module/icp/spi/kcf_spi.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or https://opensource.org/licenses/CDDL-1.0.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 /*
  27  * This file is part of the core Kernel Cryptographic Framework.
  28  * It implements the SPI functions exported to cryptographic
  29  * providers.
  30  */
  31
  32
  33 #include <sys/zfs_context.h>
  34 #include <sys/crypto/common.h>
  35 #include <sys/crypto/impl.h>
  36 #include <sys/crypto/sched_impl.h>
  37 #include <sys/crypto/spi.h>
  38
  39 static int init_prov_mechs(const crypto_provider_info_t *,
  40     kcf_provider_desc_t *);
  41
  42 /*
  43  * This routine is used to add cryptographic providers to the KEF framework.
  44  * Providers pass a crypto_provider_info structure to crypto_register_provider()
  45  * and get back a handle.  The crypto_provider_info structure contains a
  46  * list of mechanisms supported by the provider and an ops vector containing
  47  * provider entry points.  Providers call this routine in their _init() routine.
  48  */
  49 int
  50 crypto_register_provider(const crypto_provider_info_t *info,
  51     crypto_kcf_provider_handle_t *handle)
  52 {
  53         kcf_provider_desc_t *prov_desc = NULL;
  54         int ret = CRYPTO_ARGUMENTS_BAD;
  55
  56         /*
  57          * Allocate and initialize a new provider descriptor. We also
  58          * hold it and release it when done.
  59          */
  60         prov_desc = kcf_alloc_provider_desc();
  61         KCF_PROV_REFHOLD(prov_desc);
  62
  63         /* copy provider description string */
  64         prov_desc->pd_description = info->pi_provider_description;
  65
  66         /* Change from Illumos: the ops vector is persistent. */
  67         prov_desc->pd_ops_vector = info->pi_ops_vector;
  68
  69         /* process the mechanisms supported by the provider */
  70         if ((ret = init_prov_mechs(info, prov_desc)) != CRYPTO_SUCCESS)
  71                 goto bail;
  72
  73         /*
  74          * Add provider to providers tables, also sets the descriptor
  75          * pd_prov_id field.
  76          */
  77         if ((ret = kcf_prov_tab_add_provider(prov_desc)) != CRYPTO_SUCCESS) {
  78                 undo_register_provider(prov_desc, B_FALSE);
  79                 goto bail;
  80         }
  81
  82         /*
  83          * The global queue is used for providers. We handle ordering
  84          * of multi-part requests in the taskq routine. So, it is safe to
  85          * have multiple threads for the taskq. We pass TASKQ_PREPOPULATE flag
  86          * to keep some entries cached to improve performance.
  87          */
  88
  89         mutex_enter(&prov_desc->pd_lock);
  90         prov_desc->pd_state = KCF_PROV_READY;
  91         mutex_exit(&prov_desc->pd_lock);
  92
  93         *handle = prov_desc->pd_kcf_prov_handle;
  94         ret = CRYPTO_SUCCESS;
  95
  96 bail:
  97         KCF_PROV_REFRELE(prov_desc);
  98         return (ret);
  99 }
 100
 101 /*
 102  * This routine is used to notify the framework when a provider is being
 103  * removed.  Providers call this routine in their _fini() routine.
 104  */
 105 int
 106 crypto_unregister_provider(crypto_kcf_provider_handle_t handle)
 107 {
 108         uint_t mech_idx;
 109         kcf_provider_desc_t *desc;
 110         kcf_prov_state_t saved_state;
 111
 112         /* lookup provider descriptor */
 113         if ((desc = kcf_prov_tab_lookup((crypto_provider_id_t)handle)) == NULL)
 114                 return (CRYPTO_UNKNOWN_PROVIDER);
 115
 116         mutex_enter(&desc->pd_lock);
 117         /*
 118          * Check if any other thread is disabling or removing
 119          * this provider. We return if this is the case.
 120          */
 121         if (desc->pd_state >= KCF_PROV_DISABLED) {
 122                 mutex_exit(&desc->pd_lock);
 123                 /* Release reference held by kcf_prov_tab_lookup(). */
 124                 KCF_PROV_REFRELE(desc);
 125                 return (CRYPTO_BUSY);
 126         }
 127
 128         saved_state = desc->pd_state;
 129         desc->pd_state = KCF_PROV_REMOVED;
 130
 131         /*
 132          * Check if this provider is currently being used.
 133          * pd_irefcnt is the number of holds from the internal
 134          * structures. We add one to account for the above lookup.
 135          */
 136         if (desc->pd_refcnt > desc->pd_irefcnt + 1) {
 137                 desc->pd_state = saved_state;
 138                 mutex_exit(&desc->pd_lock);
 139                 /* Release reference held by kcf_prov_tab_lookup(). */
 140                 KCF_PROV_REFRELE(desc);
 141                 /*
 142                  * The administrator will presumably stop the clients,
 143                  * thus removing the holds, when they get the busy
 144                  * return value.  Any retry will succeed then.
 145                  */
 146                 return (CRYPTO_BUSY);
 147         }
 148         mutex_exit(&desc->pd_lock);
 149
 150         /* remove the provider from the mechanisms tables */
 151         for (mech_idx = 0; mech_idx < desc->pd_mech_list_count;
 152             mech_idx++) {
 153                 kcf_remove_mech_provider(
 154                     desc->pd_mechanisms[mech_idx].cm_mech_name, desc);
 155         }
 156
 157         /* remove provider from providers table */
 158         if (kcf_prov_tab_rem_provider((crypto_provider_id_t)handle) !=
 159             CRYPTO_SUCCESS) {
 160                 /* Release reference held by kcf_prov_tab_lookup(). */
 161                 KCF_PROV_REFRELE(desc);
 162                 return (CRYPTO_UNKNOWN_PROVIDER);
 163         }
 164
 165         /* Release reference held by kcf_prov_tab_lookup(). */
 166         KCF_PROV_REFRELE(desc);
 167
 168         /*
 169          * Wait till the existing requests complete.
 170          */
 171         mutex_enter(&desc->pd_lock);
 172         while (desc->pd_state != KCF_PROV_FREED)
 173                 cv_wait(&desc->pd_remove_cv, &desc->pd_lock);
 174         mutex_exit(&desc->pd_lock);
 175
 176         /*
 177          * This is the only place where kcf_free_provider_desc()
 178          * is called directly. KCF_PROV_REFRELE() should free the
 179          * structure in all other places.
 180          */
 181         ASSERT(desc->pd_state == KCF_PROV_FREED &&
 182             desc->pd_refcnt == 0);
 183         kcf_free_provider_desc(desc);
 184
 185         return (CRYPTO_SUCCESS);
 186 }
 187
 188 /*
 189  * Process the mechanism info structures specified by the provider
 190  * during registration. A NULL crypto_provider_info_t indicates
 191  * an already initialized provider descriptor.
 192  *
 193  * Returns CRYPTO_SUCCESS on success, CRYPTO_ARGUMENTS if one
 194  * of the specified mechanisms was malformed, or CRYPTO_HOST_MEMORY
 195  * if the table of mechanisms is full.
 196  */
 197 static int
 198 init_prov_mechs(const crypto_provider_info_t *info, kcf_provider_desc_t *desc)
 199 {
 200         uint_t mech_idx;
 201         uint_t cleanup_idx;
 202         int err = CRYPTO_SUCCESS;
 203         kcf_prov_mech_desc_t *pmd;
 204         int desc_use_count = 0;
 205
 206         /*
 207          * Copy the mechanism list from the provider info to the provider
 208          * descriptor. desc->pd_mechanisms has an extra crypto_mech_info_t
 209          * element if the provider has random_ops since we keep an internal
 210          * mechanism, SUN_RANDOM, in this case.
 211          */
 212         if (info != NULL) {
 213                 ASSERT(info->pi_mechanisms != NULL);
 214                 desc->pd_mech_list_count = info->pi_mech_list_count;
 215                 desc->pd_mechanisms = info->pi_mechanisms;
 216         }
 217
 218         /*
 219          * For each mechanism support by the provider, add the provider
 220          * to the corresponding KCF mechanism mech_entry chain.
 221          */
 222         for (mech_idx = 0; mech_idx < desc->pd_mech_list_count; mech_idx++) {
 223                 if ((err = kcf_add_mech_provider(mech_idx, desc, &pmd)) !=
 224                     KCF_SUCCESS)
 225                         break;
 226
 227                 if (pmd == NULL)
 228                         continue;
 229
 230                 /* The provider will be used for this mechanism */
 231                 desc_use_count++;
 232         }
 233
 234         /*
 235          * Don't allow multiple providers with disabled mechanisms
 236          * to register. Subsequent enabling of mechanisms will result in
 237          * an unsupported configuration, i.e. multiple providers
 238          * per mechanism.
 239          */
 240         if (desc_use_count == 0)
 241                 return (CRYPTO_ARGUMENTS_BAD);
 242
 243         if (err == KCF_SUCCESS)
 244                 return (CRYPTO_SUCCESS);
 245
 246         /*
 247          * An error occurred while adding the mechanism, cleanup
 248          * and bail.
 249          */
 250         for (cleanup_idx = 0; cleanup_idx < mech_idx; cleanup_idx++) {
 251                 kcf_remove_mech_provider(
 252                     desc->pd_mechanisms[cleanup_idx].cm_mech_name, desc);
 253         }
 254
 255         if (err == KCF_MECH_TAB_FULL)
 256                 return (CRYPTO_HOST_MEMORY);
 257
 258         return (CRYPTO_ARGUMENTS_BAD);
 259 }
 260
 261 /*
 262  * Utility routine called from failure paths in crypto_register_provider()
 263  * and from crypto_load_soft_disabled().
 264  */
 265 void
 266 undo_register_provider(kcf_provider_desc_t *desc, boolean_t remove_prov)
 267 {
 268         uint_t mech_idx;
 269
 270         /* remove the provider from the mechanisms tables */
 271         for (mech_idx = 0; mech_idx < desc->pd_mech_list_count;
 272             mech_idx++) {
 273                 kcf_remove_mech_provider(
 274                     desc->pd_mechanisms[mech_idx].cm_mech_name, desc);
 275         }
 276
 277         /* remove provider from providers table */
 278         if (remove_prov)
 279                 (void) kcf_prov_tab_rem_provider(desc->pd_prov_id);
 280 }