23 /* Keep updated - see below */
 137
 138 /* Algorithm flags */
 139 #define CRYPTO_ALG_FLAG_SUPPORTED       0x01 /* Algorithm is supported */
 140 #define CRYPTO_ALG_FLAG_RNG_ENABLE      0x02 /* Has HW RNG for DH/DSA */
 141 #define CRYPTO_ALG_FLAG_DSA_SHA         0x04 /* Can do SHA on msg */
 142
 143 struct session_op {
 144         u_int32_t       cipher;         /* ie. CRYPTO_DES_CBC */
 145         u_int32_t       mac;            /* ie. CRYPTO_MD5_HMAC */
 146         u_int32_t       comp_alg;       /* ie. CRYPTO_GZIP_COMP */
 147
 148         u_int32_t       keylen;         /* cipher key */
 149         void *          key;
 150         int             mackeylen;      /* mac key */
 151         void *          mackey;
 152
 153         u_int32_t       ses;            /* returns: session # */
 154 };
 155
 156 /* to support multiple session creation */
 157
 158 struct session_n_op {
 159         u_int32_t       cipher;         /* ie. CRYPTO_DES_CBC */
 160         u_int32_t       mac;            /* ie. CRYPTO_MD5_HMAC */
 161         u_int32_t       comp_alg;       /* ie. CRYPTO_GZIP_COMP */
 162
 163         u_int32_t       keylen;         /* cipher key */
 164         void *          key;
 165         int             mackeylen;      /* mac key */
 166         void *          mackey;
 167
 168         u_int32_t       ses;            /* returns: session # */
 169         int             status;
 170 };
 171
 172 struct crypt_op {
 173         u_int32_t       ses;
 174         u_int16_t       op;             /* i.e. COP_ENCRYPT */
 175 #define COP_ENCRYPT     1
 176 #define COP_DECRYPT     2
 177 #define COP_COMP        3
 178 #define COP_DECOMP      4
 179         u_int16_t       flags;
 180 #define COP_F_BATCH     0x0008          /* Dispatch as quickly as possible */
 181         u_int           len;            /* src len */
 182         void *          src, *dst;      /* become iov[] inside kernel */
 183         void *          mac;            /* must be big enough for chosen MAC */
 184         void *          iv;
 185         u_int           dst_len;        /* dst len if not 0 */
 186 };
 187
 188 /* to support multiple session creation */
 189 /*
 190  *
 191  * The reqid field is filled when the operation has
 192  * been accepted and started, and can be used to later retrieve
 193  * the operation results via CIOCNCRYPTRET or identify the
 194  * request in the completion list returned by CIOCNCRYPTRETM.
 195  *
 196  * The opaque pointer can be set arbitrarily by the user
 197  * and it is passed back in the crypt_result structure
 198  * when the request completes.  This field can be used for example
 199  * to track context for the request and avoid lookups in the
 200  * user application.
 201  */
 202
 203 struct crypt_n_op {
 204         u_int32_t       ses;
 205         u_int16_t       op;             /* i.e. COP_ENCRYPT */
 206 #define COP_ENCRYPT     1
 207 #define COP_DECRYPT     2
 208         u_int16_t       flags;
 209 #define COP_F_BATCH     0x0008          /* Dispatch as quickly as possible */
 210 #define COP_F_MORE      0x0010          /* more data to follow */
 211         u_int           len;            /* src len */
 212
 213         u_int32_t       reqid;          /* request id */
 214         int             status;         /* status of request -accepted or not */
 215         void            *opaque;        /* opaque pointer returned to user */
 216         u_int32_t       keylen;         /* cipher key - optional */
 217         void *          key;
 218         u_int32_t       mackeylen;      /* also optional */
 219         void *          mackey;
 220
 221         void *          src, *dst;      /* become iov[] inside kernel */
 222         void *          mac;            /* must be big enough for chosen MAC */
 223         void *          iv;
 224         u_int           dst_len;        /* dst len if not 0 */
 225 };
 226
 227 /* CIOCNCRYPTM ioctl argument, supporting one or more asynchronous
 228  * crypt_n_op operations.
 229  * Each crypt_n_op will receive a request id which can be used to check its
 230  * status via CIOCNCRYPTRET, or to watch for its completion in the list
 231  * obtained via CIOCNCRYPTRETM.
 232  */
 233 struct crypt_mop {
 234         size_t          count;          /* how many */
 235         struct crypt_n_op *     reqs;   /* where to get them */
 236 };
 237
 238 struct crypt_sfop {
 239         size_t          count;
 240         u_int32_t       *sesid;
 241 };
 242
 243 struct crypt_sgop {
 244         size_t          count;
 245         struct session_n_op * sessions;
 246 };
 247
 248 #define CRYPTO_MAX_MAC_LEN      20
 249
 250 /* bignum parameter, in packed bytes, ... */
 251 struct crparam {
 252         void *          crp_p;
 253         u_int           crp_nbits;
 254 };
 255
 256 #define CRK_MAXPARAM    8
 257
 258 struct crypt_kop {
 259         u_int           crk_op;         /* ie. CRK_MOD_EXP or other */
 260         u_int           crk_status;     /* return status */
 261         u_short         crk_iparams;    /* # of input parameters */
 262         u_short         crk_oparams;    /* # of output parameters */
 263         u_int           crk_pad1;
 264         struct crparam  crk_param[CRK_MAXPARAM];
 265 };
 266
 267 /*
 268  * Used with the CIOCNFKEYM ioctl.
 269  *
 270  * This structure allows the OCF to return a request id
 271  * for each of the kop operations specified in the CIOCNFKEYM call.
 272  *
 273  * The crk_opaque pointer can be arbitrarily set by the user
 274  * and it is passed back in the crypt_result structure
 275  * when the request completes.  This field can be used for example
 276  * to track context for the request and avoid lookups in the
 277  * user application.
 278  */
 279 struct crypt_n_kop {
 280         u_int           crk_op;         /* ie. CRK_MOD_EXP or other */
 281         u_int           crk_status;     /* return status */
 282         u_short         crk_iparams;    /* # of input parameters */
 283         u_short         crk_oparams;    /* # of output parameters */
 284         u_int32_t       crk_reqid;      /* request id */
 285         struct crparam  crk_param[CRK_MAXPARAM];
 286         void            *crk_opaque;    /* opaque pointer returned to user */
 287 };
 288
 289 struct crypt_mkop {
 290         size_t  count;                  /* how many */
 291         struct crypt_n_kop *    reqs;   /* where to get them */
 292 };
 293
 294 /* Asynchronous key or crypto result.
 295  * Note that the status will be set in the crypt_result structure,
 296  * not in the original crypt_kop structure (crk_status).
 297  */
 298 struct crypt_result {
 299         u_int32_t       reqid;          /* request id */
 300         u_int32_t       status;         /* status of request: 0 if successful */
 301         void *          opaque;         /* Opaque pointer from the user, passed along */
 302 };
 303
 304 struct cryptret {
 305         size_t          count;          /* space for how many */
 306         struct crypt_result *   results;        /* where to put them */
 307 };
 308
 309
 310 /* Assymetric key operations */
 311 #define CRK_ALGORITM_MIN        0
 312 #define CRK_MOD_EXP             0
 313 #define CRK_MOD_EXP_CRT         1
 314 #define CRK_DSA_SIGN            2
 315 #define CRK_DSA_VERIFY          3
 316 #define CRK_DH_COMPUTE_KEY      4
 317 #define CRK_MOD_ADD             5
 318 #define CRK_MOD_ADDINV          6
 319 #define CRK_MOD_SUB             7
 320 #define CRK_MOD_MULT            8
 321 #define CRK_MOD_MULTINV         9
 322 #define CRK_MOD                 10
 323 #define CRK_ALGORITHM_MAX       10 /* Keep updated - see below */
 324
 325 #define CRF_MOD_EXP             (1 << CRK_MOD_EXP)
 326 #define CRF_MOD_EXP_CRT         (1 << CRK_MOD_EXP_CRT)
 327 #define CRF_DSA_SIGN            (1 << CRK_DSA_SIGN)
 328 #define CRF_DSA_VERIFY          (1 << CRK_DSA_VERIFY)
 329 #define CRF_DH_COMPUTE_KEY      (1 << CRK_DH_COMPUTE_KEY)
 330 #define CRF_MOD_ADD             (1 << CRK_MOD_ADD)
 331 #define CRF_MOD_ADDINV          (1 << CRK_MOD_ADDINV)
 332 #define CRF_MOD_SUB             (1 << CRK_MOD_SUB)
 333 #define CRF_MOD_MULT            (1 << CRK_MOD_MULT)
 334 #define CRF_MOD_MULTINV         (1 << CRK_MOD_MULTINV)
 335 #define CRF_MOD                 (1 << CRK_MOD)
 336
 337 /*
 338  * A large comment here once held descriptions of the ioctl
 339  * requests implemented by the device.  This text has been moved
 340  * to the crypto(4) manual page and, later, removed from this file
 341  * as it was always a step behind the times.
 342  */
 343
 344 /*
 345  * done against open of /dev/crypto, to get a cloned descriptor.
 346  * Please use F_SETFD against the cloned descriptor.  But this ioctl
 347  * is obsolete (the device now clones): please, just don't use it.
 348  */
 349 #define CRIOGET         _IOWR('c', 100, u_int32_t)
 350
 351 /* the following are done against the cloned descriptor */
 352 #define CIOCFSESSION    _IOW('c', 102, u_int32_t)
 353 #define CIOCKEY         _IOWR('c', 104, struct crypt_kop)
 354 #define CIOCNFKEYM      _IOWR('c', 108, struct crypt_mkop)
 355 #define CIOCNFSESSION   _IOW('c', 109, struct crypt_sfop)
 356 #define CIOCNCRYPTRETM  _IOWR('c', 110, struct cryptret)
 357 #define CIOCNCRYPTRET   _IOWR('c', 111, struct crypt_result)
 358
 359 #define CIOCGSESSION    _IOWR('c', 112, struct session_op)
 360 #define CIOCNGSESSION   _IOWR('c', 113, struct crypt_sgop)
 361 #define CIOCCRYPT       _IOWR('c', 114, struct crypt_op)
 362 #define CIOCNCRYPTM     _IOWR('c', 115, struct crypt_mop)
 363
 364 #define CIOCASYMFEAT    _IOR('c', 105, u_int32_t)
 365
 366 struct cryptotstat {
 367         struct timespec acc;            /* total accumulated time */
 368         struct timespec min;            /* max time */
 369         struct timespec max;            /* max time */
 370         u_int32_t       count;          /* number of observations */
 371 };
 372
 373 struct cryptostats {
 374         u_int32_t       cs_ops;         /* symmetric crypto ops submitted */
 375         u_int32_t       cs_errs;        /* symmetric crypto ops that failed */
 376         u_int32_t       cs_kops;        /* asymetric/key ops submitted */
 377         u_int32_t       cs_kerrs;       /* asymetric/key ops that failed */
 378         u_int32_t       cs_intrs;       /* crypto swi thread activations */
 379         u_int32_t       cs_rets;        /* crypto return thread activations */
 380         u_int32_t       cs_blocks;      /* symmetric op driver block */
 381         u_int32_t       cs_kblocks;     /* symmetric op driver block */
 382         /*
 383          * When CRYPTO_TIMING is defined at compile time and the
 384          * sysctl debug.crypto is set to 1, the crypto system will
 385          * accumulate statistics about how long it takes to process
 386          * crypto requests at various points during processing.
 387          */
 388         struct cryptotstat cs_invoke;   /* crypto_dipsatch -> crypto_invoke */
 389         struct cryptotstat cs_done;     /* crypto_invoke -> crypto_done */
 390         struct cryptotstat cs_cb;       /* crypto_done -> callback */
 391         struct cryptotstat cs_finis;    /* callback -> callback return */
 392 };
 393
 394 #ifdef _KERNEL
 395 /* Standard initialization structure beginning */
 396 struct cryptoini {
 397         int             cri_alg;        /* Algorithm to use */
 398         int             cri_klen;       /* Key length, in bits */
 399         int             cri_rnd;        /* Algorithm rounds, where relevant */
 400         char           *cri_key;        /* key to use */
 401         u_int8_t        cri_iv[EALG_MAX_BLOCK_LEN];     /* IV to use */
 402         struct cryptoini *cri_next;
 403 };
 404
 405 /* Describe boundaries of a single crypto operation */
 406 struct cryptodesc {
 407         int             crd_skip;       /* How many bytes to ignore from start */
 408         int             crd_len;        /* How many bytes to process */
 409         int             crd_inject;     /* Where to inject results, if applicable */
 410         int             crd_flags;
 411
 412 #define CRD_F_ENCRYPT           0x01    /* Set when doing encryption */
 413 #define CRD_F_IV_PRESENT        0x02    /* When encrypting, IV is already in
 414                                            place, so don't copy. */
 415 #define CRD_F_IV_EXPLICIT       0x04    /* IV explicitly provided */
 416 #define CRD_F_DSA_SHA_NEEDED    0x08    /* Compute SHA-1 of buffer for DSA */
 417 #define CRD_F_COMP              0x10    /* Set when doing compression */
 418
 419         struct cryptoini        CRD_INI; /* Initialization/context data */
 420 #define crd_iv          CRD_INI.cri_iv
 421 #define crd_key         CRD_INI.cri_key
 422 #define crd_rnd         CRD_INI.cri_rnd
 423 #define crd_alg         CRD_INI.cri_alg
 424 #define crd_klen        CRD_INI.cri_klen
 425
 426         struct cryptodesc *crd_next;
 427 };
 428
 429 /* Structure describing complete operation */
 430 struct cryptop {
 431         TAILQ_ENTRY(cryptop) crp_next;
 432         u_int64_t       crp_sid;        /* Session ID */
 433
 434         u_int32_t       crp_reqid;      /* request id */
 435         void *          crp_usropaque;  /* Opaque pointer from user, passed along */
 436
 437         int             crp_ilen;       /* Input data total length */
 438         int             crp_olen;       /* Result total length */
 439
 440         int             crp_etype;      /*
 441                                          * Error type (zero means no error).
 442                                          * All error codes except EAGAIN
 443                                          * indicate possible data corruption (as in,
 444                                          * the data have been touched). On all
 445                                          * errors, the crp_sid may have changed
 446                                          * (reset to a new one), so the caller
 447                                          * should always check and use the new
 448                                          * value on future requests.
 449                                          */
 450         int             crp_flags;      /* Note: must hold mutext to modify */
 451
 452 #define CRYPTO_F_IMBUF          0x0001  /* Input/output are mbuf chains */
 453 #define CRYPTO_F_IOV            0x0002  /* Input/output are uio */
 454 #define CRYPTO_F_REL            0x0004  /* Must return data in same place */
 455 #define CRYPTO_F_BATCH          0x0008  /* Batch op if possible possible */
 456 #define CRYPTO_F_CBIMM          0x0010  /* Do callback immediately */
 457 #define CRYPTO_F_DONE           0x0020  /* Operation completed */
 458 #define CRYPTO_F_CBIFSYNC       0x0040  /* Do CBIMM if op is synchronous */
 459 #define CRYPTO_F_ONRETQ         0x0080  /* Request is on return queue */
 460 #define CRYPTO_F_USER           0x0100  /* Request is in user context */
 461 #define CRYPTO_F_MORE           0x0200  /* more data to follow */
 462
 463         void *          crp_buf;        /* Data to be processed */
 464         void *          crp_opaque;     /* Opaque pointer, passed along */
 465         struct cryptodesc *crp_desc;    /* Linked list of processing descriptors */
 466
 467         int (*crp_callback)(struct cryptop *); /* Callback function */
 468
 469         void *          crp_mac;
 470         struct timespec crp_tstamp;     /* performance time stamp */
 471         kcondvar_t      crp_cv;
 472         struct fcrypt   *fcrp;
 473         void *          dst;
 474         void *          mac;
 475         u_int           len;
 476         u_char          tmp_iv[EALG_MAX_BLOCK_LEN];
 477         u_char          tmp_mac[CRYPTO_MAX_MAC_LEN];
 478
 479         struct iovec    iovec[1];
 480         struct uio      uio;
 481         uint32_t        magic;
 482 };
 483
 484 #define CRYPTO_BUF_CONTIG       0x0
 485 #define CRYPTO_BUF_IOV          0x1
 486 #define CRYPTO_BUF_MBUF         0x2
 487
 488 #define CRYPTO_OP_DECRYPT       0x0
 489 #define CRYPTO_OP_ENCRYPT       0x1
 490
 491 /*
 492  * Hints passed to process methods.
 493  */
 494 #define CRYPTO_HINT_MORE        0x1     /* more ops coming shortly */
 495
 496 struct cryptkop {
 497         TAILQ_ENTRY(cryptkop) krp_next;
 498
 499         u_int32_t       krp_reqid;      /* request id */
 500         void *          krp_usropaque;  /* Opaque pointer from user, passed along */
 501
 502         u_int           krp_op;         /* ie. CRK_MOD_EXP or other */
 503         u_int           krp_status;     /* return status */
 504         u_short         krp_iparams;    /* # of input parameters */
 505         u_short         krp_oparams;    /* # of output parameters */
 506         u_int32_t       krp_hid;
 507         struct crparam  krp_param[CRK_MAXPARAM];        /* kvm */
 508         int             (*krp_callback)(struct cryptkop *);
 509         int             krp_flags;      /* same values as crp_flags */
 510         kcondvar_t      krp_cv;
 511         struct fcrypt   *fcrp;
 512         struct crparam  crk_param[CRK_MAXPARAM];
 513 };
 514
 515 /* Crypto capabilities structure */
 516 struct cryptocap {
 517         u_int32_t       cc_sessions;
 518
 519         /*
 520          * Largest possible operator length (in bits) for each type of
 521          * encryption algorithm.
 522          */
 523         u_int16_t       cc_max_op_len[CRYPTO_ALGORITHM_MAX + 1];
 524
 525         u_int8_t        cc_alg[CRYPTO_ALGORITHM_MAX + 1];
 526
 527         u_int8_t        cc_kalg[CRK_ALGORITHM_MAX + 1];
 528
 529         u_int8_t        cc_flags;
 530         u_int8_t        cc_qblocked;            /* symmetric q blocked */
 531         u_int8_t        cc_kqblocked;           /* asymmetric q blocked */
 532 #define CRYPTOCAP_F_CLEANUP     0x01            /* needs resource cleanup */
 533 #define CRYPTOCAP_F_SOFTWARE    0x02            /* software implementation */
 534 #define CRYPTOCAP_F_SYNC        0x04            /* operates synchronously */
 535
 536         void            *cc_arg;                /* callback argument */
 537         int             (*cc_newsession)(void*, u_int32_t*, struct cryptoini*);
 538         int             (*cc_process) (void*, struct cryptop *, int);
 539         int             (*cc_freesession) (void*, u_int64_t);
 540         void            *cc_karg;               /* callback argument */
 541         int             (*cc_kprocess) (void*, struct cryptkop *, int);
 542 };
 543
 544 /*
 545  * Session ids are 64 bits.  The lower 32 bits contain a "local id" which
 546  * is a driver-private session identifier.  The upper 32 bits contain a
 547  * "hardware id" used by the core crypto code to identify the driver and
 548  * a copy of the driver's capabilities that can be used by client code to
 549  * optimize operation.
 550  */
 551 #define CRYPTO_SESID2HID(_sid)  (((_sid) >> 32) & 0xffffff)
 552 #define CRYPTO_SESID2CAPS(_sid) (((_sid) >> 56) & 0xff)
 553 #define CRYPTO_SESID2LID(_sid)  (((u_int32_t) (_sid)) & 0xffffffff)
 554
 555 MALLOC_DECLARE(M_CRYPTO_DATA);
 556
 557 extern  int crypto_newsession(u_int64_t *sid, struct cryptoini *cri, int hard);
 558 extern  int crypto_freesession(u_int64_t sid);
 559 extern  int32_t crypto_get_driverid(u_int32_t flags);
 560 extern  int crypto_register(u_int32_t driverid, int alg, u_int16_t maxoplen,
 561             u_int32_t flags,
 562             int (*newses)(void*, u_int32_t*, struct cryptoini*),
 563             int (*freeses)(void*, u_int64_t),
 564             int (*process)(void*, struct cryptop *, int),
 565             void *arg);
 566 extern  int crypto_kregister(u_int32_t, int, u_int32_t,
 567             int (*)(void*, struct cryptkop *, int),
 568             void *arg);
 569 extern  int crypto_unregister(u_int32_t driverid, int alg);
 570 extern  int crypto_unregister_all(u_int32_t driverid);
 571 extern  int crypto_dispatch(struct cryptop *crp);
 572 extern  int crypto_kdispatch(struct cryptkop *);
 573 #define CRYPTO_SYMQ     0x1
 574 #define CRYPTO_ASYMQ    0x2
 575 extern  int crypto_unblock(u_int32_t, int);
 576 extern  void crypto_done(struct cryptop *crp);
 577 extern  void crypto_kdone(struct cryptkop *);
 578 extern  int crypto_getfeat(int *);
 579
 580 void    cuio_copydata(struct uio *, int, int, void *);
 581 void    cuio_copyback(struct uio *, int, int, void *);
 582 int     cuio_apply(struct uio *, int, int,
 583             int (*f)(void *, void *, unsigned int), void *);
 584
 585 extern  int crypto_ret_q_remove(struct cryptop *);
 586 extern  int crypto_ret_kq_remove(struct cryptkop *);
 587 extern  void crypto_freereq(struct cryptop *crp);
 588 extern  struct cryptop *crypto_getreq(int num);
 589
 590 extern  int crypto_usercrypto;          /* userland may do crypto requests */
 591 extern  int crypto_userasymcrypto;      /* userland may do asym crypto reqs */
 592 extern  int crypto_devallowsoft;        /* only use hardware crypto */
 593
 594 /*
 595  * Asymmetric operations are allocated in cryptodev.c but can be
 596  * freed in crypto.c.
 597  */
 598 extern struct pool      cryptkop_pool;
 599
 600 /*
 601  * Mutual exclusion and its unwelcome friends.
 602  */
 603
 604 extern  kmutex_t        crypto_mtx;
 605
 606 /*
 607  * initialize the crypto framework subsystem (not the pseudo-device).
 608  * This must be called very early in boot, so the framework is ready
 609  * to handle registration requests when crpto hardware is autoconfigured.
 610  * (This declaration doesnt really belong here but there's no header
 611  * for the raw framework.)
 612  */
 613 void    crypto_init(void);
 614
 615 /*
 616  * Crypto-related utility routines used mainly by drivers.
 617  *
 618  * XXX these don't really belong here; but for now they're
 619  *     kept apart from the rest of the system.
 620  */
 621 struct mbuf;
 622 struct  mbuf    *m_getptr(struct mbuf *, int, int *);
 623
 624 struct uio;
 625 extern  void cuio_copydata(struct uio* uio, int off, int len, void *cp);
 626 extern  void cuio_copyback(struct uio* uio, int off, int len, void *cp);
 627 extern int      cuio_getptr(struct uio *, int loc, int *off);
 628
 629 #ifdef CRYPTO_DEBUG     /* yuck, netipsec defines these differently */
 630 #ifndef DPRINTF
 631 #define DPRINTF(a) uprintf a
 632 #endif
 633 #ifndef DCPRINTF
 634 #define DCPRINTF(a) printf a
 635 #endif
 636 #else
 637 #ifndef DPRINTF
 638 #define DPRINTF(a)
 639 #endif
 640 #ifndef DCPRINTF
 641 #define DCPRINTF(a)
 642 #endif
 643 #endif
 644
 645 #endif /* _KERNEL */
 646 #endif /* _CRYPTO_CRYPTO_H_ */