crypto - zygaena/hammerhead

root / base / usr / src / uts / common / sys / crypto
crypto Plain Text 7104 lines 228.3 KB
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#ifndef	_SYS_CRYPTO_API_H
#define	_SYS_CRYPTO_API_H

#ifdef	__cplusplus
extern "C" {
#endif

#include <sys/types.h>
#include <sys/crypto/common.h>

typedef long crypto_req_id_t;
typedef void *crypto_bc_t;
typedef void *crypto_context_t;
typedef void *crypto_ctx_template_t;

typedef uint32_t crypto_call_flag_t;

/* crypto_call_flag's values */
#define	CRYPTO_ALWAYS_QUEUE	0x00000001	/* ALWAYS queue the req. */
#define	CRYPTO_NOTIFY_OPDONE	0x00000002	/* Notify intermediate steps */
#define	CRYPTO_SKIP_REQID	0x00000004	/* Skip request ID generation */

typedef struct {
	crypto_call_flag_t	cr_flag;
	void			(*cr_callback_func)(void *, int);
	void			*cr_callback_arg;
	crypto_req_id_t		cr_reqid;
} crypto_call_req_t;

/*
 * Returns the mechanism type corresponding to a mechanism name.
 */

#define	CRYPTO_MECH_INVALID	((uint64_t)-1)
extern crypto_mech_type_t crypto_mech2id(const char *name);

/*
 * Create and destroy context templates.
 */
extern int crypto_create_ctx_template(crypto_mechanism_t *mech,
    crypto_key_t *key, crypto_ctx_template_t *tmpl, int kmflag);
extern void crypto_destroy_ctx_template(crypto_ctx_template_t tmpl);

/*
 * Single and multi-part digest operations.
 */
extern int crypto_digest(crypto_mechanism_t *mech, crypto_data_t *data,
    crypto_data_t *digest, crypto_call_req_t *cr);
extern int crypto_digest_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_data_t *, crypto_data_t *,
    crypto_call_req_t *);
extern int crypto_digest_init(crypto_mechanism_t *mech, crypto_context_t *ctxp,
    crypto_call_req_t *cr);
extern int crypto_digest_init_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_context_t *, crypto_call_req_t *);
extern int crypto_digest_update(crypto_context_t ctx, crypto_data_t *data,
    crypto_call_req_t *cr);
extern int crypto_digest_final(crypto_context_t ctx, crypto_data_t *digest,
    crypto_call_req_t *cr);

/*
 * Single and multi-part MAC operations.
 */
extern int crypto_mac(crypto_mechanism_t *mech, crypto_data_t *data,
    crypto_key_t *key, crypto_ctx_template_t tmpl, crypto_data_t *mac,
    crypto_call_req_t *cr);
extern int crypto_mac_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_data_t *, crypto_key_t *,
    crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *);
extern int crypto_mac_verify(crypto_mechanism_t *mech, crypto_data_t *data,
    crypto_key_t *key, crypto_ctx_template_t tmpl, crypto_data_t *mac,
    crypto_call_req_t *cr);
extern int crypto_mac_verify_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_data_t *, crypto_key_t *,
    crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *);
extern int crypto_mac_init(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_ctx_template_t tmpl, crypto_context_t *ctxp, crypto_call_req_t *cr);
extern int crypto_mac_init_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t,
    crypto_context_t *, crypto_call_req_t *);
extern int crypto_mac_update(crypto_context_t ctx, crypto_data_t *data,
    crypto_call_req_t *cr);
extern int crypto_mac_final(crypto_context_t ctx, crypto_data_t *data,
    crypto_call_req_t *cr);

/*
 * Single and multi-part sign with private key operations.
 */
extern int crypto_sign(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_data_t *data, crypto_ctx_template_t tmpl,
    crypto_data_t *signature, crypto_call_req_t *cr);
extern int crypto_sign_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
    crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *);
extern int crypto_sign_init(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_ctx_template_t tmpl, crypto_context_t *ctxp, crypto_call_req_t *cr);
extern int crypto_sign_init_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t,
    crypto_context_t *, crypto_call_req_t *);
extern int crypto_sign_update(crypto_context_t ctx, crypto_data_t *data,
    crypto_call_req_t *cr);
extern int crypto_sign_final(crypto_context_t ctx, crypto_data_t *signature,
    crypto_call_req_t *cr);
extern int crypto_sign_recover_init_prov(crypto_provider_t,
    crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *,
    crypto_ctx_template_t tmpl, crypto_context_t *, crypto_call_req_t *);
extern int crypto_sign_recover(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_data_t *data, crypto_ctx_template_t tmpl, crypto_data_t *signature,
    crypto_call_req_t *cr);
extern int crypto_sign_recover_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
    crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *);

/*
 * Single and multi-part verify with public key operations.
 */
extern int crypto_verify(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_data_t *data, crypto_ctx_template_t tmpl, crypto_data_t *signature,
    crypto_call_req_t *cr);
extern int crypto_verify_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
    crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *);
extern int crypto_verify_init(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_ctx_template_t tmpl, crypto_context_t *ctxp, crypto_call_req_t *cr);
extern int crypto_verify_init_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t,
    crypto_context_t *, crypto_call_req_t *);
extern int crypto_verify_update(crypto_context_t ctx, crypto_data_t *data,
    crypto_call_req_t *cr);
extern int crypto_verify_final(crypto_context_t ctx, crypto_data_t *signature,
    crypto_call_req_t *cr);
extern int crypto_verify_recover_init_prov(crypto_provider_t,
    crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *,
    crypto_ctx_template_t tmpl, crypto_context_t *, crypto_call_req_t *);
extern int crypto_verify_recover(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_data_t *signature, crypto_ctx_template_t tmpl, crypto_data_t *data,
    crypto_call_req_t *cr);
extern int crypto_verify_recover_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
    crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *);

/*
 * Single and multi-part encryption operations.
 */
extern int crypto_encrypt(crypto_mechanism_t *mech, crypto_data_t *plaintext,
    crypto_key_t *key, crypto_ctx_template_t tmpl, crypto_data_t *ciphertext,
    crypto_call_req_t *cr);
extern int crypto_encrypt_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_data_t *, crypto_key_t *,
    crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *);
extern int crypto_encrypt_init(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_ctx_template_t tmpl, crypto_context_t *ctxp, crypto_call_req_t *cr);
extern int crypto_encrypt_init_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t,
    crypto_context_t *, crypto_call_req_t *);
extern int crypto_encrypt_update(crypto_context_t ctx,
    crypto_data_t *plaintext, crypto_data_t *ciphertext,
    crypto_call_req_t *cr);
extern int crypto_encrypt_final(crypto_context_t ctx,
    crypto_data_t *ciphertext, crypto_call_req_t *cr);

/*
 * Single and multi-part decryption operations.
 */
extern int crypto_decrypt(crypto_mechanism_t *mech, crypto_data_t *ciphertext,
    crypto_key_t *key, crypto_ctx_template_t tmpl, crypto_data_t *plaintext,
    crypto_call_req_t *cr);
extern int crypto_decrypt_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_data_t *, crypto_key_t *,
    crypto_ctx_template_t, crypto_data_t *, crypto_call_req_t *);
extern int crypto_decrypt_init(crypto_mechanism_t *mech, crypto_key_t *key,
    crypto_ctx_template_t tmpl, crypto_context_t *ctxp,
    crypto_call_req_t *cr);
extern int crypto_decrypt_init_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_ctx_template_t,
    crypto_context_t *, crypto_call_req_t *);
extern int crypto_decrypt_update(crypto_context_t ctx,
    crypto_data_t *ciphertext, crypto_data_t *plaintext,
    crypto_call_req_t *cr);
extern int crypto_decrypt_final(crypto_context_t ctx, crypto_data_t *plaintext,
    crypto_call_req_t *cr);

/*
 * Single and multi-part encrypt/MAC dual operations.
 */
extern int crypto_encrypt_mac(crypto_mechanism_t *encr_mech,
    crypto_mechanism_t *mac_mech, crypto_data_t *pt,
    crypto_key_t *encr_key, crypto_key_t *mac_key,
    crypto_ctx_template_t encr_tmpl, crypto_ctx_template_t mac_tmpl,
    crypto_dual_data_t *ct, crypto_data_t *mac, crypto_call_req_t *cr);
extern int crypto_encrypt_mac_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_mechanism_t *, crypto_data_t *,
    crypto_key_t *, crypto_key_t *, crypto_ctx_template_t,
    crypto_ctx_template_t, crypto_dual_data_t *, crypto_data_t *,
    crypto_call_req_t *);
extern int crypto_encrypt_mac_init(crypto_mechanism_t *encr_mech,
    crypto_mechanism_t *mac_mech, crypto_key_t *encr_key,
    crypto_key_t *mac_key, crypto_ctx_template_t encr_tmpl,
    crypto_ctx_template_t mac_tmpl, crypto_context_t *ctxp,
    crypto_call_req_t *cr);
extern int crypto_encrypt_mac_init_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_mechanism_t *, crypto_key_t *, crypto_key_t *,
    crypto_ctx_template_t, crypto_ctx_template_t, crypto_context_t *,
    crypto_call_req_t *);
extern int crypto_encrypt_mac_update(crypto_context_t ctx,
    crypto_data_t *pt, crypto_dual_data_t *ct, crypto_call_req_t *cr);
extern int crypto_encrypt_mac_final(crypto_context_t ctx,
    crypto_dual_data_t *ct, crypto_data_t *mac, crypto_call_req_t *cr);

/*
 * Single and multi-part MAC/decrypt dual operations.
 */
extern int crypto_mac_decrypt(crypto_mechanism_t *mac_mech,
    crypto_mechanism_t *decr_mech, crypto_dual_data_t *ct,
    crypto_key_t *mac_key, crypto_key_t *decr_key,
    crypto_ctx_template_t mac_tmpl, crypto_ctx_template_t decr_tmpl,
    crypto_data_t *mac, crypto_data_t *pt, crypto_call_req_t *cr);
extern int crypto_mac_decrypt_prov(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *mac_mech, crypto_mechanism_t *decr_mech,
    crypto_dual_data_t *ct, crypto_key_t *mac_key, crypto_key_t *decr_key,
    crypto_ctx_template_t mac_tmpl, crypto_ctx_template_t decr_tmpl,
    crypto_data_t *mac, crypto_data_t *pt, crypto_call_req_t *cr);
extern int crypto_mac_verify_decrypt(crypto_mechanism_t *mac_mech,
    crypto_mechanism_t *decr_mech, crypto_dual_data_t *ct,
    crypto_key_t *mac_key, crypto_key_t *decr_key,
    crypto_ctx_template_t mac_tmpl, crypto_ctx_template_t decr_tmpl,
    crypto_data_t *mac, crypto_data_t *pt, crypto_call_req_t *cr);
extern int crypto_mac_verify_decrypt_prov(crypto_provider_t,
    crypto_session_id_t, crypto_mechanism_t *mac_mech,
    crypto_mechanism_t *decr_mech, crypto_dual_data_t *ct,
    crypto_key_t *mac_key, crypto_key_t *decr_key,
    crypto_ctx_template_t mac_tmpl, crypto_ctx_template_t decr_tmpl,
    crypto_data_t *mac, crypto_data_t *pt, crypto_call_req_t *cr);
extern int crypto_mac_decrypt_init(crypto_mechanism_t *mac_mech,
    crypto_mechanism_t *decr_mech, crypto_key_t *mac_key,
    crypto_key_t *decr_key, crypto_ctx_template_t mac_tmpl,
    crypto_ctx_template_t decr_tmpl, crypto_context_t *ctxp,
    crypto_call_req_t *cr);
extern int crypto_mac_decrypt_init_prov(crypto_provider_t,
    crypto_session_id_t, crypto_mechanism_t *mac_mech,
    crypto_mechanism_t *decr_mech, crypto_key_t *mac_key,
    crypto_key_t *decr_key, crypto_ctx_template_t mac_tmpl,
    crypto_ctx_template_t decr_tmpl, crypto_context_t *ctxp,
    crypto_call_req_t *cr);
extern int crypto_mac_decrypt_update(crypto_context_t ctx,
    crypto_dual_data_t *ct, crypto_data_t *pt, crypto_call_req_t *cr);
extern int crypto_mac_decrypt_final(crypto_context_t ctx, crypto_data_t *mac,
    crypto_data_t *pt, crypto_call_req_t *cr);

/* Session Management */
extern int crypto_session_open(crypto_provider_t, crypto_session_id_t *,
    crypto_call_req_t *);
extern int crypto_session_close(crypto_provider_t, crypto_session_id_t,
    crypto_call_req_t *);
extern int crypto_session_login(crypto_provider_t, crypto_session_id_t,
    crypto_user_type_t, char *, size_t, crypto_call_req_t *);
extern int crypto_session_logout(crypto_provider_t, crypto_session_id_t,
    crypto_call_req_t *);

/* Object Management */
extern int crypto_object_copy(crypto_provider_t, crypto_session_id_t,
    crypto_object_id_t, crypto_object_attribute_t *, uint_t,
    crypto_object_id_t *, crypto_call_req_t *);
extern int crypto_object_create(crypto_provider_t, crypto_session_id_t,
    crypto_object_attribute_t *, uint_t, crypto_object_id_t *,
    crypto_call_req_t *);
extern int crypto_object_destroy(crypto_provider_t, crypto_session_id_t,
    crypto_object_id_t, crypto_call_req_t *);
extern int crypto_object_get_attribute_value(crypto_provider_t,
    crypto_session_id_t, crypto_object_id_t, crypto_object_attribute_t *,
    uint_t, crypto_call_req_t *);
extern int crypto_object_get_size(crypto_provider_t, crypto_session_id_t,
    crypto_object_id_t, size_t *, crypto_call_req_t *);
extern int crypto_object_find_final(crypto_provider_t, void *,
    crypto_call_req_t *);
extern int crypto_object_find_init(crypto_provider_t, crypto_session_id_t,
    crypto_object_attribute_t *, uint_t, void **, crypto_call_req_t *);
extern int crypto_object_find(crypto_provider_t, void *, crypto_object_id_t *,
    uint_t *, uint_t, crypto_call_req_t *);
extern int crypto_object_set_attribute_value(crypto_provider_t,
    crypto_session_id_t, crypto_object_id_t, crypto_object_attribute_t *,
    uint_t, crypto_call_req_t *);

/* Key Management */
extern int crypto_key_derive(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_object_attribute_t *,
    uint_t, crypto_object_id_t *, crypto_call_req_t *);
extern int crypto_key_generate(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_object_attribute_t *, uint_t,
    crypto_object_id_t *, crypto_call_req_t *);
extern int crypto_key_generate_pair(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_object_attribute_t *, uint_t,
    crypto_object_attribute_t *, uint_t, crypto_object_id_t *,
    crypto_object_id_t *, crypto_call_req_t *);
extern int crypto_key_unwrap(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, uchar_t *, size_t *,
    crypto_object_attribute_t *, uint_t, crypto_object_id_t *,
    crypto_call_req_t *);
extern int crypto_key_wrap(crypto_provider_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_object_id_t *, uchar_t *,
    size_t *, crypto_call_req_t *);
extern int crypto_key_check_prov(crypto_provider_t, crypto_mechanism_t *mech,
    crypto_key_t *key);
extern int crypto_key_check(crypto_mechanism_t *mech, crypto_key_t *key);


/*
 * Routines to cancel a single asynchronous request or all asynchronous
 * requests associated with a particular context.
 */
extern void crypto_cancel_req(crypto_req_id_t req);
extern void crypto_cancel_ctx(crypto_context_t ctx);

/*
 * crypto_get_mech_list(9F) allocates and returns the list of currently
 * supported cryptographic mechanisms.
 */
extern crypto_mech_name_t *crypto_get_mech_list(uint_t *count, int kmflag);
extern void crypto_free_mech_list(crypto_mech_name_t *mech_names,
    uint_t count);

extern crypto_provider_t crypto_get_provider(char *, char *, char *);
extern int crypto_get_provinfo(crypto_provider_t, crypto_provider_ext_info_t *);
extern void crypto_release_provider(crypto_provider_t);

/*
 * A kernel consumer can request to be notified when some particular event
 * occurs. The valid events, callback function type, and functions to
 * be called to register or unregister for notification are defined below.
 */

#define	CRYPTO_EVENT_MECHS_CHANGED		0x00000001
#define	CRYPTO_EVENT_PROVIDER_REGISTERED	0x00000002
#define	CRYPTO_EVENT_PROVIDER_UNREGISTERED	0x00000004

typedef enum {
	CRYPTO_MECH_ADDED = 1,
	CRYPTO_MECH_REMOVED
} crypto_event_change_t;

/* The event_arg argument structure for CRYPTO_EVENT_PROVIDERS_CHANGE event */
typedef struct crypto_notify_event_change {
	crypto_mech_name_t ec_mech_name;
	crypto_provider_type_t ec_provider_type;
	crypto_event_change_t ec_change;
} crypto_notify_event_change_t;

typedef void *crypto_notify_handle_t;
typedef void (*crypto_notify_callback_t)(uint32_t event_mask, void *event_arg);

extern crypto_notify_handle_t crypto_notify_events(
    crypto_notify_callback_t nf, uint32_t event_mask);
extern void crypto_unnotify_events(crypto_notify_handle_t);

/*
 * crypto_bufcall(9F) group of routines.
 */
extern crypto_bc_t crypto_bufcall_alloc(void);
extern int crypto_bufcall_free(crypto_bc_t bc);
extern int crypto_bufcall(crypto_bc_t bc, void (*func)(void *arg), void *arg);
extern int crypto_unbufcall(crypto_bc_t bc);

/*
 * To obtain the list of key size ranges supported by a mechanism.
 */

#define	CRYPTO_MECH_USAGE_ENCRYPT	0x00000001
#define	CRYPTO_MECH_USAGE_DECRYPT	0x00000002
#define	CRYPTO_MECH_USAGE_MAC		0x00000004

typedef	uint32_t crypto_mech_usage_t;

typedef struct crypto_mechanism_info {
	size_t mi_min_key_size;
	size_t mi_max_key_size;
	crypto_keysize_unit_t mi_keysize_unit; /* for mi_xxx_key_size */
	crypto_mech_usage_t mi_usage;
} crypto_mechanism_info_t;

#ifdef	_SYSCALL32

typedef struct crypto_mechanism_info32 {
	size32_t mi_min_key_size;
	size32_t mi_max_key_size;
	crypto_keysize_unit_t mi_keysize_unit; /* for mi_xxx_key_size */
	crypto_mech_usage_t mi_usage;
} crypto_mechanism_info32_t;

#endif	/* _SYSCALL32 */

extern int crypto_get_all_mech_info(crypto_mech_type_t,
    crypto_mechanism_info_t **, uint_t *, int);
extern void crypto_free_all_mech_info(crypto_mechanism_info_t *, uint_t);

#ifdef	__cplusplus
}
#endif

#endif	/* _SYS_CRYPTO_API_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 */
/*
 * Copyright 2013 Saso Kiselkov.  All rights reserved.
 * Copyright 2023 RackTop Systems, Inc.
 */

#ifndef _SYS_CRYPTO_COMMON_H
#define	_SYS_CRYPTO_COMMON_H

/*
 * Header file for the common data structures of the cryptographic framework
 */

#ifdef __cplusplus
extern "C" {
#endif

#include <sys/types.h>
#include <sys/uio.h>
#include <sys/stream.h>
#include <sys/mutex.h>
#include <sys/condvar.h>


/* Cryptographic Mechanisms */

#define	CRYPTO_MAX_MECH_NAME 32
typedef char crypto_mech_name_t[CRYPTO_MAX_MECH_NAME];

typedef uint64_t crypto_mech_type_t;

typedef struct crypto_mechanism {
	crypto_mech_type_t	cm_type;	/* mechanism type */
	caddr_t			cm_param;	/* mech. parameter */
	size_t			cm_param_len;	/* mech. parameter len */
} crypto_mechanism_t;

#ifdef  _SYSCALL32

typedef struct crypto_mechanism32 {
	crypto_mech_type_t	cm_type;	/* mechanism type */
	caddr32_t		cm_param;	/* mech. parameter */
	size32_t		cm_param_len;   /* mech. parameter len */
} crypto_mechanism32_t;

#endif  /* _SYSCALL32 */

/*
 * New structures that have internal pointers need a custom me_copyin_param
 * and me_free_param function added to their kcf_mech_entry_t.
 * See: kcf_copyin_*_param in kcf_mech_tabs.c.
 */

#ifdef _KERNEL
/* CK_AES_CTR_PARAMS provides parameters to the CKM_AES_CTR mechanism */
typedef struct CK_AES_CTR_PARAMS {
	ulong_t	ulCounterBits;
	uint8_t cb[16];
} CK_AES_CTR_PARAMS;
#endif

/* CK_AES_CCM_PARAMS provides parameters to the CKM_AES_CCM mechanism */
typedef struct CK_AES_CCM_PARAMS {
	ulong_t ulMACSize;
	ulong_t ulNonceSize;
	ulong_t ulAuthDataSize;
	ulong_t ulDataSize; /* used for plaintext or ciphertext */
	uchar_t *nonce;
	uchar_t *authData;
} CK_AES_CCM_PARAMS;

/* CK_AES_GCM_PARAMS provides parameters to the CKM_AES_GCM mechanism */
typedef struct CK_AES_GCM_PARAMS {
	uchar_t *pIv;
	ulong_t ulIvLen;
	ulong_t ulIvBits;
	uchar_t *pAAD;
	ulong_t ulAADLen;
	ulong_t ulTagBits;
} CK_AES_GCM_PARAMS;

/* CK_AES_GMAC_PARAMS provides parameters to the CKM_AES_GMAC mechanism */
typedef struct CK_AES_GMAC_PARAMS {
	uchar_t *pIv;	/* Length is AES_GMAC_IV_LEN */
	uchar_t *pAAD;
	ulong_t ulAADLen;
} CK_AES_GMAC_PARAMS;

#ifdef _KERNEL
/*
 * CK_ECDH1_DERIVE_PARAMS provides the parameters to the
 * CKM_ECDH1_KEY_DERIVE mechanism
 */
typedef struct CK_ECDH1_DERIVE_PARAMS {
	ulong_t		kdf;
	ulong_t		ulSharedDataLen;
	uchar_t		*pSharedData;
	ulong_t		ulPublicDataLen;
	uchar_t		*pPublicData;
} CK_ECDH1_DERIVE_PARAMS;
#endif

#ifdef _KERNEL
#ifdef  _SYSCALL32

/* needed for 32-bit applications running on 64-bit kernels */
typedef struct CK_AES_CTR_PARAMS32 {
	uint32_t ulCounterBits;
	uint8_t cb[16];
} CK_AES_CTR_PARAMS32;

/* needed for 32-bit applications running on 64-bit kernels */
typedef struct CK_AES_CCM_PARAMS32 {
	uint32_t ulMACSize;
	uint32_t ulNonceSize;
	uint32_t ulAuthDataSize;
	uint32_t ulDataSize;
	caddr32_t nonce;
	caddr32_t authData;
} CK_AES_CCM_PARAMS32;

/* needed for 32-bit applications running on 64-bit kernels */
typedef struct CK_AES_GCM_PARAMS32 {
	caddr32_t pIv;
	uint32_t ulIvLen;
	uint32_t ulIvBits;
	caddr32_t pAAD;
	uint32_t ulAADLen;
	uint32_t ulTagBits;
} CK_AES_GCM_PARAMS32;

/* needed for 32-bit applications running on 64-bit kernels */
typedef struct CK_AES_GMAC_PARAMS32 {
	caddr32_t pIv;
	caddr32_t pAAD;
	uint32_t ulAADLen;
} CK_AES_GMAC_PARAMS32;

typedef struct CK_ECDH1_DERIVE_PARAMS32 {
	uint32_t	kdf;
	uint32_t	ulSharedDataLen;
	caddr32_t	pSharedData;
	uint32_t	ulPublicDataLen;
	caddr32_t	pPublicData;
} CK_ECDH1_DERIVE_PARAMS32;

#endif  /* _SYSCALL32 */
#endif /* _KERNEL */

/*
 * The measurement unit bit flag for a mechanism's minimum or maximum key size.
 * The unit are mechanism dependent.  It can be in bits or in bytes.
 */
typedef uint32_t crypto_keysize_unit_t;

/*
 * The following bit flags are valid in cm_mech_flags field in
 * the crypto_mech_info_t structure of the SPI.
 *
 * Only the first two bit flags are valid in mi_keysize_unit
 * field in the crypto_mechanism_info_t structure of the API.
 */
#define	CRYPTO_KEYSIZE_UNIT_IN_BITS	0x00000001
#define	CRYPTO_KEYSIZE_UNIT_IN_BYTES	0x00000002
#define	CRYPTO_CAN_SHARE_OPSTATE	0x00000004 /* supports sharing */


/* Mechanisms supported out-of-the-box */
#define	SUN_CKM_MD4			"CKM_MD4"
#define	SUN_CKM_MD5			"CKM_MD5"
#define	SUN_CKM_MD5_HMAC		"CKM_MD5_HMAC"
#define	SUN_CKM_MD5_HMAC_GENERAL	"CKM_MD5_HMAC_GENERAL"
#define	SUN_CKM_SHA1			"CKM_SHA_1"
#define	SUN_CKM_SHA1_HMAC		"CKM_SHA_1_HMAC"
#define	SUN_CKM_SHA1_HMAC_GENERAL	"CKM_SHA_1_HMAC_GENERAL"
#define	SUN_CKM_SHA256			"CKM_SHA256"
#define	SUN_CKM_SHA256_HMAC		"CKM_SHA256_HMAC"
#define	SUN_CKM_SHA256_HMAC_GENERAL	"CKM_SHA256_HMAC_GENERAL"
#define	SUN_CKM_SHA384			"CKM_SHA384"
#define	SUN_CKM_SHA384_HMAC		"CKM_SHA384_HMAC"
#define	SUN_CKM_SHA384_HMAC_GENERAL	"CKM_SHA384_HMAC_GENERAL"
#define	SUN_CKM_SHA512			"CKM_SHA512"
#define	SUN_CKM_SHA512_HMAC		"CKM_SHA512_HMAC"
#define	SUN_CKM_SHA512_HMAC_GENERAL	"CKM_SHA512_HMAC_GENERAL"
#define	SUN_CKM_SHA512_224		"CKM_SHA512_224"
#define	SUN_CKM_SHA512_256		"CKM_SHA512_256"
#define	SUN_CKM_DES_CBC			"CKM_DES_CBC"
#define	SUN_CKM_DES3_CBC		"CKM_DES3_CBC"
#define	SUN_CKM_DES_ECB			"CKM_DES_ECB"
#define	SUN_CKM_DES3_ECB		"CKM_DES3_ECB"
#define	SUN_CKM_BLOWFISH_CBC		"CKM_BLOWFISH_CBC"
#define	SUN_CKM_BLOWFISH_ECB		"CKM_BLOWFISH_ECB"
#define	SUN_CKM_AES_CBC			"CKM_AES_CBC"
#define	SUN_CKM_AES_CMAC		"CKM_AES_CMAC"
#define	SUN_CKM_AES_ECB			"CKM_AES_ECB"
#define	SUN_CKM_AES_CTR			"CKM_AES_CTR"
#define	SUN_CKM_AES_CCM			"CKM_AES_CCM"
#define	SUN_CKM_AES_GCM			"CKM_AES_GCM"
#define	SUN_CKM_AES_GMAC		"CKM_AES_GMAC"
#define	SUN_CKM_AES_CFB128		"CKM_AES_CFB128"
#define	SUN_CKM_RC4			"CKM_RC4"
#define	SUN_CKM_RSA_PKCS		"CKM_RSA_PKCS"
#define	SUN_CKM_RSA_X_509		"CKM_RSA_X_509"
#define	SUN_CKM_MD5_RSA_PKCS		"CKM_MD5_RSA_PKCS"
#define	SUN_CKM_SHA1_RSA_PKCS		"CKM_SHA1_RSA_PKCS"
#define	SUN_CKM_SHA256_RSA_PKCS		"CKM_SHA256_RSA_PKCS"
#define	SUN_CKM_SHA384_RSA_PKCS		"CKM_SHA384_RSA_PKCS"
#define	SUN_CKM_SHA512_RSA_PKCS		"CKM_SHA512_RSA_PKCS"
#define	SUN_CKM_EC_KEY_PAIR_GEN		"CKM_EC_KEY_PAIR_GEN"
#define	SUN_CKM_ECDH1_DERIVE		"CKM_ECDH1_DERIVE"
#define	SUN_CKM_ECDSA_SHA1		"CKM_ECDSA_SHA1"
#define	SUN_CKM_ECDSA			"CKM_ECDSA"

/* Shared operation context format for CKM_RC4 */
typedef struct {
#if defined(__amd64)
	uint32_t	i, j;
	uint32_t	arr[256];
	uint32_t	flag;
#else
	uchar_t		arr[256];
	uchar_t		i, j;
#endif /* __amd64 */
	uint64_t	pad;		/* For 64-bit alignment */
} arcfour_state_t;

/* Data arguments of cryptographic operations */

typedef enum crypto_data_format {
	CRYPTO_DATA_RAW = 1,
	CRYPTO_DATA_UIO,
	CRYPTO_DATA_MBLK
} crypto_data_format_t;

typedef struct crypto_data {
	crypto_data_format_t	cd_format;	/* Format identifier	*/
	off_t			cd_offset;	/* Offset from the beginning */
	size_t			cd_length;	/* # of bytes in use */
	caddr_t			cd_miscdata;	/* ancillary data */
	union {
		/* Raw format */
		iovec_t cdu_raw;		/* Pointer and length	    */

		/* uio scatter-gather format */
		uio_t	*cdu_uio;

		/* mblk scatter-gather format */
		mblk_t	*cdu_mp;		/* The mblk chain */

	} cdu;	/* Crypto Data Union */
} crypto_data_t;

#define	cd_raw		cdu.cdu_raw
#define	cd_uio		cdu.cdu_uio
#define	cd_mp		cdu.cdu_mp

typedef struct crypto_dual_data {
	crypto_data_t		dd_data;	/* The data */
	off_t			dd_offset2;	/* Used by dual operation */
	size_t			dd_len2;	/* # of bytes to take	*/
} crypto_dual_data_t;

#define	dd_format	dd_data.cd_format
#define	dd_offset1	dd_data.cd_offset
#define	dd_len1		dd_data.cd_length
#define	dd_miscdata	dd_data.cd_miscdata
#define	dd_raw		dd_data.cd_raw
#define	dd_uio		dd_data.cd_uio
#define	dd_mp		dd_data.cd_mp

/* The keys, and their contents */

typedef enum {
	CRYPTO_KEY_RAW = 1,	/* ck_data is a cleartext key */
	CRYPTO_KEY_REFERENCE,	/* ck_obj_id is an opaque reference */
	CRYPTO_KEY_ATTR_LIST	/* ck_attrs is a list of object attributes */
} crypto_key_format_t;

typedef uint64_t crypto_attr_type_t;

/* Attribute types to use for passing a RSA public key or a private key. */
#define	SUN_CKA_MODULUS			0x00000120
#define	SUN_CKA_MODULUS_BITS		0x00000121
#define	SUN_CKA_PUBLIC_EXPONENT		0x00000122
#define	SUN_CKA_PRIVATE_EXPONENT	0x00000123
#define	SUN_CKA_PRIME_1			0x00000124
#define	SUN_CKA_PRIME_2			0x00000125
#define	SUN_CKA_EXPONENT_1		0x00000126
#define	SUN_CKA_EXPONENT_2		0x00000127
#define	SUN_CKA_COEFFICIENT		0x00000128
#define	SUN_CKA_PRIME			0x00000130
#define	SUN_CKA_SUBPRIME		0x00000131
#define	SUN_CKA_BASE			0x00000132

#define	CKK_EC			0x00000003UL
#define	CKK_GENERIC_SECRET	0x00000010UL
#define	CKK_RC4			0x00000012UL
#define	CKK_AES			0x0000001FUL
#define	CKK_DES			0x00000013UL
#define	CKK_DES2		0x00000014UL
#define	CKK_DES3		0x00000015UL

#define	CKO_PUBLIC_KEY		0x00000002UL
#define	CKO_PRIVATE_KEY		0x00000003UL
#define	CKA_CLASS		0x00000000UL
#define	CKA_VALUE		0x00000011UL
#define	CKA_KEY_TYPE		0x00000100UL
#define	CKA_VALUE_LEN		0x00000161UL
#define	CKA_EC_PARAMS		0x00000180UL
#define	CKA_EC_POINT		0x00000181UL

typedef uint32_t	crypto_object_id_t;

typedef struct crypto_object_attribute {
	crypto_attr_type_t	oa_type;	/* attribute type */
	caddr_t			oa_value;	/* attribute value */
	ssize_t			oa_value_len;	/* length of attribute value */
} crypto_object_attribute_t;

typedef struct crypto_key {
	crypto_key_format_t	ck_format;	/* format identifier */
	union {
		/* for CRYPTO_KEY_RAW ck_format */
		struct {
			uint_t	cku_v_length;	/* # of bits in ck_data   */
			void	*cku_v_data;	/* ptr to key value */
		} cku_key_value;

		/* for CRYPTO_KEY_REFERENCE ck_format */
		crypto_object_id_t cku_key_id;	/* reference to object key */

		/* for CRYPTO_KEY_ATTR_LIST ck_format */
		struct {
			uint_t cku_a_count;	/* number of attributes */
			crypto_object_attribute_t *cku_a_oattr;
		} cku_key_attrs;
	} cku_data;				/* Crypto Key union */
} crypto_key_t;

#ifdef  _SYSCALL32

typedef struct crypto_object_attribute32 {
	uint64_t	oa_type;	/* attribute type */
	caddr32_t	oa_value;	/* attribute value */
	ssize32_t	oa_value_len;	/* length of attribute value */
} crypto_object_attribute32_t;

typedef struct crypto_key32 {
	crypto_key_format_t	ck_format;	/* format identifier */
	union {
		/* for CRYPTO_KEY_RAW ck_format */
		struct {
			uint32_t cku_v_length;	/* # of bytes in ck_data */
			caddr32_t cku_v_data;	/* ptr to key value */
		} cku_key_value;

		/* for CRYPTO_KEY_REFERENCE ck_format */
		crypto_object_id_t cku_key_id; /* reference to object key */

		/* for CRYPTO_KEY_ATTR_LIST ck_format */
		struct {
			uint32_t cku_a_count;	/* number of attributes */
			caddr32_t cku_a_oattr;
		} cku_key_attrs;
	} cku_data;				/* Crypto Key union */
} crypto_key32_t;

#endif  /* _SYSCALL32 */

#define	ck_data		cku_data.cku_key_value.cku_v_data
#define	ck_length	cku_data.cku_key_value.cku_v_length
#define	ck_obj_id	cku_data.cku_key_id
#define	ck_count	cku_data.cku_key_attrs.cku_a_count
#define	ck_attrs	cku_data.cku_key_attrs.cku_a_oattr

/*
 * Raw key lengths are expressed in number of bits.
 * The following macro returns the minimum number of
 * bytes that can contain the specified number of bits.
 * Round up without overflowing the integer type.
 */
#define	CRYPTO_BITS2BYTES(n) ((n) == 0 ? 0 : (((n) - 1) >> 3) + 1)
#define	CRYPTO_BYTES2BITS(n) ((n) << 3)

/* Providers */

typedef enum {
	CRYPTO_HW_PROVIDER = 0,
	CRYPTO_SW_PROVIDER,
	CRYPTO_LOGICAL_PROVIDER
} crypto_provider_type_t;

typedef uint32_t	crypto_provider_id_t;
#define	KCF_PROVID_INVALID	((uint32_t)-1)

typedef struct crypto_provider_entry {
	crypto_provider_id_t	pe_provider_id;
	uint_t			pe_mechanism_count;
} crypto_provider_entry_t;

typedef struct crypto_dev_list_entry {
	char			le_dev_name[MAXNAMELEN];
	uint_t			le_dev_instance;
	uint_t			le_mechanism_count;
} crypto_dev_list_entry_t;

/* User type for authentication ioctls and SPI entry points */

typedef enum crypto_user_type {
	CRYPTO_SO = 0,
	CRYPTO_USER
} crypto_user_type_t;

/* Version for provider management ioctls and SPI entry points */

typedef struct crypto_version {
	uchar_t	cv_major;
	uchar_t	cv_minor;
} crypto_version_t;

/* session data structure opaque to the consumer */
typedef void *crypto_session_t;

/* provider data structure opaque to the consumer */
typedef void *crypto_provider_t;

/* Limits used by both consumers and providers */
#define	CRYPTO_EXT_SIZE_LABEL		32
#define	CRYPTO_EXT_SIZE_MANUF		32
#define	CRYPTO_EXT_SIZE_MODEL		16
#define	CRYPTO_EXT_SIZE_SERIAL		16
#define	CRYPTO_EXT_SIZE_TIME		16

typedef struct crypto_provider_ext_info {
	uchar_t			ei_label[CRYPTO_EXT_SIZE_LABEL];
	uchar_t			ei_manufacturerID[CRYPTO_EXT_SIZE_MANUF];
	uchar_t			ei_model[CRYPTO_EXT_SIZE_MODEL];
	uchar_t			ei_serial_number[CRYPTO_EXT_SIZE_SERIAL];
	ulong_t			ei_flags;
	ulong_t			ei_max_session_count;
	ulong_t			ei_max_pin_len;
	ulong_t			ei_min_pin_len;
	ulong_t			ei_total_public_memory;
	ulong_t			ei_free_public_memory;
	ulong_t			ei_total_private_memory;
	ulong_t			ei_free_private_memory;
	crypto_version_t	ei_hardware_version;
	crypto_version_t	ei_firmware_version;
	uchar_t			ei_time[CRYPTO_EXT_SIZE_TIME];
	int			ei_hash_max_input_len;
	int			ei_hmac_max_input_len;
} crypto_provider_ext_info_t;

typedef uint_t		crypto_session_id_t;

typedef enum cmd_type {
	COPY_FROM_DATA,
	COPY_TO_DATA,
	COMPARE_TO_DATA,
	MD5_DIGEST_DATA,
	SHA1_DIGEST_DATA,
	SHA2_DIGEST_DATA,
	GHASH_DATA
} cmd_type_t;

#define	CRYPTO_DO_UPDATE	0x01
#define	CRYPTO_DO_FINAL		0x02
#define	CRYPTO_DO_MD5		0x04
#define	CRYPTO_DO_SHA1		0x08
#define	CRYPTO_DO_SIGN		0x10
#define	CRYPTO_DO_VERIFY	0x20
#define	CRYPTO_DO_SHA2		0x40

#define	PROVIDER_OWNS_KEY_SCHEDULE	0x00000001

/*
 * Common cryptographic status and error codes.
 */
#define	CRYPTO_SUCCESS				0x00000000
#define	CRYPTO_CANCEL				0x00000001
#define	CRYPTO_HOST_MEMORY			0x00000002
#define	CRYPTO_GENERAL_ERROR			0x00000003
#define	CRYPTO_FAILED				0x00000004
#define	CRYPTO_ARGUMENTS_BAD			0x00000005
#define	CRYPTO_ATTRIBUTE_READ_ONLY		0x00000006
#define	CRYPTO_ATTRIBUTE_SENSITIVE		0x00000007
#define	CRYPTO_ATTRIBUTE_TYPE_INVALID		0x00000008
#define	CRYPTO_ATTRIBUTE_VALUE_INVALID		0x00000009
#define	CRYPTO_CANCELED				0x0000000A
#define	CRYPTO_DATA_INVALID			0x0000000B
#define	CRYPTO_DATA_LEN_RANGE			0x0000000C
#define	CRYPTO_DEVICE_ERROR			0x0000000D
#define	CRYPTO_DEVICE_MEMORY			0x0000000E
#define	CRYPTO_DEVICE_REMOVED			0x0000000F
#define	CRYPTO_ENCRYPTED_DATA_INVALID		0x00000010
#define	CRYPTO_ENCRYPTED_DATA_LEN_RANGE		0x00000011
#define	CRYPTO_KEY_HANDLE_INVALID		0x00000012
#define	CRYPTO_KEY_SIZE_RANGE			0x00000013
#define	CRYPTO_KEY_TYPE_INCONSISTENT		0x00000014
#define	CRYPTO_KEY_NOT_NEEDED			0x00000015
#define	CRYPTO_KEY_CHANGED			0x00000016
#define	CRYPTO_KEY_NEEDED			0x00000017
#define	CRYPTO_KEY_INDIGESTIBLE			0x00000018
#define	CRYPTO_KEY_FUNCTION_NOT_PERMITTED	0x00000019
#define	CRYPTO_KEY_NOT_WRAPPABLE		0x0000001A
#define	CRYPTO_KEY_UNEXTRACTABLE		0x0000001B
#define	CRYPTO_MECHANISM_INVALID		0x0000001C
#define	CRYPTO_MECHANISM_PARAM_INVALID		0x0000001D
#define	CRYPTO_OBJECT_HANDLE_INVALID		0x0000001E
#define	CRYPTO_OPERATION_IS_ACTIVE		0x0000001F
#define	CRYPTO_OPERATION_NOT_INITIALIZED	0x00000020
#define	CRYPTO_PIN_INCORRECT			0x00000021
#define	CRYPTO_PIN_INVALID			0x00000022
#define	CRYPTO_PIN_LEN_RANGE			0x00000023
#define	CRYPTO_PIN_EXPIRED			0x00000024
#define	CRYPTO_PIN_LOCKED			0x00000025
#define	CRYPTO_SESSION_CLOSED			0x00000026
#define	CRYPTO_SESSION_COUNT			0x00000027
#define	CRYPTO_SESSION_HANDLE_INVALID		0x00000028
#define	CRYPTO_SESSION_READ_ONLY		0x00000029
#define	CRYPTO_SESSION_EXISTS			0x0000002A
#define	CRYPTO_SESSION_READ_ONLY_EXISTS		0x0000002B
#define	CRYPTO_SESSION_READ_WRITE_SO_EXISTS	0x0000002C
#define	CRYPTO_SIGNATURE_INVALID		0x0000002D
#define	CRYPTO_SIGNATURE_LEN_RANGE		0x0000002E
#define	CRYPTO_TEMPLATE_INCOMPLETE		0x0000002F
#define	CRYPTO_TEMPLATE_INCONSISTENT		0x00000030
#define	CRYPTO_UNWRAPPING_KEY_HANDLE_INVALID	0x00000031
#define	CRYPTO_UNWRAPPING_KEY_SIZE_RANGE	0x00000032
#define	CRYPTO_UNWRAPPING_KEY_TYPE_INCONSISTENT	0x00000033
#define	CRYPTO_USER_ALREADY_LOGGED_IN		0x00000034
#define	CRYPTO_USER_NOT_LOGGED_IN		0x00000035
#define	CRYPTO_USER_PIN_NOT_INITIALIZED		0x00000036
#define	CRYPTO_USER_TYPE_INVALID		0x00000037
#define	CRYPTO_USER_ANOTHER_ALREADY_LOGGED_IN	0x00000038
#define	CRYPTO_USER_TOO_MANY_TYPES		0x00000039
#define	CRYPTO_WRAPPED_KEY_INVALID		0x0000003A
#define	CRYPTO_WRAPPED_KEY_LEN_RANGE		0x0000003B
#define	CRYPTO_WRAPPING_KEY_HANDLE_INVALID	0x0000003C
#define	CRYPTO_WRAPPING_KEY_SIZE_RANGE		0x0000003D
#define	CRYPTO_WRAPPING_KEY_TYPE_INCONSISTENT	0x0000003E
#define	CRYPTO_RANDOM_SEED_NOT_SUPPORTED	0x0000003F
#define	CRYPTO_RANDOM_NO_RNG			0x00000040
#define	CRYPTO_DOMAIN_PARAMS_INVALID		0x00000041
#define	CRYPTO_BUFFER_TOO_SMALL			0x00000042
#define	CRYPTO_INFORMATION_SENSITIVE		0x00000043
#define	CRYPTO_NOT_SUPPORTED			0x00000044

#define	CRYPTO_QUEUED				0x00000045
#define	CRYPTO_BUFFER_TOO_BIG			0x00000046
#define	CRYPTO_INVALID_CONTEXT			0x00000047
#define	CRYPTO_INVALID_MAC			0x00000048
#define	CRYPTO_MECH_NOT_SUPPORTED		0x00000049
#define	CRYPTO_INCONSISTENT_ATTRIBUTE		0x0000004A
#define	CRYPTO_NO_PERMISSION			0x0000004B
#define	CRYPTO_INVALID_PROVIDER_ID		0x0000004C
#define	CRYPTO_VERSION_MISMATCH			0x0000004D
#define	CRYPTO_BUSY				0x0000004E
#define	CRYPTO_UNKNOWN_PROVIDER			0x0000004F
#define	CRYPTO_MODVERIFICATION_FAILED		0x00000050
#define	CRYPTO_OLD_CTX_TEMPLATE			0x00000051
#define	CRYPTO_WEAK_KEY				0x00000052
#define	CRYPTO_FIPS140_ERROR			0x00000053
/*
 * Don't forget to update CRYPTO_LAST_ERROR and the error_number_table[]
 * in kernelUtil.c when new error code is added.
 */
#define	CRYPTO_LAST_ERROR			0x00000053

/*
 * Special values that can be used to indicate that information is unavailable
 * or that there is not practical limit. These values can be used
 * by fields of the SPI crypto_provider_ext_info(9S) structure.
 * The value of CRYPTO_UNAVAILABLE_INFO should be the same as
 * CK_UNAVAILABLE_INFO in the PKCS#11 spec.
 */
#define	CRYPTO_UNAVAILABLE_INFO		((ulong_t)(-1))
#define	CRYPTO_EFFECTIVELY_INFINITE	0x0

#ifdef __cplusplus
}
#endif

#endif /* _SYS_CRYPTO_COMMON_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef	_SYS_CRYPTO_DCA_H
#define	_SYS_CRYPTO_DCA_H

#ifdef	__cplusplus
extern "C" {
#endif

#include <sys/types.h>
#include <sys/varargs.h>

#include <sys/crypto/spi.h>

/*
 * Deimos - cryptographic acceleration based upon Broadcom 582x.
 *
 * Note: Everything in this file is private to the Deimos device
 *	 driver!  Do not include this in any other file.
 */

#define	DRIVER			"dca"
#define	DCA_MANUFACTURER_ID	"SUNWdca"

#ifdef _KERNEL

/*
 * Tunables.
 */
#define	MCR1LOWATER	16	/* these numbers favor overall throughput */
#define	MCR1HIWATER	24
#define	MCR1MAXREQS	8
#define	MCR2LOWATER	16
#define	MCR2HIWATER	24
#define	MCR2MAXREQS	4
#define	MAXMCR		2	/* there are 2 mcrs */
#define	MAXREQSPERMCR	16	/* there are 4 subunits serviced by MCR2 */
#define	MAXFRAGS	6	/* Limit on the number of fragments */
#define	MAXWORK		6	/* How many work structures to preallocate */

/*
 * These are constants.  Do not change them.
 */
#if defined(i386) || defined(__i386) || defined(__amd64)
#define	MAXPACKET	0xefff	/* rootnex INT_MAX_BUF hack. */
#else
#define	MAXPACKET	0xffff	/* Max size of a packet or fragment */
#endif
#define	DESBLOCK	8	/* Size of a DES or 3DES block */
#define	DSAPARTLEN	20	/* Size of fixed DSA parts (r, s, q, x, v) */
#define	DSASIGLEN	40	/* Size of a DSA signature */
#define	SHA1LEN		20	/* Size of a SHA1 hash */
#define	SECOND		1000000	/* One second in usec */
#define	MSEC		1000	/* One millisecond in usec */
#define	DES_KEYSIZE	8
#define	DES_IV_LEN	8
#define	DES3_KEYSIZE	(3 * DES_KEYSIZE)

/*
 * Mechanism info structure passed to KCF during registration.
 */

#define	MD5_HMAC_BLOCK_SIZE	64	/* MD5-HMAC block size */
#define	MD5_HMAC_MIN_KEY_LEN	1	/* MD5-HMAC min key length in bytes */
#define	MD5_HMAC_MAX_KEY_LEN	64	/* MD5-HMAC max key length in bytes */

#define	SHA1_HMAC_BLOCK_SIZE	64	/* SHA1-HMAC block size */
#define	SHA1_HMAC_MIN_KEY_LEN	1	/* SHA1-HMAC min key length in bytes */
#define	SHA1_HMAC_MAX_KEY_LEN	64	/* SHA1-HMAC max key length in bytes */

#define	DES_KEY_LEN		8	/* DES key length in bytes */
#define	DES3_MIN_KEY_LEN	16	/* 3DES min key length in bytes */
#define	DES3_MAX_KEY_LEN	24	/* 3DES max key length in bytes */

#define	DSA_MIN_KEY_LEN		64	/* DSA min key length in bytes */
#define	DSA_MAX_KEY_LEN		128	/* DSA max key length in bytes */

#define	RSA_MIN_KEY_LEN		32	/* RSA min key length in bytes */
#define	RSA_MAX_KEY_LEN		256	/* RSA max key length in bytes */

/*
 * RSA implementation.
 */

#define	DCA_RSA_ENC	0
#define	DCA_RSA_DEC	1
#define	DCA_RSA_SIGN	2
#define	DCA_RSA_VRFY	3
#define	DCA_RSA_SIGNR	4
#define	DCA_RSA_VRFYR	5

/*
 * DSA implementation.
 */

#define	DCA_DSA_SIGN	0
#define	DCA_DSA_VRFY	1

/*
 * FMA eclass index definitions. Note that this enum must be consistent
 * with the dca_fma_eclass_sca1000 and dca_fma_eclass_sca500 string arrays.
 */
typedef enum dca_fma_eclass {
	DCA_FM_ECLASS_HW_DEVICE = 0,
	DCA_FM_ECLASS_HW_TIMEOUT,
	DCA_FM_ECLASS_NONE
} dca_fma_eclass_t;

/*
 * Forward typedefs.
 */
typedef struct dca dca_t;
typedef struct dca_chain dca_chain_t;
typedef struct dca_listnode dca_listnode_t;
typedef struct dca_worklist dca_worklist_t;
typedef struct dca_work dca_work_t;
typedef struct dca_request dca_request_t;
typedef struct dca_stat dca_stat_t;
typedef struct dca_cookie dca_cookie_t;
typedef struct dca_device dca_device_t;

/*
 * This structure is used to identify a specific board.
 */
struct dca_device {
	ushort_t		dd_vendor_id;
	ushort_t		dd_device_id;
	char			*dd_model;
};

/*
 * Structure representing a node in a DMA chain.  (Broadcom calls
 * these "Data Buffer Chain Entries".)
 *
 * note, this structure must be a multiple of sizeof (intptr_t)
 */
struct dca_chain {
	/* the descriptor */
	caddr_t			dc_desc_kaddr;
	/* and the buffer to which it points */
	size_t			dc_buffer_length;
	ddi_dma_handle_t	dc_buffer_dmah;
	caddr_t			dc_buffer_kaddr;
	/* physical addresses */
	uint32_t		dc_desc_paddr;
	uint32_t		dc_buffer_paddr;
	uint32_t		dc_next_paddr;
};

/*
 * Linked-list linkage.
 */
struct dca_listnode {
	dca_listnode_t		*dl_next;
	dca_listnode_t		*dl_prev;
	dca_listnode_t		*dl_next2;
	dca_listnode_t		*dl_prev2;
};

typedef enum dca_mech_type {
	DES_CBC_MECH_INFO_TYPE,		/* SUN_CKM_DES_CBC */
	DES3_CBC_MECH_INFO_TYPE,	/* SUN_CKM_DES3_CBC */
	DSA_MECH_INFO_TYPE,		/* SUN_CKM_DSA */
	RSA_X_509_MECH_INFO_TYPE,	/* SUN_CKM_RSA_X_509 */
	RSA_PKCS_MECH_INFO_TYPE		/* SUN_CKM_RSA_PKCS */
} dca_mech_type_t;

#define	SUN_CKM_DSA			"CKM_DSA"

struct dca_rng {
	uint32_t		dr_chunklen;
};

union dca_parameters {
	struct dca_rng		dp_rng;
};

typedef struct dca_ctx {
	/*
	 * The following are context fields for Deimos 2.0.
	 */
	crypto_mech_type_t	ctx_cm_type;	/* Mechanism type */
	int			mode;		/* Mode of operation */
	int 			atomic;		/* Boolean */

	/* Fields for RSA and DSA */
	uchar_t			*mod;		/* RSA modulus */
	unsigned		modlen;		/* RSA modulus length */
	unsigned		pqfix;		/* RSA flag */

	/* Fields for DES and 3DES */
	uint32_t		iv[2];
	uint32_t		key[6];
	int			residlen;
	uchar_t			resid[DESBLOCK];
	int			activeresidlen;
	uchar_t			activeresid[DESBLOCK];
	crypto_data_t		in_dup;		/* input data duplicate */
} dca_ctx_t;

/*
 * Work structure.  One of these per actual job submitted to an MCR.
 * Contains everything we need to submit the job, and everything we
 * need to notify caller and release resources when the completion
 * interrupt comes.
 */
struct dca_request {
	dca_listnode_t		dr_linkage;
	uint16_t		dr_pkt_length;
	crypto_req_handle_t	dr_kcf_req;
	dca_t			*dr_dca;
	dca_worklist_t		*dr_wlp;
	/*
	 * Consumer's I/O buffers.
	 */
	crypto_data_t		*dr_in;
	crypto_data_t		*dr_out;
	dca_ctx_t		dr_ctx;
	/*
	 * Chains and DMA structures.
	 */
	size_t			dr_dma_size;
	uint32_t		dr_ctx_paddr;
	caddr_t			dr_ctx_kaddr;
	ddi_acc_handle_t	dr_ctx_acch;
	ddi_dma_handle_t	dr_ctx_dmah;
	/*
	 * Scratch input buffer.
	 */
	ddi_acc_handle_t	dr_ibuf_acch;
	ddi_dma_handle_t	dr_ibuf_dmah;
	caddr_t			dr_ibuf_kaddr;
	uint32_t		dr_ibuf_paddr;

	/*
	 * Scratch output buffer.
	 */
	ddi_acc_handle_t	dr_obuf_acch;
	ddi_dma_handle_t	dr_obuf_dmah;
	caddr_t			dr_obuf_kaddr;
	uint32_t		dr_obuf_paddr;

	/*
	 * Values to program MCR with.
	 */
	uint32_t		dr_in_paddr;
	uint32_t		dr_out_paddr;
	uint32_t		dr_in_next;
	uint32_t		dr_out_next;
	uint16_t		dr_in_len;
	uint16_t		dr_out_len;
	/*
	 * Callback.
	 */
	void			(*dr_callback)(dca_request_t *, int);
	/*
	 * Other stuff.
	 */
	uint32_t		dr_flags;
	/*
	 * Algorithm specific parameters.
	 */
	void			*dr_context;
	union dca_parameters	dr_param;
	/*
	 * Statistics.
	 */
	int			dr_job_stat;
	int			dr_byte_stat;

	/* Pre-mapped input and output data buffer chain support */
	dca_chain_t		dr_ibuf_head;
	dca_chain_t		dr_obuf_head;

	/*
	 * User buffers are mapped to DMA handles dynamically. The physically
	 * contigous blocks ( >= a page) are built into a data buffer chain.
	 */
	dca_chain_t		dr_chain_in_head;
	ddi_dma_handle_t	dr_chain_in_dmah;

	dca_chain_t		dr_chain_out_head;
	ddi_dma_handle_t	dr_chain_out_dmah;

	/* Offset in the context page for storing dynamic buffer chains */
	int			dr_offset;

	/* Destroy this request if true */
	int			destroy;
};

/*
 * Request flags (dca_request_t.dr_flags).
 */
#define	DR_INPLACE		0x002
#define	DR_SCATTER		0x004
#define	DR_GATHER		0x008
#define	DR_NOCACHE		0x020
#define	DR_ENCRYPT		0x040
#define	DR_DECRYPT		0x080
#define	DR_TRIPLE		0x100	/* triple DES vs. single DES */
#define	DR_ATOMIC		0x200	/* for atomic operation */

struct dca_work {
	dca_listnode_t		dw_linkage;
	dca_worklist_t		*dw_wlp;

	/* DMA access to the MCR and context */
	ddi_acc_handle_t	dw_mcr_acch;
	ddi_dma_handle_t	dw_mcr_dmah;
	caddr_t			dw_mcr_kaddr;
	uint32_t		dw_mcr_paddr;

	dca_request_t		*dw_reqs[MAXREQSPERMCR];
	clock_t			dw_lbolt;
};

/*
 * MCRs.
 */
#define	MCR1			0x1
#define	MCR2			0x2

struct dca_worklist {
	dca_t			*dwl_dca;
	crypto_kcf_provider_handle_t	dwl_prov;
	char			dwl_name[16];
	int			dwl_mcr;
	kmutex_t		dwl_lock;
	kmutex_t		dwl_freelock;
	kmutex_t		dwl_freereqslock;
	kcondvar_t		dwl_cv;
	dca_listnode_t		dwl_freereqs;	/* available requests */
	dca_listnode_t		dwl_waitq;	/* requests arrive here */
	dca_listnode_t		dwl_freework;	/* available work structures */
	dca_listnode_t		dwl_runq;	/* work structs sent to chip */
	timeout_id_t		dwl_schedtid;
	clock_t			dwl_lastsubmit;
	int			dwl_count;
	int			dwl_busy;
	int			dwl_lowater;
	int			dwl_hiwater;
	int			dwl_reqspermcr;
	int			dwl_drain;	/* for DR (suspend) */
	/* Kstats */
	u_longlong_t		dwl_submit;
	u_longlong_t		dwl_flowctl;
};

/*
 * Operations for MCR1 (bulk stuff).
 */
#define	CMD_IPSEC		0x0	/* IPsec packet processing */
#define	CMD_SSLMAC		0x1	/* SSL HMAC processing */
#define	CMD_TLSMAC		0x2	/* TLS HMAC processing */
#define	CMD_3DES		0x3	/* SSL/TLS/raw 3DES processing */
#define	CMD_RC4			0x4	/* ARCFOUR procesing */
#define	CMD_PUREHASH		0x5	/* Pure MD5/SHA1 hash processing */

/*
 * Operations for MCR2 (key stuff).
 */
#define	CMD_DHPUBLIC		0x1	/* DH public key generation */
#define	CMD_DHSHARED		0x2	/* DH shared secret generation */
#define	CMD_RSAPUBLIC		0x3	/* RSA public key operation */
#define	CMD_RSAPRIVATE		0x4	/* RSA private key operation (CRT) */
#define	CMD_DSASIGN		0x5	/* DSA signing operation */
#define	CMD_DSAVERIFY		0x6	/* DSA verification operation */
#define	CMD_RNGDIRECT		0x41	/* Direct access to the RNG */
#define	CMD_RNGSHA1		0x42	/* RNG output processed by SHA1 */
#define	CMD_MODADD		0x43	/* Modular add */
#define	CMD_MODSUB		0x44	/* Moduler subtract */
#define	CMD_MODMUL		0x45	/* Modular multiply */
#define	CMD_MODREM		0x46	/* Modular remainder */
#define	CMD_MODEXP		0x47	/* Modular exponentiation */
#define	CMD_MODINV		0x48	/* Modular inverse */

/*
 * Kstats.
 */
#define	DS_3DESJOBS		0
#define	DS_3DESBYTES		1
#define	DS_RSAPUBLIC		2
#define	DS_RSAPRIVATE		3
#define	DS_DSASIGN		4
#define	DS_DSAVERIFY		5
#define	DS_RNGJOBS		6
#define	DS_RNGBYTES		7
#define	DS_RNGSHA1JOBS		8
#define	DS_RNGSHA1BYTES		9
#define	DS_MAX			10

#if 0
/*
 * note that when reenabling any of these stats, DS_MAX will need to
 * be adjusted.
 */
#define	DS_RC4JOBS		11
#define	DS_RC4BYTES		12
#define	DS_DHPUBLIC		13
#define	DS_DHSECRET		14
#endif

struct dca_stat {
	kstat_named_t		ds_status;
	kstat_named_t		ds_algs[DS_MAX];
	struct {
		kstat_named_t	ds_submit;
		kstat_named_t	ds_flowctl;
		kstat_named_t	ds_lowater;
		kstat_named_t	ds_hiwater;
		kstat_named_t	ds_maxreqs;
	}			ds_mcr[MAXMCR];
};

/*
 * Blocking structure for ioctls.
 */
struct dca_cookie {
	kmutex_t		dc_mx;
	kcondvar_t		dc_cv;
	int			dc_outstanding;
	int			dc_status;
};

/*
 * Per instance structure.
 */
struct dca {
	dev_info_t		*dca_dip;
	kmutex_t		dca_intrlock;
	caddr_t			dca_regs;
	ddi_acc_handle_t	dca_regs_handle;
	ddi_iblock_cookie_t	dca_icookie;
	timeout_id_t		dca_jobtid;
	ulong_t			dca_pagesize;
	unsigned		dca_flags;	/* dev state flags */

	/*
	 * Work requests.
	 */
	dca_worklist_t		dca_worklist[MAXMCR];

	/*
	 * hardware model
	 */
	char			*dca_model;
	ushort_t		dca_devid;

	/*
	 * Kstats.  There is no standard for what standards
	 * Cryptographic Providers should supply, so we're
	 * making them up for now.
	 */
	kstat_t			*dca_ksp;
	kstat_t			*dca_intrstats;
	u_longlong_t		dca_stats[DS_MAX];

	/* For the local random number pool used internally by the dca driver */
	char 			*dca_buf1;
	char 			*dca_buf2;
	char 			*dca_buf_ptr;
	int 			dca_index;
	uint32_t 		dca_random_filling;
	kmutex_t 		dca_random_lock;

	/* FMA capabilities */
	int			fm_capabilities;	/* FMA capabilities */

	kmutex_t		dca_ctx_list_lock;
	dca_listnode_t		dca_ctx_list;
};

/*
 * Device flags (dca_t.dca_flags)
 */
#define	DCA_FAILED		0x1
#define	DCA_POWERMGMT		0x4
#define	DCA_RNGSHA1		0x8

#define	KIOIP(dca)		KSTAT_INTR_PTR((dca)->dca_intrstats)

/*
 * Scatter/gather checks.
 */
typedef enum dca_sg_param {
	DCA_SG_CONTIG = 1,
	DCA_SG_WALIGN,
	DCA_SG_PALIGN
} dca_sg_param_t;

#define	FALSE		0
#define	TRUE		1

/*
 * PCI configuration registers.
 */
#define	PCI_VENID		0x00	/* vendor id, 16 bits */
#define	PCI_DEVID		0x02	/* device id, 16 bits */
#define	PCI_COMM		0x04	/* command, 16 bits */
#define	PCI_STATUS		0x06	/* status, 16 bits */
#define	PCI_REVID		0x08	/* revision id, 8 bits */
#define	PCI_PROGCLASS		0x09	/* programming class, 8 bits */
#define	PCI_SUBCLASS		0x0A	/* subclass, 8 bits */
#define	PCI_CACHELINESZ		0x0C	/* cache line size, 8 bits */
#define	PCI_LATTMR		0x0D	/* latency timer, 8 bits */
#define	PCI_BIST		0x0F	/* builtin-self-test, 8 bits */
#define	PCI_SUBVENID		0x2C	/* subsystem vendor id, 16 bits */
#define	PCI_SUBSYSID		0x2E	/* subsystem id, 16 bits */
#define	PCI_MINGNT		0x3E	/* min grant for burst, 8 bits */
#define	PCI_MAXLAT		0x3F	/* maximum grant for burst, 8 bits */
#define	PCI_TRDYTO		0x40	/* TRDY timeout, 8 bits */
#define	PCI_RETRIES		0x41	/* retries bus will perform, 8 bits */

/*
 * PCI configuration register bit values.
 */
#define	PCICOMM_FBBE		0x0200	/* fast back-to-back enable */
#define	PCICOMM_SEE		0x0100	/* system error enable */
#define	PCICOMM_PEE		0x0040	/* parity error enable */
#define	PCICOMM_MWIE		0x0010	/* memory write & invalidate enable */
#define	PCICOMM_BME		0x0004	/* bus master enable */
#define	PCICOMM_MAE		0x0002	/* memory access enable */

#define	PCISTAT_PERR		0x8000	/* parity error detected */
#define	PCISTAT_SERR		0x4000	/* system error detected */
#define	PCISTAT_MABRT		0x2000	/* master abort detected */
#define	PCISTAT_TABRT		0x1000	/* target abort detected */
#define	PCISTAT_TABRTS		0x0800	/* target abort signaled */
#define	PCISTAT_PARITY		0x0100	/* data parity error detected */

#define	PCIREVID_DOMESTIC	0x01	/* domestic version */
#define	PCIREVID_EXPORT		0xE1	/* export version */

/* Note: 5820 errata: BIST feature does not work */
#define	PCIBIST_CAP		0x80	/* BIST capable */
#define	PCIBIST_START		0x40	/* start BIST test */
#define	PCIBIST_ERRMASK		0x0F	/* mask of BIST error codes */

/*
 * Command and Status Registers.
 */
#define	CSR_MCR1		0x00	/* pointer to MCR1 (bulk) */
#define	CSR_DMACTL		0x04	/* DMA control */
#define	CSR_DMASTAT		0x08	/* DMA status */
#define	CSR_DMAEA		0x0C	/* DMA error address */
#define	CSR_MCR2		0x10	/* pointer to MCR2 (exponentiator) */

/*
 * Command and status register bits.
 */
#define	DMACTL_RESET		0x80000000U	/* reset the chip */
#define	DMACTL_MCR2IE		0x40000000U	/* MCR2 interrupt enable */
#define	DMACTL_MCR1IE		0x20000000U	/* MCR1 interrupt enable */
#define	DMACTL_OFM		0x10000000U	/* output fragment mode */
#define	DMACTL_BE32		0x08000000U	/* 32-bit big endian mode */
#define	DMACTL_BE64		0x04000000U	/* 64-bit big endian mode */
#define	DMACTL_EIE		0x02000000U	/* error interrupt enable */
#define	DMACTL_RNGMASK		0x01800000U	/* RNG mode mask */
#define	DMACTL_RNG1		0x00000000U	/* 1 RNG bit per cycle */
#define	DMACTL_RNG4		0x00800000U	/* 1 RNG bit per 4 cycles */
#define	DMACTL_RNG8		0x01000000U	/* 1 RNG bit per 8 cycles */
#define	DMACTL_RNG16		0x01800000U	/* 1 RNG bit per 16 cycles */
#define	DMACTL_MODNORM		0x00400000U	/* s/w modulus normalization */
#define	DMACTL_RD256		0x00020000U	/* 256 byte read DMA size */
#define	DMACTL_FRAGMASK		0x0000FFFFU	/* output fragment size */

#define	DMASTAT_MAIP		0x80000000U	/* master access in progress */
#define	DMASTAT_MCR1FULL	0x40000000U	/* MCR1 is full */
#define	DMASTAT_MCR1INT		0x20000000U	/* MCR1 interrupted */
#define	DMASTAT_ERRINT		0x10000000U	/* error interrupted */
#define	DMASTAT_MCR2FULL	0x08000000U	/* MCR2 is full */
#define	DMASTAT_MCR2INT		0x04000000U	/* MCR2 interrupted */
#define	DMASTAT_INTERRUPTS	0x34000000U	/* all interrupts */

/*
 * Offsets of things relative to an MCR.
 */
#define	MCR_COUNT	0	/* 16 bits */
#define	MCR_FLAGS	2	/* 16 bits */
#define	MCR_CTXADDR	4	/* 32 bits */

/*
 * Basis for size (should be optimized by constant folding):
 *	4 bytes for flags and #packets.
 *	for each packet:
 *		2 descriptors (DESC_SIZE)
 *		4 bytes for context address
 *		4 bytes for packet length and reserved
 */
#define	MCR_SIZE	(4 + MAXREQSPERMCR * ((2 * DESC_SIZE) + 8))

/*
 * MCR flags.
 */
#define	MCRFLAG_FINISHED	0x0001		/* MCR processing complete */
#define	MCRFLAG_ERROR		0x0002		/* set if an error occured */
#define	MCRFLAG_ERRORMASK	0xff00		/* error code bits */

/*
 * Fields within a descriptor (data buffer chain).
 */
#define	DESC_BUFADDR	0	/* 32 bits */
#define	DESC_NEXT	4	/* 32 bits */
#define	DESC_LENGTH	8	/* 16 bits */
#define	DESC_RSVD	10	/* 16 bits */
#define	DESC_SIZE	16	/* ROUNDUP(12, 16) - descriptor size (bytes) */

/*
 * Offsets of fields within context structures, see Broadcom spec.
 */
#define	CTX_LENGTH		0	/* 16 bits */
#define	CTX_CMD			2	/* 16 bits */
#define	CTX_MAXLENGTH		768	/* max size of ctx, fits anything */

#define	CTX_3DESDIRECTION	4	/* 16 bits */
#define	CTX_3DESKEY1HI		8	/* 32 bits */
#define	CTX_3DESKEY1LO		12	/* 32 bits */
#define	CTX_3DESKEY2HI		16	/* 32 bits */
#define	CTX_3DESKEY2LO		20	/* 32 bits */
#define	CTX_3DESKEY3HI		24	/* 32 bits */
#define	CTX_3DESKEY3LO		28	/* 32 bits */
#define	CTX_3DESIVHI		32	/* 32 bits */
#define	CTX_3DESIVLO		36	/* 32 bits */

#define	CTX_IPSECFLAGS		4	/* 16 bits */
#define	CTX_IPSECOFFSET		6	/* 16 bits */
#define	CTX_IPSECKEY1HI		8	/* 32 bits */
#define	CTX_IPSECKEY1LO		12	/* 32 bits */
#define	CTX_IPSECKEY2HI		16	/* 32 bits */
#define	CTX_IPSECKEY2LO		20	/* 32 bits */
#define	CTX_IPSECKEY3HI		24	/* 32 bits */
#define	CTX_IPSECKEY3LO		28	/* 32 bits */
#define	CTX_IPSECIVHI		32	/* 32 bits */
#define	CTX_IPSECIVLO		36	/* 32 bits */
#define	CTX_IPSECHMACINNER1	40	/* 32 bits */
#define	CTX_IPSECHMACINNER2	44	/* 32 bits */
#define	CTX_IPSECHMACINNER3	48	/* 32 bits */
#define	CTX_IPSECHMACINNER4	52	/* 32 bits */
#define	CTX_IPSECHMACINNER5	56	/* 32 bits */
#define	CTX_IPSECHMACOUTER1	60	/* 32 bits */
#define	CTX_IPSECHMACOUTER2	64	/* 32 bits */
#define	CTX_IPSECHMACOUTER3	68	/* 32 bits */
#define	CTX_IPSECHMACOUTER4	72	/* 32 bits */
#define	CTX_IPSECHMACOUTER5	76	/* 32 bits */

#define	CTX_RSAEXPLEN		4	/* 16 bits */
#define	CTX_RSAMODLEN		6	/* 16 bits */
#define	CTX_RSABIGNUMS		8	/* variable length */
#define	CTX_RSAQLEN		4	/* 16 bits */
#define	CTX_RSAPLEN		6	/* 16 bits */

#define	CTX_DSAMSGTYPE		4	/* 16 bits */
#define	CTX_DSARSVD		6	/* 16 bits */
#define	CTX_DSARNG		8	/* 16 bits */
#define	CTX_DSAPLEN		10	/* 16 bits */
#define	CTX_DSABIGNUMS		12	/* variable length */

/*
 * Values for specific operations.
 */
#define	CTX_RNG_LENGTH		64	/* context length for RNG (64 min) */
#define	CTX_3DES_LENGTH		64	/* context length for 3DES (64 min) */
#define	CTX_3DES_DECRYPT	0x4000	/* perform decryption */
#define	CTX_3DES_ENCRYPT	0x0000	/* perform encryption */
#define	CTX_IPSEC_LENGTH	80	/* context length for IPsec */
#define	CTX_IPSEC_ENCRYPT	0x8000	/* perform encryption */
#define	CTX_IPSEC_DECRYPT	0xc000	/* perform decryption */
#define	CTX_IPSEC_HMAC_MD5	0x1000	/* HMAC-MD5 authentication */
#define	CTX_IPSEC_HMAC_SHA1	0x2000	/* HMAC-MD5 authentication */
#define	CTX_DSAMSGTYPE_SHA1	0	/* Message is SHA1 */
#define	CTX_DSAMSGTYPE_TEXT	1	/* Generate SHA1 hash first */
#define	CTX_DSARNG_GEN		1	/* Generate random k */
#define	CTX_DSARNG_SUPPLY	0	/* Random k is supplied */

/*
 * Macros to access fields within the MCR.  Note that this includes the
 * context fields as well, since the context is just offset from the
 * base of the MCR.
 */

#define	PUTMCR32(work, reg, val)	\
	ddi_put32(work->dw_mcr_acch,	\
	(uint32_t *)(work->dw_mcr_kaddr + reg), val)

#define	PUTMCR16(work, reg, val)	\
	ddi_put16(work->dw_mcr_acch,	\
	(uint16_t *)(work->dw_mcr_kaddr + reg), val)

#define	GETMCR32(work, reg)	\
	ddi_get32(work->dw_mcr_acch, (uint32_t *)(work->dw_mcr_kaddr + reg))

#define	GETMCR16(work, reg)	\
	ddi_get16(work->dw_mcr_acch, (uint16_t *)(work->dw_mcr_kaddr + reg))

#define	PUTDESC32(req, dc_desc_kaddr, reg, val)	\
	ddi_put32(req->dr_ctx_acch,	\
	(uint32_t *)(dc_desc_kaddr + reg), val)

#define	PUTDESC16(req, dc_desc_kaddr, reg, val)	\
	ddi_put16(req->dr_ctx_acch,	\
	(uint16_t *)(dc_desc_kaddr + reg), val)

/* XXX: define the GET forms for descriptors only if needed */

#define	PUTCTX32(req, reg, val)	\
	ddi_put32(req->dr_ctx_acch,	\
	(uint32_t *)(req->dr_ctx_kaddr + reg), val)

#define	PUTCTX16(req, reg, val)	\
	ddi_put16(req->dr_ctx_acch,	\
	(uint16_t *)(req->dr_ctx_kaddr + reg), val)

#define	CTXBCOPY(req, src, dst, count)	\
	ddi_rep_put8(req->dr_ctx_acch, (uchar_t *)src, (uchar_t *)dst, count, \
	DDI_DEV_AUTOINCR)

/*
 * Register access.
 */
#define	GETCSR(dca, reg)	\
	ddi_get32(dca->dca_regs_handle, (uint_t *)(dca->dca_regs + reg))

#define	PUTCSR(dca, reg, val)	\
	ddi_put32(dca->dca_regs_handle, (uint_t *)(dca->dca_regs + reg), val)

#define	SETBIT(dca, reg, val)	\
	PUTCSR(dca, reg, GETCSR(dca, reg) | val)

#define	CLRBIT(dca, reg, val)	\
	PUTCSR(dca, reg, GETCSR(dca, reg) & ~val)

/*
 * Used to guarantee alignment.
 */
#define	ROUNDUP(a, n)	(((a) + ((n) - 1)) & ~((n) - 1))
#define	ROUNDDOWN(a, n)	(((a) & ~((n) - 1)))
#define	HIDBLWORD(x)	(((x) & 0xffffffff00000000ULL) >> 32)
#define	LODBLWORD(x)	((x) & 0xffffffffULL)

/*
 * Driver hardening related.
 */
#define	CHECK_REGS(dca)	ddi_check_acc_handle(dca->dca_regs_handle)

/*
 * Other utility macros.
 */
#define	QEMPTY(q)	((q)->dl_next == (q))
#define	BITS2BYTES(b)	((b) >> 3)
#define	WORKLIST(dca, mcr)	(&((dca)->dca_worklist[mcr - 1]))

/*
 * Debug stuff.
 */
#ifdef	DEBUG
#define	DWARN		0x0001
#define	DPCI		0x0002
#define	DINTR		0x0004
#define	DSTART		0x0008
#define	DRECLAIM	0x0010
#define	DCHATTY		0x0020
#define	DMOD		0x0040	/* _init/_fini/_info/attach/detach */
#define	DENTRY		0x0080	/* crypto routine entry/exit points */

void	dca_dprintf(dca_t *, int, const char *, ...);
#define	DBG	dca_dprintf
#else
#define	DBG(dca, lvl, ...)
#endif

/*
 * Some pkcs#11 defines as there are no pkcs#11 header files included.
 */
#define	CKO_PUBLIC_KEY		0x00000002UL
#define	CKO_PRIVATE_KEY		0x00000003UL

#define	CKA_CLASS		0x00000000UL
#define	CKA_VALUE		0x00000011UL
#define	CKA_KEY_TYPE		0x00000100UL
#define	CKA_MODULUS		0x00000120UL
#define	CKA_PUBLIC_EXPONENT	0x00000122UL
#define	CKA_PRIVATE_EXPONENT	0x00000123UL
#define	CKA_PRIME_1		0x00000124UL
#define	CKA_PRIME_2		0x00000125UL
#define	CKA_EXPONENT_1		0x00000126UL
#define	CKA_EXPONENT_2		0x00000127UL
#define	CKA_COEFFICIENT		0x00000128UL
#define	CKA_PRIME		0x00000130UL
#define	CKA_SUBPRIME		0x00000131UL
#define	CKA_BASE		0x00000132UL
/*
 * Driver globals.
 */
extern int	dca_mindma;
extern int	dca_hardening;

/*
 * Prototypes.
 */

/*
 * dca_debug.c
 */
void	dca_error(dca_t *, const char *, ...);
void	dca_diperror(dev_info_t *, const char *, ...);
void	dca_dipverror(dev_info_t *, const char *, va_list);
/*
 * dca_3des.c
 */
int	dca_3desctxinit(crypto_ctx_t *, crypto_mechanism_t *, crypto_key_t *,
    int, int);
int	dca_3des(crypto_ctx_t *, crypto_data_t *, crypto_data_t *,
    crypto_req_handle_t, int);
int	dca_3desupdate(crypto_ctx_t *, crypto_data_t *, crypto_data_t *,
    crypto_req_handle_t, int);
int	dca_3desfinal(crypto_ctx_t *, crypto_data_t *, int);
int	dca_3desatomic(crypto_provider_handle_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *, crypto_data_t *,
    int, crypto_req_handle_t, int);
void	dca_3desctxfree(void *);

/*
 * dca_rsa.c
 */
int	dca_rsastart(crypto_ctx_t *, crypto_data_t *, crypto_data_t *,
    crypto_req_handle_t, int);
int	dca_rsainit(crypto_ctx_t *, crypto_mechanism_t *, crypto_key_t *, int);
void	dca_rsactxfree(void *);
int	dca_rsaatomic(crypto_provider_handle_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *, crypto_data_t *,
    int, crypto_req_handle_t, int);

/*
 * dca_dsa.c
 */
int	dca_dsa_sign(crypto_ctx_t *, crypto_data_t *, crypto_data_t *,
    crypto_req_handle_t);
int	dca_dsa_verify(crypto_ctx_t *, crypto_data_t *, crypto_data_t *,
    crypto_req_handle_t);
int	dca_dsainit(crypto_ctx_t *, crypto_mechanism_t *, crypto_key_t *, int,
    int);
void	dca_dsactxfree(void *);
int	dca_dsaatomic(crypto_provider_handle_t, crypto_session_id_t,
    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *, crypto_data_t *,
    int, crypto_req_handle_t, int);

/*
 * dca_rng.c
 */
int	dca_rng(dca_t *, uchar_t *, size_t len, crypto_req_handle_t);
int	dca_random_buffer(dca_t *dca, caddr_t buf, int len);
int	dca_random_init();
void	dca_random_fini();

/*
 * dca_kstat.c
 */
void	dca_ksinit(dca_t *);
/*
 * dca.c
 */
void	dca_rmqueue(dca_listnode_t *);
dca_request_t *dca_getreq(dca_t *, int, int);
void	dca_freereq(dca_request_t *);
int	dca_bindchains(dca_request_t *, size_t, size_t);
int	dca_unbindchains(dca_request_t *);
int	dca_start(dca_t *, dca_request_t *, int, int);
void	dca_done(dca_request_t *, int);
void	dca_destroyreq(dca_request_t *);
int	dca_length(crypto_data_t *);
int	dca_gather(crypto_data_t *, char *, int, int);
int	dca_resid_gather(crypto_data_t *, char *, int *, char *, int);
int	dca_scatter(const char *, crypto_data_t *, int, int);
int	dca_bcmp_reverse(const void *s1, const void *s2, size_t n);
int	dca_dupcrypto(crypto_data_t *, crypto_data_t *);
int	dca_verifyio(crypto_data_t *, crypto_data_t *);
int	dca_getbufbytes(crypto_data_t *, size_t, int, uchar_t *);
int	dca_sgcheck(dca_t *, crypto_data_t *, dca_sg_param_t);
crypto_object_attribute_t *
	dca_get_key_attr(crypto_key_t *);
int	dca_attr_lookup_uint32(crypto_object_attribute_t *, uint_t, uint64_t,
	    uint32_t *);
int	dca_attr_lookup_uint8_array(crypto_object_attribute_t *, uint_t,
	    uint64_t, void **, unsigned int *);
crypto_object_attribute_t *
	dca_find_attribute(crypto_object_attribute_t *, uint_t, uint64_t);
caddr_t	dca_bufdaddr(crypto_data_t *);
void	dca_rcoalesce(dca_request_t *, int);
void	dca_runcoalesce(dca_request_t *);
int	dca_bitlen(unsigned char *, int);
uint16_t dca_padhalf(int);
uint16_t dca_padfull(int);
void	dca_reverse(void *, void *, int, int);
int	dca_numcmp(caddr_t, int, caddr_t, int);
int dca_check_dma_handle(dca_t *dca, ddi_dma_handle_t handle,
	dca_fma_eclass_t eclass_index);
int dca_free_context(crypto_ctx_t *ctx);

#endif	/* _KERNEL */

#ifdef	__cplusplus
}
#endif

#endif	/* _SYS_CRYPTO_DCA_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 */
/*
 * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
 */

#ifndef _SYS_CRYPTO_ELFSIGN_H
#define	_SYS_CRYPTO_ELFSIGN_H

#ifdef __cplusplus
extern "C" {
#endif

/*
 * Consolidation Private Interface for elfsign/libpkcs11/kcfd
 */

#include <sys/types.h>
#include <sys/param.h>

/*
 * Project Private structures and types used for communication between kcfd
 * and KCF over the door.
 */

typedef enum ELFsign_status_e {
	ELFSIGN_UNKNOWN,
	ELFSIGN_SUCCESS,
	ELFSIGN_FAILED,
	ELFSIGN_NOTSIGNED,
	ELFSIGN_INVALID_CERTPATH,
	ELFSIGN_INVALID_ELFOBJ,
	ELFSIGN_UNAVAILABLE
} ELFsign_status_t;


#define	SIG_MAX_LENGTH		1024

#define	ELF_SIGNATURE_SECTION	".SUNW_signature"

typedef uint32_t	filesig_vers_t;

/*
 * File Signature Structure
 *	Applicable to ELF and other file formats
 */
struct filesignatures {
	uint32_t	filesig_cnt;	/* count of signatures */
	uint32_t	filesig_pad;	/* unused */
	union {
		char	filesig_data[1];
		struct filesig {	/* one of these for each signature */
			uint32_t	filesig_size;
			filesig_vers_t	filesig_version;
			union {
				struct filesig_version1 {
					uint32_t	filesig_v1_dnsize;
					uint32_t	filesig_v1_sigsize;
					uint32_t	filesig_v1_oidsize;
					char	filesig_v1_data[1];
				} filesig_v1;
				struct filesig_version3 {
					uint64_t	filesig_v3_time;
					uint32_t	filesig_v3_dnsize;
					uint32_t	filesig_v3_sigsize;
					uint32_t	filesig_v3_oidsize;
					char	filesig_v3_data[1];
				} filesig_v3;
			} _u2;
		} filesig_sig;
		uint64_t filesig_align;
	} _u1;
};
#define	filesig_sig		_u1.filesig_sig

#define	filesig_v1_dnsize	_u2.filesig_v1.filesig_v1_dnsize
#define	filesig_v1_sigsize	_u2.filesig_v1.filesig_v1_sigsize
#define	filesig_v1_oidsize	_u2.filesig_v1.filesig_v1_oidsize
#define	filesig_v1_data		_u2.filesig_v1.filesig_v1_data

#define	filesig_v3_time		_u2.filesig_v3.filesig_v3_time
#define	filesig_v3_dnsize	_u2.filesig_v3.filesig_v3_dnsize
#define	filesig_v3_sigsize	_u2.filesig_v3.filesig_v3_sigsize
#define	filesig_v3_oidsize	_u2.filesig_v3.filesig_v3_oidsize
#define	filesig_v3_data		_u2.filesig_v3.filesig_v3_data

#define	filesig_ALIGN(s)	(((s) + sizeof (uint64_t) - 1) & \
				    (-sizeof (uint64_t)))
#define	filesig_next(ptr)	(struct filesig *)((void *)((char *)(ptr) + \
				    filesig_ALIGN((ptr)->filesig_size)))

#define	FILESIG_UNKNOWN		0	/* unrecognized version */
#define	FILESIG_VERSION1	1	/* version1, all but sig section */
#define	FILESIG_VERSION2	2	/* version1 format, SHF_ALLOC only */
#define	FILESIG_VERSION3	3	/* version3, all but sig section */
#define	FILESIG_VERSION4	4	/* version3 format, SHF_ALLOC only */

#ifndef	_KERNEL

#endif	/* _KERNEL */

#ifdef __cplusplus
}
#endif

#endif /* _SYS_CRYPTO_ELFSIGN_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2023-2026 RackTop Systems, Inc.
 */

#ifndef	_SYS_CRYPTO_IMPL_H
#define	_SYS_CRYPTO_IMPL_H

/*
 * Kernel Cryptographic Framework private implementation definitions.
 */

#include <sys/types.h>
#include <sys/param.h>

#ifdef _KERNEL
#include <sys/crypto/common.h>
#include <sys/crypto/api.h>
#include <sys/crypto/spi.h>
#include <sys/crypto/ioctl.h>
#include <sys/atomic.h>
#include <sys/project.h>
#include <sys/taskq.h>
#include <sys/rctl.h>
#include <sys/cpuvar.h>
#endif /* _KERNEL */

#ifdef	__cplusplus
extern "C" {
#endif

#ifdef _KERNEL

/*
 * Prefixes convention: structures internal to the kernel cryptographic
 * framework start with 'kcf_'. Exposed structure start with 'crypto_'.
 */

/* Provider stats. Not protected. */
typedef	struct kcf_prov_stats {
	kstat_named_t	ps_ops_total;
	kstat_named_t	ps_ops_passed;
	kstat_named_t	ps_ops_failed;
	kstat_named_t	ps_ops_busy_rval;
} kcf_prov_stats_t;

/* Various kcf stats. Not protected. */
typedef	struct kcf_stats {
	kstat_named_t	ks_thrs_in_pool;
	kstat_named_t	ks_idle_thrs;
	kstat_named_t	ks_minthrs;
	kstat_named_t	ks_maxthrs;
	kstat_named_t	ks_swq_njobs;
	kstat_named_t	ks_swq_maxjobs;
	kstat_named_t	ks_taskq_threads;
	kstat_named_t	ks_taskq_minalloc;
	kstat_named_t	ks_taskq_maxalloc;
} kcf_stats_t;

#define	CPU_SEQID	(CPU->cpu_seqid)

typedef struct kcf_lock_withpad {
	kmutex_t	kl_lock;
	uint8_t		kl_pad[64 - sizeof (kmutex_t)];
} kcf_lock_withpad_t;

/*
 * Per-CPU structure used by a provider to keep track of
 * various counters.
 */
typedef struct kcf_prov_cpu {
	kmutex_t	kp_lock;
	int		kp_holdcnt;	/* can go negative! */
	uint_t		kp_jobcnt;

	uint64_t	kp_ndispatches;
	uint64_t	kp_nfails;
	uint64_t	kp_nbusy_rval;
	kcondvar_t	kp_cv;

	uint8_t		kp_pad[64 - sizeof (kmutex_t) - 2 * sizeof (int) -
	    3 * sizeof (uint64_t) - sizeof (kcondvar_t)];
} kcf_prov_cpu_t;

/*
 * kcf_get_refcnt(pd) is the number of inflight requests to the
 * provider. So, it is a good measure of the load on a provider when
 * it is not in a busy state. Once a provider notifies it is busy, requests
 * backup in the taskq. So, we use tq_nalloc in that case which gives
 * the number of task entries in the task queue. Note that we do not
 * acquire any locks here as it is not critical to get the exact number
 * and the lock contention is too costly for this code path.
 */
#define	KCF_PROV_LOAD(pd)	((pd)->pd_state != KCF_PROV_BUSY ?	\
	kcf_get_refcnt(pd, B_FALSE) : (pd)->pd_taskq->tq_nalloc)


/*
 * The following two macros should be
 * #define KCF_OPS_CLASSSIZE (KCF_LAST_OPSCLASS - KCF_FIRST_OPSCLASS + 2)
 * #define KCF_MAXMECHTAB KCF_MAXCIPHER
 *
 * However, doing that would involve reorganizing the header file a bit.
 * When impl.h is broken up (bug# 4703218), this will be done. For now,
 * we hardcode these values.
 */
#define	KCF_OPS_CLASSSIZE	8
#define	KCF_MAXMECHTAB		32

/*
 * Valid values for the state of a provider. The order of
 * the elements is important.
 *
 * Routines which get a provider or the list of providers
 * should pick only those that are either in KCF_PROV_READY state
 * or in KCF_PROV_BUSY state.
 */
typedef enum {
	KCF_PROV_ALLOCATED = 1,
	KCF_PROV_UNVERIFIED,
	KCF_PROV_UNVERIFIED_FIPS140,
	KCF_PROV_VERIFICATION_FAILED,
	/*
	 * state < KCF_PROV_READY means the provider can not
	 * be used at all.
	 */
	KCF_PROV_READY,
	KCF_PROV_BUSY,
	/*
	 * state > KCF_PROV_BUSY means the provider can not
	 * be used for new requests.
	 */
	KCF_PROV_FAILED,
	/*
	 * Threads setting the following two states should do so only
	 * if the current state < KCF_PROV_DISABLED.
	 */
	KCF_PROV_DISABLED,
	KCF_PROV_UNREGISTERING,
	KCF_PROV_UNREGISTERED
} kcf_prov_state_t;

#define	KCF_IS_PROV_UNVERIFIED(pd) ((pd)->pd_state == KCF_PROV_UNVERIFIED)
#define	KCF_IS_PROV_USABLE(pd) ((pd)->pd_state == KCF_PROV_READY || \
	(pd)->pd_state == KCF_PROV_BUSY)
#define	KCF_IS_PROV_REMOVED(pd)	((pd)->pd_state >= KCF_PROV_UNREGISTERING)

/* Internal flags valid for pd_flags field */
#define	KCF_LPROV_MEMBER	0x80000000 /* is member of a logical provider */

/*
 * A provider descriptor structure. There is one such structure per
 * provider. It is allocated and initialized at registration time and
 * freed when the provider unregisters.
 *
 * pd_prov_type:	Provider type, hardware or software
 * pd_sid:		Session ID of the provider used by kernel clients.
 *			This is valid only for session-oriented providers.
 * pd_taskq:		taskq used to dispatch crypto requests
 * pd_nbins:		number of bins in pd_percpu_bins
 * pd_percpu_bins:	Pointer to an array of per-CPU structures
 *			containing a lock, a cv and various counters.
 * pd_lock:		lock protects pd_state and pd_provider_list
 * pd_state:		State value of the provider
 * pd_provider_list:	Used to cross-reference logical providers and their
 *			members. Not used for software providers.
 * pd_resume_cv:	cv to wait for state to change from KCF_PROV_BUSY
 * pd_prov_handle:	Provider handle specified by provider
 * pd_ops_vector:	The ops vector specified by Provider
 * pd_mech_indx:	Lookup table which maps a core framework mechanism
 *			number to an index in pd_mechanisms array
 * pd_mechanisms:	Array of mechanisms supported by the provider, specified
 *			by the provider during registration
 * pd_mech_list_count:	The number of entries in pi_mechanisms, specified
 *			by the provider during registration
 * pd_name:		Device name or module name
 * pd_instance:		Device instance
 * pd_module_id:	Module ID returned by modload
 * pd_mctlp:		Pointer to modctl structure for this provider
 * pd_description:	Provider description string
 * pd_flags:		bitwise OR of pi_flags from crypto_provider_info_t
 *			and other internal flags defined above.
 * pd_hash_limit:	Maximum data size that hash mechanisms of this provider
 *			can support.
 * pd_hmac_limit:	Maximum data size that HMAC mechanisms of this provider
 *			can support.
 * pd_kcf_prov_handle:	KCF-private handle assigned by KCF
 * pd_prov_id:		Identification # assigned by KCF to provider
 * pd_kstat:		kstat associated with the provider
 * pd_ks_data:		kstat data
 */
typedef struct kcf_provider_desc {
	crypto_provider_type_t		pd_prov_type;
	crypto_session_id_t		pd_sid;
	taskq_t				*pd_taskq;
	uint_t				pd_nbins;
	kcf_prov_cpu_t			*pd_percpu_bins;
	kmutex_t			pd_lock;
	kcf_prov_state_t		pd_state;
	struct kcf_provider_list	*pd_provider_list;
	kcondvar_t			pd_resume_cv;
	crypto_provider_handle_t	pd_prov_handle;
	crypto_ops_t			*pd_ops_vector;
	ushort_t			pd_mech_indx[KCF_OPS_CLASSSIZE]\
					    [KCF_MAXMECHTAB];
	crypto_mech_info_t		*pd_mechanisms;
	uint_t				pd_mech_list_count;
	char				*pd_name;
	uint_t				pd_instance;
	int				pd_module_id;
	struct modctl			*pd_mctlp;
	char				*pd_description;
	uint_t				pd_flags;
	uint_t				pd_hash_limit;
	uint_t				pd_hmac_limit;
	crypto_kcf_provider_handle_t	pd_kcf_prov_handle;
	crypto_provider_id_t		pd_prov_id;
	kstat_t				*pd_kstat;
	kcf_prov_stats_t		pd_ks_data;
} kcf_provider_desc_t;

/* useful for making a list of providers */
typedef struct kcf_provider_list {
	struct kcf_provider_list *pl_next;
	struct kcf_provider_desc *pl_provider;
} kcf_provider_list_t;

/*
 * If a component has a reference to a kcf_provider_desc_t,
 * it REFHOLD()s. A new provider descriptor which is referenced only
 * by the providers table has a reference counter of one.
 */
#define	KCF_PROV_REFHOLD(desc) {			\
	kcf_prov_cpu_t	*mp;				\
							\
	mp = &((desc)->pd_percpu_bins[CPU_SEQID]);	\
	mutex_enter(&mp->kp_lock);			\
	mp->kp_holdcnt++;				\
	mutex_exit(&mp->kp_lock);			\
}

#define	KCF_PROV_REFRELE(desc) {			\
	kcf_prov_cpu_t	*mp;				\
							\
	mp = &((desc)->pd_percpu_bins[CPU_SEQID]);	\
	mutex_enter(&mp->kp_lock);			\
	mp->kp_holdcnt--;				\
	mutex_exit(&mp->kp_lock);			\
}

#define	KCF_PROV_REFHELD(desc)	(kcf_get_refcnt(desc, B_TRUE) >= 1)

/*
 * The JOB macros are used only for a hardware provider.
 * Hardware providers can have holds that stay forever.
 * So, the job counter is used to check if it is safe to
 * unregister a provider.
 */
#define	KCF_PROV_JOB_HOLD(mp) {			\
	mutex_enter(&(mp)->kp_lock);		\
	(mp)->kp_jobcnt++;			\
	mutex_exit(&(mp)->kp_lock);		\
}

#define	KCF_PROV_JOB_RELE(mp) {			\
	mutex_enter(&(mp)->kp_lock);		\
	(mp)->kp_jobcnt--;			\
	if ((mp)->kp_jobcnt == 0)		\
		cv_signal(&(mp)->kp_cv);	\
	mutex_exit(&(mp)->kp_lock);		\
}

#define	KCF_PROV_JOB_RELE_STAT(mp, doincr) {	\
	if (doincr)				\
		(mp)->kp_nfails++;		\
	KCF_PROV_JOB_RELE(mp);			\
}

#define	KCF_PROV_INCRSTATS(pd, error)	{				\
	kcf_prov_cpu_t	*mp;						\
									\
	mp = &((pd)->pd_percpu_bins[CPU_SEQID]);			\
	mp->kp_ndispatches++;						\
	if ((error) == CRYPTO_BUSY)					\
		mp->kp_nbusy_rval++;					\
	else if ((error) != CRYPTO_SUCCESS && (error) != CRYPTO_QUEUED)	\
		mp->kp_nfails++;					\
}

/* list of crypto_mech_info_t valid as the second mech in a dual operation */

typedef	struct crypto_mech_info_list {
	struct crypto_mech_info_list	*ml_next;
	crypto_mech_type_t		ml_kcf_mechid;	/* KCF's id */
	crypto_mech_info_t		ml_mech_info;
} crypto_mech_info_list_t;

/*
 * An element in a mechanism provider descriptors chain.
 * The kcf_prov_mech_desc_t is duplicated in every chain the provider belongs
 * to. This is a small tradeoff memory vs mutex spinning time to access the
 * common provider field.
 */

typedef struct kcf_prov_mech_desc {
	struct kcf_mech_entry		*pm_me;		/* Back to the head */
	struct kcf_prov_mech_desc	*pm_next;	/* Next in the chain */
	crypto_mech_info_t		pm_mech_info;	/* Provider mech info */
	crypto_mech_info_list_t		*pm_mi_list;	/* list for duals */
	kcf_provider_desc_t		*pm_prov_desc;	/* Common desc. */
} kcf_prov_mech_desc_t;

/* and the notation shortcuts ... */
#define	pm_provider_type	pm_prov_desc.pd_provider_type
#define	pm_provider_handle	pm_prov_desc.pd_provider_handle
#define	pm_ops_vector		pm_prov_desc.pd_ops_vector

extern kcf_lock_withpad_t *me_mutexes;

typedef int (*kcf_copyin_param_func_t) (caddr_t, size_t, crypto_mechanism_t *,
    int, int);

#define	KCF_CPU_PAD (128 - sizeof (crypto_mech_name_t) - \
    sizeof (crypto_mech_type_t) - \
    2 * sizeof (kcf_prov_mech_desc_t *) - \
    sizeof (int) - sizeof (uint32_t) - sizeof (size_t) - \
    sizeof (kcf_copyin_param_func_t))

CTASSERT(KCF_CPU_PAD > 0);

/*
 * A mechanism entry in an xxx_mech_tab[]. KCF_CPU_PAD needs
 * to be adjusted if this structure is changed.
 */
typedef	struct kcf_mech_entry {
	crypto_mech_name_t	me_name;	/* mechanism name */
	crypto_mech_type_t	me_mechid;	/* Internal id for mechanism */
	kcf_prov_mech_desc_t	*me_hw_prov_chain;  /* list of HW providers */
	kcf_prov_mech_desc_t	*me_sw_prov;    /* SW provider */
	/*
	 * Number of HW providers in the chain. There is only one
	 * SW provider. So, we need only a count of HW providers.
	 */
	int			me_num_hwprov;
	/*
	 * When a SW provider is present, this is the generation number that
	 * ensures no objects from old SW providers are used in the new one
	 */
	uint32_t		me_gen_swprov;
	/*
	 *  threshold for using hardware providers for this mech
	 */
	size_t			me_threshold;
	kcf_copyin_param_func_t	me_copyin_param;
	uint8_t			me_pad[KCF_CPU_PAD];
} kcf_mech_entry_t;

/*
 * A policy descriptor structure. It is allocated and initialized
 * when administrative ioctls load disabled mechanisms.
 *
 * pd_prov_type:	Provider type, hardware or software
 * pd_name:		Device name or module name.
 * pd_instance:		Device instance.
 * pd_refcnt:		Reference counter for this policy descriptor
 * pd_mutex:		Protects array and count of disabled mechanisms.
 * pd_disabled_count:	Count of disabled mechanisms.
 * pd_disabled_mechs:	Array of disabled mechanisms.
 */
typedef struct kcf_policy_desc {
	crypto_provider_type_t	pd_prov_type;
	char			*pd_name;
	uint_t			pd_instance;
	uint_t			pd_refcnt;
	kmutex_t		pd_mutex;
	uint_t			pd_disabled_count;
	crypto_mech_name_t	*pd_disabled_mechs;
} kcf_policy_desc_t;

/*
 * If a component has a reference to a kcf_policy_desc_t,
 * it REFHOLD()s. A new policy descriptor which is referenced only
 * by the policy table has a reference count of one.
 */
#define	KCF_POLICY_REFHOLD(desc) {		\
	atomic_inc_32(&(desc)->pd_refcnt);	\
	ASSERT((desc)->pd_refcnt != 0);		\
}

/*
 * Releases a reference to a policy descriptor. When the last
 * reference is released, the descriptor is freed.
 */
#define	KCF_POLICY_REFRELE(desc) {				\
	ASSERT((desc)->pd_refcnt != 0);				\
	membar_exit();						\
	if (atomic_dec_32_nv(&(desc)->pd_refcnt) == 0)	\
		kcf_policy_free_desc(desc);			\
}

/*
 * This entry stores the name of a software module and its
 * mechanisms.  The mechanisms are 'hints' that are used to
 * trigger loading of the module.
 */
typedef struct kcf_soft_conf_entry {
	struct kcf_soft_conf_entry	*ce_next;
	char				*ce_name;
	crypto_mech_name_t		*ce_mechs;
	uint_t				ce_count;
} kcf_soft_conf_entry_t;

extern kmutex_t soft_config_mutex;
extern kcf_soft_conf_entry_t *soft_config_list;

/*
 * Global tables. The sizes are from the predefined PKCS#11 v2.20 mechanisms,
 * with a margin of few extra empty entry points
 */

#define	KCF_MAXDIGEST		16	/* Digests */
#define	KCF_MAXCIPHER		64	/* Ciphers */
#define	KCF_MAXMAC		40	/* Message authentication codes */
#define	KCF_MAXSIGN		24	/* Sign/Verify */
#define	KCF_MAXKEYOPS		116	/* Key generation and derivation */
#define	KCF_MAXMISC		16	/* Others ... */

#define	KCF_MAXMECHS		KCF_MAXDIGEST + KCF_MAXCIPHER + KCF_MAXMAC + \
				KCF_MAXSIGN + KCF_MAXKEYOPS + \
				KCF_MAXMISC

extern kcf_mech_entry_t kcf_digest_mechs_tab[];
extern kcf_mech_entry_t kcf_cipher_mechs_tab[];
extern kcf_mech_entry_t kcf_mac_mechs_tab[];
extern kcf_mech_entry_t kcf_sign_mechs_tab[];
extern kcf_mech_entry_t kcf_keyops_mechs_tab[];
extern kcf_mech_entry_t kcf_misc_mechs_tab[];

extern kmutex_t kcf_mech_tabs_lock;

typedef	enum {
	KCF_DIGEST_CLASS = 1,
	KCF_CIPHER_CLASS,
	KCF_MAC_CLASS,
	KCF_SIGN_CLASS,
	KCF_KEYOPS_CLASS,
	KCF_MISC_CLASS
} kcf_ops_class_t;

#define	KCF_FIRST_OPSCLASS	KCF_DIGEST_CLASS
#define	KCF_LAST_OPSCLASS	KCF_MISC_CLASS

/* The table of all the kcf_xxx_mech_tab[]s, indexed by kcf_ops_class */

typedef	struct kcf_mech_entry_tab {
	int			met_size;	/* Size of the met_tab[] */
	kcf_mech_entry_t	*met_tab;	/* the table		 */
} kcf_mech_entry_tab_t;

extern kcf_mech_entry_tab_t kcf_mech_tabs_tab[];

#define	KCF_MECHID(class, index)				\
	(((crypto_mech_type_t)(class) << 32) | (crypto_mech_type_t)(index))

#define	KCF_MECH2CLASS(mech_type) ((kcf_ops_class_t)((mech_type) >> 32))

#define	KCF_MECH2INDEX(mech_type) ((int)(mech_type))

#define	KCF_TO_PROV_MECH_INDX(pd, mech_type)			\
	((pd)->pd_mech_indx[KCF_MECH2CLASS(mech_type)]		\
	[KCF_MECH2INDEX(mech_type)])

#define	KCF_TO_PROV_MECHINFO(pd, mech_type)			\
	((pd)->pd_mechanisms[KCF_TO_PROV_MECH_INDX(pd, mech_type)])

#define	KCF_TO_PROV_MECHNUM(pd, mech_type)			\
	(KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_number)

#define	KCF_CAN_SHARE_OPSTATE(pd, mech_type)			\
	((KCF_TO_PROV_MECHINFO(pd, mech_type).cm_mech_flags) &	\
	CRYPTO_CAN_SHARE_OPSTATE)

/* ps_refcnt is protected by cm_lock in the crypto_minor structure */
typedef struct crypto_provider_session {
	struct crypto_provider_session *ps_next;
	crypto_session_id_t		ps_session;
	kcf_provider_desc_t		*ps_provider;
	kcf_provider_desc_t		*ps_real_provider;
	uint_t				ps_refcnt;
} crypto_provider_session_t;

typedef struct crypto_session_data {
	kmutex_t			sd_lock;
	kcondvar_t			sd_cv;
	uint32_t			sd_flags;
	int				sd_pre_approved_amount;
	crypto_ctx_t			*sd_digest_ctx;
	crypto_ctx_t			*sd_encr_ctx;
	crypto_ctx_t			*sd_decr_ctx;
	crypto_ctx_t			*sd_mac_ctx;
	crypto_ctx_t			*sd_sign_ctx;
	crypto_ctx_t			*sd_verify_ctx;
	crypto_ctx_t			*sd_sign_recover_ctx;
	crypto_ctx_t			*sd_verify_recover_ctx;
	kcf_provider_desc_t		*sd_provider;
	void				*sd_find_init_cookie;
	crypto_provider_session_t	*sd_provider_session;
} crypto_session_data_t;

#define	CRYPTO_SESSION_IN_USE		0x00000001
#define	CRYPTO_SESSION_IS_BUSY		0x00000002
#define	CRYPTO_SESSION_IS_CLOSED	0x00000004

#define	KCF_MAX_PIN_LEN			1024

/*
 * Per-minor info.
 *
 * cm_lock protects everything in this structure except for cm_refcnt.
 */
typedef struct crypto_minor {
	uint_t				cm_refcnt;
	kmutex_t			cm_lock;
	kcondvar_t			cm_cv;
	crypto_session_data_t		**cm_session_table;
	uint_t				cm_session_table_count;
	kcf_provider_desc_t		**cm_provider_array;
	uint_t				cm_provider_count;
	crypto_provider_session_t	*cm_provider_session;
} crypto_minor_t;

/* resource control framework handle used by /dev/crypto */
extern rctl_hndl_t rc_project_crypto_mem;
/*
 * Return codes for internal functions
 */
#define	KCF_SUCCESS		0x0	/* Successful call */
#define	KCF_INVALID_MECH_NUMBER	0x1	/* invalid mechanism number */
#define	KCF_INVALID_MECH_NAME	0x2	/* invalid mechanism name */
#define	KCF_INVALID_MECH_CLASS	0x3	/* invalid mechanism class */
#define	KCF_MECH_TAB_FULL	0x4	/* Need more room in the mech tabs. */
#define	KCF_INVALID_INDX	((ushort_t)-1)

/*
 * kCF internal mechanism and function group for tracking RNG providers.
 */
#define	SUN_RANDOM		"random"
#define	CRYPTO_FG_RANDOM	0x80000000	/* generate_random() */

/*
 * Wrappers for ops vectors. In the wrapper definitions below, the pd
 * argument always corresponds to a pointer to a provider descriptor
 * of type kcf_prov_desc_t.
 */

#define	KCF_PROV_CONTROL_OPS(pd)	((pd)->pd_ops_vector->co_control_ops)
#define	KCF_PROV_CTX_OPS(pd)		((pd)->pd_ops_vector->co_ctx_ops)
#define	KCF_PROV_DIGEST_OPS(pd)		((pd)->pd_ops_vector->co_digest_ops)
#define	KCF_PROV_CIPHER_OPS(pd)		((pd)->pd_ops_vector->co_cipher_ops)
#define	KCF_PROV_MAC_OPS(pd)		((pd)->pd_ops_vector->co_mac_ops)
#define	KCF_PROV_SIGN_OPS(pd)		((pd)->pd_ops_vector->co_sign_ops)
#define	KCF_PROV_VERIFY_OPS(pd)		((pd)->pd_ops_vector->co_verify_ops)
#define	KCF_PROV_DUAL_OPS(pd)		((pd)->pd_ops_vector->co_dual_ops)
#define	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) \
	((pd)->pd_ops_vector->co_dual_cipher_mac_ops)
#define	KCF_PROV_RANDOM_OPS(pd)		((pd)->pd_ops_vector->co_random_ops)
#define	KCF_PROV_SESSION_OPS(pd)	((pd)->pd_ops_vector->co_session_ops)
#define	KCF_PROV_OBJECT_OPS(pd)		((pd)->pd_ops_vector->co_object_ops)
#define	KCF_PROV_KEY_OPS(pd)		((pd)->pd_ops_vector->co_key_ops)
#define	KCF_PROV_PROVIDER_OPS(pd)	((pd)->pd_ops_vector->co_provider_ops)
#define	KCF_PROV_MECH_OPS(pd)		((pd)->pd_ops_vector->co_mech_ops)
#define	KCF_PROV_NOSTORE_KEY_OPS(pd)	\
	((pd)->pd_ops_vector->co_nostore_key_ops)
#define	KCF_PROV_FIPS140_OPS(pd)	((pd)->pd_ops_vector->co_fips140_ops)
#define	KCF_PROV_PROVMGMT_OPS(pd)	((pd)->pd_ops_vector->co_provider_ops)

/*
 * Wrappers for crypto_control_ops(9S) entry points.
 */

#define	KCF_PROV_STATUS(pd, status) ( \
	(KCF_PROV_CONTROL_OPS(pd) && \
	KCF_PROV_CONTROL_OPS(pd)->provider_status) ? \
	KCF_PROV_CONTROL_OPS(pd)->provider_status( \
	    (pd)->pd_prov_handle, status) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_ctx_ops(9S) entry points.
 */

#define	KCF_PROV_CREATE_CTX_TEMPLATE(pd, mech, key, template, size, req) ( \
	(KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->create_ctx_template) ? \
	KCF_PROV_CTX_OPS(pd)->create_ctx_template( \
	    (pd)->pd_prov_handle, mech, key, template, size, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_FREE_CONTEXT(pd, ctx) ( \
	(KCF_PROV_CTX_OPS(pd) && KCF_PROV_CTX_OPS(pd)->free_context) ? \
	KCF_PROV_CTX_OPS(pd)->free_context(ctx) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_COPYIN_MECH(pd, umech, kmech, errorp, mode) ( \
	(KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyin_mechanism) ? \
	KCF_PROV_MECH_OPS(pd)->copyin_mechanism( \
	    (pd)->pd_prov_handle, umech, kmech, errorp, mode) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_COPYOUT_MECH(pd, kmech, umech, errorp, mode) ( \
	(KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->copyout_mechanism) ? \
	KCF_PROV_MECH_OPS(pd)->copyout_mechanism( \
	    (pd)->pd_prov_handle, kmech, umech, errorp, mode) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_FREE_MECH(pd, prov_mech) ( \
	(KCF_PROV_MECH_OPS(pd) && KCF_PROV_MECH_OPS(pd)->free_mechanism) ? \
	KCF_PROV_MECH_OPS(pd)->free_mechanism( \
	    (pd)->pd_prov_handle, prov_mech) : CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_digest_ops(9S) entry points.
 */

#define	KCF_PROV_DIGEST_INIT(pd, ctx, mech, req) ( \
	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_init) ? \
	KCF_PROV_DIGEST_OPS(pd)->digest_init(ctx, mech, req) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * The _ (underscore) in _digest is needed to avoid replacing the
 * function digest().
 */
#define	KCF_PROV_DIGEST(pd, ctx, data, _digest, req) ( \
	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest) ? \
	KCF_PROV_DIGEST_OPS(pd)->digest(ctx, data, _digest, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DIGEST_UPDATE(pd, ctx, data, req) ( \
	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_update) ? \
	KCF_PROV_DIGEST_OPS(pd)->digest_update(ctx, data, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DIGEST_KEY(pd, ctx, key, req) ( \
	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_key) ? \
	KCF_PROV_DIGEST_OPS(pd)->digest_key(ctx, key, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DIGEST_FINAL(pd, ctx, digest, req) ( \
	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_final) ? \
	KCF_PROV_DIGEST_OPS(pd)->digest_final(ctx, digest, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DIGEST_ATOMIC(pd, session, mech, data, digest, req) ( \
	(KCF_PROV_DIGEST_OPS(pd) && KCF_PROV_DIGEST_OPS(pd)->digest_atomic) ? \
	KCF_PROV_DIGEST_OPS(pd)->digest_atomic( \
	    (pd)->pd_prov_handle, session, mech, data, digest, req) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_cipher_ops(9S) entry points.
 */

#define	KCF_PROV_ENCRYPT_INIT(pd, ctx, mech, key, template, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_init) ? \
	KCF_PROV_CIPHER_OPS(pd)->encrypt_init(ctx, mech, key, template, \
	    req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_ENCRYPT(pd, ctx, plaintext, ciphertext, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt) ? \
	KCF_PROV_CIPHER_OPS(pd)->encrypt(ctx, plaintext, ciphertext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_ENCRYPT_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_update) ? \
	KCF_PROV_CIPHER_OPS(pd)->encrypt_update(ctx, plaintext, \
	    ciphertext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_ENCRYPT_FINAL(pd, ctx, ciphertext, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_final) ? \
	KCF_PROV_CIPHER_OPS(pd)->encrypt_final(ctx, ciphertext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_ENCRYPT_ATOMIC(pd, session, mech, key, plaintext, ciphertext, \
	    template, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic) ? \
	KCF_PROV_CIPHER_OPS(pd)->encrypt_atomic( \
	    (pd)->pd_prov_handle, session, mech, key, plaintext, ciphertext, \
	    template, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DECRYPT_INIT(pd, ctx, mech, key, template, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_init) ? \
	KCF_PROV_CIPHER_OPS(pd)->decrypt_init(ctx, mech, key, template, \
	    req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DECRYPT(pd, ctx, ciphertext, plaintext, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt) ? \
	KCF_PROV_CIPHER_OPS(pd)->decrypt(ctx, ciphertext, plaintext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_update) ? \
	KCF_PROV_CIPHER_OPS(pd)->decrypt_update(ctx, ciphertext, \
	    plaintext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DECRYPT_FINAL(pd, ctx, plaintext, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_final) ? \
	KCF_PROV_CIPHER_OPS(pd)->decrypt_final(ctx, plaintext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DECRYPT_ATOMIC(pd, session, mech, key, ciphertext, plaintext, \
	    template, req) ( \
	(KCF_PROV_CIPHER_OPS(pd) && KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic) ? \
	KCF_PROV_CIPHER_OPS(pd)->decrypt_atomic( \
	    (pd)->pd_prov_handle, session, mech, key, ciphertext, plaintext, \
	    template, req) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_mac_ops(9S) entry points.
 */

#define	KCF_PROV_MAC_INIT(pd, ctx, mech, key, template, req) ( \
	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_init) ? \
	KCF_PROV_MAC_OPS(pd)->mac_init(ctx, mech, key, template, req) \
	: CRYPTO_NOT_SUPPORTED)

/*
 * The _ (underscore) in _mac is needed to avoid replacing the
 * function mac().
 */
#define	KCF_PROV_MAC(pd, ctx, data, _mac, req) ( \
	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac) ? \
	KCF_PROV_MAC_OPS(pd)->mac(ctx, data, _mac, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_UPDATE(pd, ctx, data, req) ( \
	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_update) ? \
	KCF_PROV_MAC_OPS(pd)->mac_update(ctx, data, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_FINAL(pd, ctx, mac, req) ( \
	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_final) ? \
	KCF_PROV_MAC_OPS(pd)->mac_final(ctx, mac, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_ATOMIC(pd, session, mech, key, data, mac, template, \
	    req) ( \
	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_atomic) ? \
	KCF_PROV_MAC_OPS(pd)->mac_atomic( \
	    (pd)->pd_prov_handle, session, mech, key, data, mac, template, \
	    req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_VERIFY_ATOMIC(pd, session, mech, key, data, mac, \
	    template, req) ( \
	(KCF_PROV_MAC_OPS(pd) && KCF_PROV_MAC_OPS(pd)->mac_verify_atomic) ? \
	KCF_PROV_MAC_OPS(pd)->mac_verify_atomic( \
	    (pd)->pd_prov_handle, session, mech, key, data, mac, template, \
	    req) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_sign_ops(9S) entry points.
 */

#define	KCF_PROV_SIGN_INIT(pd, ctx, mech, key, template, req) ( \
	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_init) ? \
	KCF_PROV_SIGN_OPS(pd)->sign_init( \
	    ctx, mech, key, template, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SIGN(pd, ctx, data, sig, req) ( \
	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign) ? \
	KCF_PROV_SIGN_OPS(pd)->sign(ctx, data, sig, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SIGN_UPDATE(pd, ctx, data, req) ( \
	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_update) ? \
	KCF_PROV_SIGN_OPS(pd)->sign_update(ctx, data, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SIGN_FINAL(pd, ctx, sig, req) ( \
	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_final) ? \
	KCF_PROV_SIGN_OPS(pd)->sign_final(ctx, sig, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SIGN_ATOMIC(pd, session, mech, key, data, template, \
	    sig, req) ( \
	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_atomic) ? \
	KCF_PROV_SIGN_OPS(pd)->sign_atomic( \
	    (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
	    req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SIGN_RECOVER_INIT(pd, ctx, mech, key, template, \
	    req) ( \
	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover_init) ? \
	KCF_PROV_SIGN_OPS(pd)->sign_recover_init(ctx, mech, key, template, \
	    req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SIGN_RECOVER(pd, ctx, data, sig, req) ( \
	(KCF_PROV_SIGN_OPS(pd) && KCF_PROV_SIGN_OPS(pd)->sign_recover) ? \
	KCF_PROV_SIGN_OPS(pd)->sign_recover(ctx, data, sig, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SIGN_RECOVER_ATOMIC(pd, session, mech, key, data, template, \
	    sig, req) ( \
	(KCF_PROV_SIGN_OPS(pd) && \
	KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic) ? \
	KCF_PROV_SIGN_OPS(pd)->sign_recover_atomic( \
	    (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
	    req) : CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_verify_ops(9S) entry points.
 */

#define	KCF_PROV_VERIFY_INIT(pd, ctx, mech, key, template, req) ( \
	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_init) ? \
	KCF_PROV_VERIFY_OPS(pd)->verify_init(ctx, mech, key, template, \
	    req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_VERIFY(pd, ctx, data, sig, req) ( \
	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify) ? \
	KCF_PROV_VERIFY_OPS(pd)->verify(ctx, data, sig, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_VERIFY_UPDATE(pd, ctx, data, req) ( \
	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_update) ? \
	KCF_PROV_VERIFY_OPS(pd)->verify_update(ctx, data, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_VERIFY_FINAL(pd, ctx, sig, req) ( \
	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_final) ? \
	KCF_PROV_VERIFY_OPS(pd)->verify_final(ctx, sig, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_VERIFY_ATOMIC(pd, session, mech, key, data, template, sig, \
	    req) ( \
	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_atomic) ? \
	KCF_PROV_VERIFY_OPS(pd)->verify_atomic( \
	    (pd)->pd_prov_handle, session, mech, key, data, sig, template, \
	    req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_VERIFY_RECOVER_INIT(pd, ctx, mech, key, template, \
	    req) ( \
	(KCF_PROV_VERIFY_OPS(pd) && \
	KCF_PROV_VERIFY_OPS(pd)->verify_recover_init) ? \
	KCF_PROV_VERIFY_OPS(pd)->verify_recover_init(ctx, mech, key, \
	    template, req) : CRYPTO_NOT_SUPPORTED)

/* verify_recover() CSPI routine has different argument order than verify() */
#define	KCF_PROV_VERIFY_RECOVER(pd, ctx, sig, data, req) ( \
	(KCF_PROV_VERIFY_OPS(pd) && KCF_PROV_VERIFY_OPS(pd)->verify_recover) ? \
	KCF_PROV_VERIFY_OPS(pd)->verify_recover(ctx, sig, data, req) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * verify_recover_atomic() CSPI routine has different argument order
 * than verify_atomic().
 */
#define	KCF_PROV_VERIFY_RECOVER_ATOMIC(pd, session, mech, key, sig, \
	    template, data,  req) ( \
	(KCF_PROV_VERIFY_OPS(pd) && \
	KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic) ? \
	KCF_PROV_VERIFY_OPS(pd)->verify_recover_atomic( \
	    (pd)->pd_prov_handle, session, mech, key, sig, data, template, \
	    req) : CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_dual_ops(9S) entry points.
 */

#define	KCF_PROV_DIGEST_ENCRYPT_UPDATE(digest_ctx, encrypt_ctx, plaintext, \
	    ciphertext, req) ( \
	(KCF_PROV_DUAL_OPS(pd) && \
	KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update) ? \
	KCF_PROV_DUAL_OPS(pd)->digest_encrypt_update( \
	    digest_ctx, encrypt_ctx, plaintext, ciphertext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DECRYPT_DIGEST_UPDATE(decrypt_ctx, digest_ctx, ciphertext, \
	    plaintext, req) ( \
	(KCF_PROV_DUAL_OPS(pd) && \
	KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update) ? \
	KCF_PROV_DUAL_OPS(pd)->decrypt_digest_update( \
	    decrypt_ctx, digest_ctx, ciphertext, plaintext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SIGN_ENCRYPT_UPDATE(sign_ctx, encrypt_ctx, plaintext, \
	    ciphertext, req) ( \
	(KCF_PROV_DUAL_OPS(pd) && \
	KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update) ? \
	KCF_PROV_DUAL_OPS(pd)->sign_encrypt_update( \
	    sign_ctx, encrypt_ctx, plaintext, ciphertext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_DECRYPT_VERIFY_UPDATE(decrypt_ctx, verify_ctx, ciphertext, \
	    plaintext, req) ( \
	(KCF_PROV_DUAL_OPS(pd) && \
	KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update) ? \
	KCF_PROV_DUAL_OPS(pd)->decrypt_verify_update( \
	    decrypt_ctx, verify_ctx, ciphertext, plaintext, req) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_dual_cipher_mac_ops(9S) entry points.
 */

#define	KCF_PROV_ENCRYPT_MAC_INIT(pd, ctx, encr_mech, encr_key, mac_mech, \
	    mac_key, encr_ctx_template, mac_ctx_template, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_init( \
	    ctx, encr_mech, encr_key, mac_mech, mac_key, encr_ctx_template, \
	    mac_ctx_template, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_ENCRYPT_MAC(pd, ctx, plaintext, ciphertext, mac, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac( \
	    ctx, plaintext, ciphertext, mac, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_ENCRYPT_MAC_UPDATE(pd, ctx, plaintext, ciphertext, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_update( \
	    ctx, plaintext, ciphertext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_ENCRYPT_MAC_FINAL(pd, ctx, ciphertext, mac, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_final( \
	    ctx, ciphertext, mac, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_ENCRYPT_MAC_ATOMIC(pd, session, encr_mech, encr_key, \
	    mac_mech, mac_key, plaintext, ciphertext, mac, \
	    encr_ctx_template, mac_ctx_template, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->encrypt_mac_atomic( \
	    (pd)->pd_prov_handle, session, encr_mech, encr_key, \
	    mac_mech, mac_key, plaintext, ciphertext, mac, \
	    encr_ctx_template, mac_ctx_template, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_DECRYPT_INIT(pd, ctx, mac_mech, mac_key, decr_mech, \
	    decr_key, mac_ctx_template, decr_ctx_template, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_init( \
	    ctx, mac_mech, mac_key, decr_mech, decr_key, mac_ctx_template, \
	    decr_ctx_template, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_DECRYPT(pd, ctx, ciphertext, mac, plaintext, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt( \
	    ctx, ciphertext, mac, plaintext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_DECRYPT_UPDATE(pd, ctx, ciphertext, plaintext, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_update( \
	    ctx, ciphertext, plaintext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_DECRYPT_FINAL(pd, ctx, mac, plaintext, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_final( \
	    ctx, mac, plaintext, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \
	    decr_mech, decr_key, ciphertext, mac, plaintext, \
	    mac_ctx_template, decr_ctx_template, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_decrypt_atomic( \
	    (pd)->pd_prov_handle, session, mac_mech, mac_key, \
	    decr_mech, decr_key, ciphertext, mac, plaintext, \
	    mac_ctx_template, decr_ctx_template, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_MAC_VERIFY_DECRYPT_ATOMIC(pd, session, mac_mech, mac_key, \
	    decr_mech, decr_key, ciphertext, mac, plaintext, \
	    mac_ctx_template, decr_ctx_template, req) ( \
	(KCF_PROV_DUAL_CIPHER_MAC_OPS(pd) && \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic \
	    != NULL) ? \
	KCF_PROV_DUAL_CIPHER_MAC_OPS(pd)->mac_verify_decrypt_atomic( \
	    (pd)->pd_prov_handle, session, mac_mech, mac_key, \
	    decr_mech, decr_key, ciphertext, mac, plaintext, \
	    mac_ctx_template, decr_ctx_template, req) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_random_number_ops(9S) entry points.
 */

#define	KCF_PROV_SEED_RANDOM(pd, session, buf, len, est, flags, req) ( \
	(KCF_PROV_RANDOM_OPS(pd) && KCF_PROV_RANDOM_OPS(pd)->seed_random) ? \
	KCF_PROV_RANDOM_OPS(pd)->seed_random((pd)->pd_prov_handle, \
	    session, buf, len, est, flags, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_GENERATE_RANDOM(pd, session, buf, len, req) ( \
	(KCF_PROV_RANDOM_OPS(pd) && \
	KCF_PROV_RANDOM_OPS(pd)->generate_random) ? \
	KCF_PROV_RANDOM_OPS(pd)->generate_random((pd)->pd_prov_handle, \
	    session, buf, len, req) : CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_session_ops(9S) entry points.
 *
 * ops_pd is the provider descriptor that supplies the ops_vector.
 * pd is the descriptor that supplies the provider handle.
 * Only session open/close needs two handles.
 */

#define	KCF_PROV_SESSION_OPEN(ops_pd, session, req, pd) ( \
	(KCF_PROV_SESSION_OPS(ops_pd) && \
	KCF_PROV_SESSION_OPS(ops_pd)->session_open) ? \
	KCF_PROV_SESSION_OPS(ops_pd)->session_open((pd)->pd_prov_handle, \
	    session, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SESSION_CLOSE(ops_pd, session, req, pd) ( \
	(KCF_PROV_SESSION_OPS(ops_pd) && \
	KCF_PROV_SESSION_OPS(ops_pd)->session_close) ? \
	KCF_PROV_SESSION_OPS(ops_pd)->session_close((pd)->pd_prov_handle, \
	    session, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SESSION_LOGIN(pd, session, user_type, pin, len, req) ( \
	(KCF_PROV_SESSION_OPS(pd) && \
	KCF_PROV_SESSION_OPS(pd)->session_login) ? \
	KCF_PROV_SESSION_OPS(pd)->session_login((pd)->pd_prov_handle, \
	    session, user_type, pin, len, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SESSION_LOGOUT(pd, session, req) ( \
	(KCF_PROV_SESSION_OPS(pd) && \
	KCF_PROV_SESSION_OPS(pd)->session_logout) ? \
	KCF_PROV_SESSION_OPS(pd)->session_logout((pd)->pd_prov_handle, \
	    session, req) : CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_object_ops(9S) entry points.
 */

#define	KCF_PROV_OBJECT_CREATE(pd, session, template, count, object, req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_create) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_create((pd)->pd_prov_handle, \
	    session, template, count, object, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_OBJECT_COPY(pd, session, object, template, count, \
	    new_object, req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_copy) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_copy((pd)->pd_prov_handle, \
	session, object, template, count, new_object, req) : \
	    CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_OBJECT_DESTROY(pd, session, object, req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_destroy) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_destroy((pd)->pd_prov_handle, \
	    session, object, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_OBJECT_GET_SIZE(pd, session, object, size, req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && \
	KCF_PROV_OBJECT_OPS(pd)->object_get_size) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_get_size((pd)->pd_prov_handle, \
	    session, object, size, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_OBJECT_GET_ATTRIBUTE_VALUE(pd, session, object, template, \
	    count, req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && \
	KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_get_attribute_value( \
	(pd)->pd_prov_handle, session, object, template, count, req) : \
	    CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_OBJECT_SET_ATTRIBUTE_VALUE(pd, session, object, template, \
	    count, req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && \
	KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_set_attribute_value( \
	(pd)->pd_prov_handle, session, object, template, count, req) : \
	    CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_OBJECT_FIND_INIT(pd, session, template, count, ppriv, \
	    req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && \
	KCF_PROV_OBJECT_OPS(pd)->object_find_init) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_find_init((pd)->pd_prov_handle, \
	session, template, count, ppriv, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_OBJECT_FIND(pd, ppriv, objects, max_objects, object_count, \
	    req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && KCF_PROV_OBJECT_OPS(pd)->object_find) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_find( \
	(pd)->pd_prov_handle, ppriv, objects, max_objects, object_count, \
	req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_OBJECT_FIND_FINAL(pd, ppriv, req) ( \
	(KCF_PROV_OBJECT_OPS(pd) && \
	KCF_PROV_OBJECT_OPS(pd)->object_find_final) ? \
	KCF_PROV_OBJECT_OPS(pd)->object_find_final( \
	    (pd)->pd_prov_handle, ppriv, req) : CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_key_ops(9S) entry points.
 */

#define	KCF_PROV_KEY_GENERATE(pd, session, mech, template, count, object, \
	    req) ( \
	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate) ? \
	KCF_PROV_KEY_OPS(pd)->key_generate((pd)->pd_prov_handle, \
	    session, mech, template, count, object, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \
	    pub_count, priv_template, priv_count, pub_key, priv_key, req) ( \
	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_generate_pair) ? \
	KCF_PROV_KEY_OPS(pd)->key_generate_pair((pd)->pd_prov_handle, \
	    session, mech, pub_template, pub_count, priv_template, \
	    priv_count, pub_key, priv_key, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_KEY_WRAP(pd, session, mech, wrapping_key, key, wrapped_key, \
	    wrapped_key_len, req) ( \
	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_wrap) ? \
	KCF_PROV_KEY_OPS(pd)->key_wrap((pd)->pd_prov_handle, \
	    session, mech, wrapping_key, key, wrapped_key, wrapped_key_len, \
	    req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_KEY_UNWRAP(pd, session, mech, unwrapping_key, wrapped_key, \
	    wrapped_key_len, template, count, key, req) ( \
	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_unwrap) ? \
	KCF_PROV_KEY_OPS(pd)->key_unwrap((pd)->pd_prov_handle, \
	    session, mech, unwrapping_key, wrapped_key, wrapped_key_len, \
	    template, count, key, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_KEY_DERIVE(pd, session, mech, base_key, template, count, \
	    key, req) ( \
	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_derive) ? \
	KCF_PROV_KEY_OPS(pd)->key_derive((pd)->pd_prov_handle, \
	    session, mech, base_key, template, count, key, req) : \
	CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_KEY_CHECK(pd, mech, key) ( \
	(KCF_PROV_KEY_OPS(pd) && KCF_PROV_KEY_OPS(pd)->key_check) ? \
	KCF_PROV_KEY_OPS(pd)->key_check((pd)->pd_prov_handle, mech, key) : \
	CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_provider_management_ops(9S) entry points.
 *
 * ops_pd is the provider descriptor that supplies the ops_vector.
 * pd is the descriptor that supplies the provider handle.
 * Only ext_info needs two handles.
 */

#define	KCF_PROV_EXT_INFO(ops_pd, provext_info, req, pd) ( \
	(KCF_PROV_PROVIDER_OPS(ops_pd) && \
	KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info) ? \
	KCF_PROV_PROVIDER_OPS(ops_pd)->ext_info((pd)->pd_prov_handle, \
	    provext_info, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_INIT_TOKEN(pd, pin, pin_len, label, req) ( \
	(KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_token) ? \
	KCF_PROV_PROVIDER_OPS(pd)->init_token((pd)->pd_prov_handle, \
	    pin, pin_len, label, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_INIT_PIN(pd, session, pin, pin_len, req) ( \
	(KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->init_pin) ? \
	KCF_PROV_PROVIDER_OPS(pd)->init_pin((pd)->pd_prov_handle, \
	    session, pin, pin_len, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_SET_PIN(pd, session, old_pin, old_len, new_pin, new_len, \
	    req) ( \
	(KCF_PROV_PROVIDER_OPS(pd) && KCF_PROV_PROVIDER_OPS(pd)->set_pin) ? \
	KCF_PROV_PROVIDER_OPS(pd)->set_pin((pd)->pd_prov_handle, \
	session, old_pin, old_len, new_pin, new_len, req) : \
	    CRYPTO_NOT_SUPPORTED)

/*
 * Wrappers for crypto_nostore_key_ops(9S) entry points.
 */

#define	KCF_PROV_NOSTORE_KEY_GENERATE(pd, session, mech, template, count, \
	    out_template, out_count, req) ( \
	(KCF_PROV_NOSTORE_KEY_OPS(pd) && \
	    KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate) ? \
	KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate( \
	    (pd)->pd_prov_handle, session, mech, template, count, \
	    out_template, out_count, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_NOSTORE_KEY_GENERATE_PAIR(pd, session, mech, pub_template, \
	    pub_count, priv_template, priv_count, out_pub_template, \
	    out_pub_count, out_priv_template, out_priv_count, req) ( \
	(KCF_PROV_NOSTORE_KEY_OPS(pd) && \
	    KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair) ? \
	KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_generate_pair( \
	    (pd)->pd_prov_handle, session, mech, pub_template, pub_count, \
	    priv_template, priv_count, out_pub_template, out_pub_count, \
	    out_priv_template, out_priv_count, req) : CRYPTO_NOT_SUPPORTED)

#define	KCF_PROV_NOSTORE_KEY_DERIVE(pd, session, mech, base_key, template, \
	    count, out_template, out_count, req) ( \
	(KCF_PROV_NOSTORE_KEY_OPS(pd) && \
	    KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive) ? \
	KCF_PROV_NOSTORE_KEY_OPS(pd)->nostore_key_derive( \
	    (pd)->pd_prov_handle, session, mech, base_key, template, count, \
	    out_template, out_count, req) : CRYPTO_NOT_SUPPORTED)

/*
 * The following routines are exported by the kcf module (/kernel/misc/kcf)
 * to the crypto and cryptoadmin modules.
 */

/* Digest/mac/cipher entry points that take a provider descriptor and session */
extern int crypto_digest_single(crypto_context_t, crypto_data_t *,
    crypto_data_t *, crypto_call_req_t *);

extern int crypto_mac_single(crypto_context_t, crypto_data_t *,
    crypto_data_t *, crypto_call_req_t *);

extern int crypto_encrypt_single(crypto_context_t, crypto_data_t *,
    crypto_data_t *, crypto_call_req_t *);

extern int crypto_decrypt_single(crypto_context_t, crypto_data_t *,
    crypto_data_t *, crypto_call_req_t *);


/* Other private digest/mac/cipher entry points not exported through k-API */
extern int crypto_digest_key_prov(crypto_context_t, crypto_key_t *,
    crypto_call_req_t *);

/* Private sign entry points exported by KCF */
extern int crypto_sign_single(crypto_context_t, crypto_data_t *,
    crypto_data_t *, crypto_call_req_t *);

extern int crypto_sign_recover_single(crypto_context_t, crypto_data_t *,
    crypto_data_t *, crypto_call_req_t *);

/* Private verify entry points exported by KCF */
extern int crypto_verify_single(crypto_context_t, crypto_data_t *,
    crypto_data_t *, crypto_call_req_t *);

extern int crypto_verify_recover_single(crypto_context_t, crypto_data_t *,
    crypto_data_t *, crypto_call_req_t *);

/* Private dual operations entry points exported by KCF */
extern int crypto_digest_encrypt_update(crypto_context_t, crypto_context_t,
    crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
extern int crypto_decrypt_digest_update(crypto_context_t, crypto_context_t,
    crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
extern int crypto_sign_encrypt_update(crypto_context_t, crypto_context_t,
    crypto_data_t *, crypto_data_t *, crypto_call_req_t *);
extern int crypto_decrypt_verify_update(crypto_context_t, crypto_context_t,
    crypto_data_t *, crypto_data_t *, crypto_call_req_t *);

/* Random Number Generation */
int crypto_seed_random(crypto_provider_handle_t provider, uchar_t *buf,
    size_t len, crypto_call_req_t *req);
int crypto_generate_random(crypto_provider_handle_t provider, uchar_t *buf,
    size_t len, crypto_call_req_t *req);

/* Provider Management */
int crypto_get_provider_info(crypto_provider_id_t id,
    crypto_provider_info_t **info, crypto_call_req_t *req);
int crypto_get_provider_mechanisms(crypto_minor_t *, crypto_provider_id_t id,
    uint_t *count, crypto_mech_name_t **list);
int crypto_init_token(crypto_provider_handle_t provider, char *pin,
    size_t pin_len, char *label, crypto_call_req_t *);
int crypto_init_pin(crypto_provider_handle_t provider, char *pin,
    size_t pin_len, crypto_call_req_t *req);
int crypto_set_pin(crypto_provider_handle_t provider, char *old_pin,
    size_t old_len, char *new_pin, size_t new_len, crypto_call_req_t *req);
void crypto_free_provider_list(crypto_provider_entry_t *list, uint_t count);
void crypto_free_provider_info(crypto_provider_info_t *info);

/* Administrative */
int crypto_get_dev_list(uint_t *count, crypto_dev_list_entry_t **list);
int crypto_get_soft_list(uint_t *count, char **list, size_t *len);
int crypto_get_dev_info(char *name, uint_t instance, uint_t *count,
    crypto_mech_name_t **list);
int crypto_get_soft_info(caddr_t name, uint_t *count,
    crypto_mech_name_t **list);
int crypto_load_dev_disabled(char *name, uint_t instance, uint_t count,
    crypto_mech_name_t *list);
int crypto_load_soft_disabled(caddr_t name, uint_t count,
    crypto_mech_name_t *list);
int crypto_unload_soft_module(caddr_t path);
int crypto_load_soft_config(caddr_t name, uint_t count,
    crypto_mech_name_t *list);
int crypto_load_door(uint_t did);
void crypto_free_mech_list(crypto_mech_name_t *list, uint_t count);
void crypto_free_dev_list(crypto_dev_list_entry_t *list, uint_t count);
extern void kcf_activate();

/* Miscellaneous */
int crypto_get_mechanism_number(caddr_t name, crypto_mech_type_t *number);
int crypto_get_function_list(crypto_provider_id_t id,
    crypto_function_list_t **list, int kmflag);
void crypto_free_function_list(crypto_function_list_t *list);
int crypto_build_permitted_mech_names(kcf_provider_desc_t *,
    crypto_mech_name_t **, uint_t *, int);
extern void kcf_init_mech_tabs(void);
extern int kcf_add_mech_provider(short, kcf_provider_desc_t *,
    kcf_prov_mech_desc_t **);
extern void kcf_remove_mech_provider(char *, kcf_provider_desc_t *);
extern int kcf_get_mech_entry(crypto_mech_type_t, kcf_mech_entry_t **);
extern kcf_provider_desc_t *kcf_alloc_provider_desc(crypto_provider_info_t *);
extern void kcf_free_provider_desc(kcf_provider_desc_t *);
extern void kcf_soft_config_init(void);
extern int get_sw_provider_for_mech(crypto_mech_name_t, char **);
extern crypto_mech_type_t crypto_mech2id_common(char *, boolean_t);
extern void undo_register_provider(kcf_provider_desc_t *, boolean_t);
extern void redo_register_provider(kcf_provider_desc_t *);
extern void kcf_rnd_init();
extern boolean_t kcf_rngprov_check(void);
extern int kcf_rnd_get_pseudo_bytes(uint8_t *, size_t);
extern int kcf_rnd_get_bytes(uint8_t *, size_t, boolean_t);
extern int random_add_pseudo_entropy(uint8_t *, size_t, uint_t);
extern void kcf_rnd_chpoll(short, int, short *, struct pollhead **);
extern int crypto_uio_data(crypto_data_t *, uchar_t *, int, cmd_type_t,
    void *, void (*update)());
extern int crypto_mblk_data(crypto_data_t *, uchar_t *, int, cmd_type_t,
    void *, void (*update)());
extern int crypto_put_output_data(uchar_t *, crypto_data_t *, int);
extern int crypto_get_input_data(crypto_data_t *, uchar_t **, uchar_t *);
extern int crypto_compare_data(crypto_data_t *, uchar_t *, size_t);
extern int crypto_copy_key_to_ctx(crypto_key_t *, crypto_key_t **, size_t *,
    int kmflag);
extern int crypto_digest_data(crypto_data_t *, void *, uchar_t *,
    void (*update)(), void (*final)(), uchar_t);
extern int crypto_update_iov(void *, crypto_data_t *, crypto_data_t *,
    int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
    void (*copy_block)(uint8_t *, uint64_t *));
extern int crypto_update_uio(void *, crypto_data_t *, crypto_data_t *,
    int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
    void (*copy_block)(uint8_t *, uint64_t *));
extern int crypto_update_mp(void *, crypto_data_t *, crypto_data_t *,
    int (*cipher)(void *, caddr_t, size_t, crypto_data_t *),
    void (*copy_block)(uint8_t *, uint64_t *));
extern int crypto_get_key_attr(crypto_key_t *, crypto_attr_type_t, uchar_t **,
    ssize_t *);

/* param copyin helpers used in kcf_mech_tabs */
int kcf_copyin_aes_ccm_param(caddr_t, size_t, crypto_mechanism_t *, int, int);
int kcf_copyin_aes_gcm_param(caddr_t, size_t, crypto_mechanism_t *, int, int);
int kcf_copyin_aes_gmac_param(caddr_t, size_t, crypto_mechanism_t *, int, int);
int kcf_copyin_ecdh1_param(caddr_t, size_t, crypto_mechanism_t *, int, int);

/* Access to the provider's table */
extern void kcf_prov_tab_init(void);
extern int kcf_prov_tab_add_provider(kcf_provider_desc_t *);
extern int kcf_prov_tab_rem_provider(crypto_provider_id_t);
extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_name(char *);
extern kcf_provider_desc_t *kcf_prov_tab_lookup_by_dev(char *, uint_t);
extern int kcf_get_hw_prov_tab(uint_t *, kcf_provider_desc_t ***, int,
    char *, uint_t, boolean_t);
extern int kcf_get_slot_list(uint_t *, kcf_provider_desc_t ***, boolean_t);
extern void kcf_free_provider_tab(uint_t, kcf_provider_desc_t **);
extern kcf_provider_desc_t *kcf_prov_tab_lookup(crypto_provider_id_t);
extern int kcf_get_sw_prov(crypto_mech_type_t, kcf_provider_desc_t **,
    kcf_mech_entry_t **, boolean_t);

extern kmutex_t prov_tab_mutex;
extern boolean_t kcf_need_provtab_walk;
extern int kcf_get_refcnt(kcf_provider_desc_t *, boolean_t);

/* Access to the policy table */
extern boolean_t is_mech_disabled(kcf_provider_desc_t *, crypto_mech_name_t);
extern boolean_t is_mech_disabled_byname(crypto_provider_type_t, char *,
    uint_t, crypto_mech_name_t);
extern void kcf_policy_tab_init(void);
extern void kcf_policy_free_desc(kcf_policy_desc_t *);
extern void kcf_policy_remove_by_name(char *, uint_t *, crypto_mech_name_t **);
extern void kcf_policy_remove_by_dev(char *, uint_t, uint_t *,
    crypto_mech_name_t **);
extern kcf_policy_desc_t *kcf_policy_lookup_by_name(char *);
extern kcf_policy_desc_t *kcf_policy_lookup_by_dev(char *, uint_t);
extern int kcf_policy_load_soft_disabled(char *, uint_t, crypto_mech_name_t *,
    uint_t *, crypto_mech_name_t **);
extern int kcf_policy_load_dev_disabled(char *, uint_t, uint_t,
    crypto_mech_name_t *, uint_t *, crypto_mech_name_t **);
extern void remove_soft_config(char *);

#endif	/* _KERNEL */

#ifdef	__cplusplus
}
#endif

#endif	/* _SYS_CRYPTO_IMPL_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef	_SYS_CRYPTO_IOCTL_H
#define	_SYS_CRYPTO_IOCTL_H

#ifdef	__cplusplus
extern "C" {
#endif

#include <sys/types.h>
#include <sys/crypto/api.h>
#include <sys/crypto/spi.h>
#include <sys/crypto/common.h>

#define	CRYPTO_MAX_ATTRIBUTE_COUNT	128

#define	CRYPTO_IOFLAGS_RW_SESSION	0x00000001

#define	CRYPTO(x)		(('y' << 8) | (x))

#define	MAX_NUM_THRESHOLD	7

/* the PKCS11 Mechanisms */
#define	CKM_RC4			0x00000111UL
#define	CKM_DES3_ECB		0x00000132UL
#define	CKM_DES3_CBC		0x00000133UL
#define	CKM_MD5			0x00000210UL
#define	CKM_SHA_1		0x00000220UL
#define	CKM_AES_ECB		0x00001081UL
#define	CKM_AES_CBC		0x00001082UL

/*
 * General Purpose Ioctls
 */

typedef struct fl_mechs_threshold {
	int		mech_type;
	uint32_t	mech_threshold;
} fl_mechs_threshold_t;

typedef struct crypto_function_list {
	boolean_t fl_digest_init;
	boolean_t fl_digest;
	boolean_t fl_digest_update;
	boolean_t fl_digest_key;
	boolean_t fl_digest_final;

	boolean_t fl_encrypt_init;
	boolean_t fl_encrypt;
	boolean_t fl_encrypt_update;
	boolean_t fl_encrypt_final;

	boolean_t fl_decrypt_init;
	boolean_t fl_decrypt;
	boolean_t fl_decrypt_update;
	boolean_t fl_decrypt_final;

	boolean_t fl_mac_init;
	boolean_t fl_mac;
	boolean_t fl_mac_update;
	boolean_t fl_mac_final;

	boolean_t fl_sign_init;
	boolean_t fl_sign;
	boolean_t fl_sign_update;
	boolean_t fl_sign_final;
	boolean_t fl_sign_recover_init;
	boolean_t fl_sign_recover;

	boolean_t fl_verify_init;
	boolean_t fl_verify;
	boolean_t fl_verify_update;
	boolean_t fl_verify_final;
	boolean_t fl_verify_recover_init;
	boolean_t fl_verify_recover;

	boolean_t fl_digest_encrypt_update;
	boolean_t fl_decrypt_digest_update;
	boolean_t fl_sign_encrypt_update;
	boolean_t fl_decrypt_verify_update;

	boolean_t fl_seed_random;
	boolean_t fl_generate_random;

	boolean_t fl_session_open;
	boolean_t fl_session_close;
	boolean_t fl_session_login;
	boolean_t fl_session_logout;

	boolean_t fl_object_create;
	boolean_t fl_object_copy;
	boolean_t fl_object_destroy;
	boolean_t fl_object_get_size;
	boolean_t fl_object_get_attribute_value;
	boolean_t fl_object_set_attribute_value;
	boolean_t fl_object_find_init;
	boolean_t fl_object_find;
	boolean_t fl_object_find_final;

	boolean_t fl_key_generate;
	boolean_t fl_key_generate_pair;
	boolean_t fl_key_wrap;
	boolean_t fl_key_unwrap;
	boolean_t fl_key_derive;

	boolean_t fl_init_token;
	boolean_t fl_init_pin;
	boolean_t fl_set_pin;

	boolean_t prov_is_hash_limited;
	uint32_t prov_hash_threshold;
	uint32_t prov_hash_limit;

	boolean_t prov_is_hmac_limited;
	uint32_t prov_hmac_limit;

	int total_threshold_count;
	fl_mechs_threshold_t	fl_threshold[MAX_NUM_THRESHOLD];
} crypto_function_list_t;

typedef struct crypto_get_function_list {
	uint_t			fl_return_value;
	crypto_provider_id_t	fl_provider_id;
	crypto_function_list_t	fl_list;
} crypto_get_function_list_t;

typedef struct crypto_get_mechanism_number {
	uint_t			pn_return_value;
	caddr_t			pn_mechanism_string;
	size_t			pn_mechanism_len;
	crypto_mech_type_t	pn_internal_number;
} crypto_get_mechanism_number_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_get_mechanism_number32 {
	uint32_t		pn_return_value;
	caddr32_t		pn_mechanism_string;
	size32_t		pn_mechanism_len;
	crypto_mech_type_t	pn_internal_number;
} crypto_get_mechanism_number32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_GET_FUNCTION_LIST	CRYPTO(20)
#define	CRYPTO_GET_MECHANISM_NUMBER	CRYPTO(21)

/*
 * Session Ioctls
 */

typedef uint32_t	crypto_flags_t;

typedef struct crypto_open_session {
	uint_t			os_return_value;
	crypto_session_id_t	os_session;
	crypto_flags_t		os_flags;
	crypto_provider_id_t	os_provider_id;
} crypto_open_session_t;

typedef struct crypto_close_session {
	uint_t			cs_return_value;
	crypto_session_id_t	cs_session;
} crypto_close_session_t;

typedef struct crypto_close_all_sessions {
	uint_t			as_return_value;
	crypto_provider_id_t	as_provider_id;
} crypto_close_all_sessions_t;

#define	CRYPTO_OPEN_SESSION		CRYPTO(30)
#define	CRYPTO_CLOSE_SESSION		CRYPTO(31)
#define	CRYPTO_CLOSE_ALL_SESSIONS	CRYPTO(32)

/*
 * Login Ioctls
 */
typedef struct crypto_login {
	uint_t			co_return_value;
	crypto_session_id_t	co_session;
	uint_t			co_user_type;
	uint_t			co_pin_len;
	caddr_t			co_pin;
} crypto_login_t;

typedef struct crypto_logout {
	uint_t			cl_return_value;
	crypto_session_id_t	cl_session;
} crypto_logout_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

typedef struct crypto_login32 {
	uint32_t		co_return_value;
	crypto_session_id_t	co_session;
	uint32_t		co_user_type;
	uint32_t		co_pin_len;
	caddr32_t		co_pin;
} crypto_login32_t;

typedef struct crypto_logout32 {
	uint32_t		cl_return_value;
	crypto_session_id_t	cl_session;
} crypto_logout32_t;

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_LOGIN			CRYPTO(40)
#define	CRYPTO_LOGOUT			CRYPTO(41)

/* flag for encrypt and decrypt operations */
#define	CRYPTO_INPLACE_OPERATION	0x00000001

/*
 * Cryptographic Ioctls
 */
typedef struct crypto_encrypt {
	uint_t			ce_return_value;
	crypto_session_id_t	ce_session;
	size_t			ce_datalen;
	caddr_t			ce_databuf;
	size_t			ce_encrlen;
	caddr_t			ce_encrbuf;
	uint_t			ce_flags;
} crypto_encrypt_t;

typedef struct crypto_encrypt_init {
	uint_t			ei_return_value;
	crypto_session_id_t	ei_session;
	crypto_mechanism_t	ei_mech;
	crypto_key_t		ei_key;
} crypto_encrypt_init_t;

typedef struct crypto_encrypt_update {
	uint_t			eu_return_value;
	crypto_session_id_t	eu_session;
	size_t			eu_datalen;
	caddr_t			eu_databuf;
	size_t			eu_encrlen;
	caddr_t			eu_encrbuf;
	uint_t			eu_flags;
} crypto_encrypt_update_t;

typedef struct crypto_encrypt_final {
	uint_t			ef_return_value;
	crypto_session_id_t	ef_session;
	size_t			ef_encrlen;
	caddr_t			ef_encrbuf;
} crypto_encrypt_final_t;

typedef struct crypto_decrypt {
	uint_t			cd_return_value;
	crypto_session_id_t	cd_session;
	size_t			cd_encrlen;
	caddr_t			cd_encrbuf;
	size_t			cd_datalen;
	caddr_t			cd_databuf;
	uint_t			cd_flags;
} crypto_decrypt_t;

typedef struct crypto_decrypt_init {
	uint_t			di_return_value;
	crypto_session_id_t	di_session;
	crypto_mechanism_t	di_mech;
	crypto_key_t		di_key;
} crypto_decrypt_init_t;

typedef struct crypto_decrypt_update {
	uint_t			du_return_value;
	crypto_session_id_t	du_session;
	size_t			du_encrlen;
	caddr_t			du_encrbuf;
	size_t			du_datalen;
	caddr_t			du_databuf;
	uint_t			du_flags;
} crypto_decrypt_update_t;

typedef struct crypto_decrypt_final {
	uint_t			df_return_value;
	crypto_session_id_t	df_session;
	size_t			df_datalen;
	caddr_t			df_databuf;
} crypto_decrypt_final_t;

typedef struct crypto_digest {
	uint_t			cd_return_value;
	crypto_session_id_t	cd_session;
	size_t			cd_datalen;
	caddr_t			cd_databuf;
	size_t			cd_digestlen;
	caddr_t			cd_digestbuf;
} crypto_digest_t;

typedef struct crypto_digest_init {
	uint_t			di_return_value;
	crypto_session_id_t	di_session;
	crypto_mechanism_t	di_mech;
} crypto_digest_init_t;

typedef struct crypto_digest_update {
	uint_t			du_return_value;
	crypto_session_id_t	du_session;
	size_t			du_datalen;
	caddr_t			du_databuf;
} crypto_digest_update_t;

typedef struct crypto_digest_key {
	uint_t			dk_return_value;
	crypto_session_id_t	dk_session;
	crypto_key_t		dk_key;
} crypto_digest_key_t;

typedef struct crypto_digest_final {
	uint_t			df_return_value;
	crypto_session_id_t	df_session;
	size_t			df_digestlen;
	caddr_t			df_digestbuf;
} crypto_digest_final_t;

typedef struct crypto_mac {
	uint_t			cm_return_value;
	crypto_session_id_t	cm_session;
	size_t			cm_datalen;
	caddr_t			cm_databuf;
	size_t			cm_maclen;
	caddr_t			cm_macbuf;
} crypto_mac_t;

typedef struct crypto_mac_init {
	uint_t			mi_return_value;
	crypto_session_id_t	mi_session;
	crypto_mechanism_t	mi_mech;
	crypto_key_t		mi_key;
} crypto_mac_init_t;

typedef struct crypto_mac_update {
	uint_t			mu_return_value;
	crypto_session_id_t	mu_session;
	size_t			mu_datalen;
	caddr_t			mu_databuf;
} crypto_mac_update_t;

typedef struct crypto_mac_final {
	uint_t			mf_return_value;
	crypto_session_id_t	mf_session;
	size_t			mf_maclen;
	caddr_t			mf_macbuf;
} crypto_mac_final_t;

typedef struct crypto_sign {
	uint_t			cs_return_value;
	crypto_session_id_t	cs_session;
	size_t			cs_datalen;
	caddr_t			cs_databuf;
	size_t			cs_signlen;
	caddr_t			cs_signbuf;
} crypto_sign_t;

typedef struct crypto_sign_init {
	uint_t			si_return_value;
	crypto_session_id_t	si_session;
	crypto_mechanism_t	si_mech;
	crypto_key_t		si_key;
} crypto_sign_init_t;

typedef struct crypto_sign_update {
	uint_t			su_return_value;
	crypto_session_id_t	su_session;
	size_t			su_datalen;
	caddr_t			su_databuf;
} crypto_sign_update_t;

typedef struct crypto_sign_final {
	uint_t			sf_return_value;
	crypto_session_id_t	sf_session;
	size_t			sf_signlen;
	caddr_t			sf_signbuf;
} crypto_sign_final_t;

typedef struct crypto_sign_recover_init {
	uint_t			ri_return_value;
	crypto_session_id_t	ri_session;
	crypto_mechanism_t	ri_mech;
	crypto_key_t		ri_key;
} crypto_sign_recover_init_t;

typedef struct crypto_sign_recover {
	uint_t			sr_return_value;
	crypto_session_id_t	sr_session;
	size_t			sr_datalen;
	caddr_t			sr_databuf;
	size_t			sr_signlen;
	caddr_t			sr_signbuf;
} crypto_sign_recover_t;

typedef struct crypto_verify {
	uint_t			cv_return_value;
	crypto_session_id_t	cv_session;
	size_t			cv_datalen;
	caddr_t			cv_databuf;
	size_t			cv_signlen;
	caddr_t			cv_signbuf;
} crypto_verify_t;

typedef struct crypto_verify_init {
	uint_t			vi_return_value;
	crypto_session_id_t	vi_session;
	crypto_mechanism_t	vi_mech;
	crypto_key_t		vi_key;
} crypto_verify_init_t;

typedef struct crypto_verify_update {
	uint_t			vu_return_value;
	crypto_session_id_t	vu_session;
	size_t			vu_datalen;
	caddr_t			vu_databuf;
} crypto_verify_update_t;

typedef struct crypto_verify_final {
	uint_t			vf_return_value;
	crypto_session_id_t	vf_session;
	size_t			vf_signlen;
	caddr_t			vf_signbuf;
} crypto_verify_final_t;

typedef struct crypto_verify_recover_init {
	uint_t			ri_return_value;
	crypto_session_id_t	ri_session;
	crypto_mechanism_t	ri_mech;
	crypto_key_t		ri_key;
} crypto_verify_recover_init_t;

typedef struct crypto_verify_recover {
	uint_t			vr_return_value;
	crypto_session_id_t	vr_session;
	size_t			vr_signlen;
	caddr_t			vr_signbuf;
	size_t			vr_datalen;
	caddr_t			vr_databuf;
} crypto_verify_recover_t;

typedef struct crypto_digest_encrypt_update {
	uint_t			eu_return_value;
	crypto_session_id_t	eu_session;
	size_t			eu_datalen;
	caddr_t			eu_databuf;
	size_t			eu_encrlen;
	caddr_t			eu_encrbuf;
} crypto_digest_encrypt_update_t;

typedef struct crypto_decrypt_digest_update {
	uint_t			du_return_value;
	crypto_session_id_t	du_session;
	size_t			du_encrlen;
	caddr_t			du_encrbuf;
	size_t			du_datalen;
	caddr_t			du_databuf;
} crypto_decrypt_digest_update_t;

typedef struct crypto_sign_encrypt_update {
	uint_t			eu_return_value;
	crypto_session_id_t	eu_session;
	size_t			eu_datalen;
	caddr_t			eu_databuf;
	size_t			eu_encrlen;
	caddr_t			eu_encrbuf;
} crypto_sign_encrypt_update_t;

typedef struct crypto_decrypt_verify_update {
	uint_t			vu_return_value;
	crypto_session_id_t	vu_session;
	size_t			vu_encrlen;
	caddr_t			vu_encrbuf;
	size_t			vu_datalen;
	caddr_t			vu_databuf;
} crypto_decrypt_verify_update_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

typedef struct crypto_encrypt32 {
	uint32_t		ce_return_value;
	crypto_session_id_t	ce_session;
	size32_t		ce_datalen;
	caddr32_t		ce_databuf;
	size32_t		ce_encrlen;
	caddr32_t		ce_encrbuf;
	uint32_t		ce_flags;
} crypto_encrypt32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_encrypt_init32 {
	uint32_t		ei_return_value;
	crypto_session_id_t	ei_session;
	crypto_mechanism32_t	ei_mech;
	crypto_key32_t		ei_key;
} crypto_encrypt_init32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

typedef struct crypto_encrypt_update32 {
	uint32_t		eu_return_value;
	crypto_session_id_t	eu_session;
	size32_t		eu_datalen;
	caddr32_t		eu_databuf;
	size32_t		eu_encrlen;
	caddr32_t		eu_encrbuf;
	uint_t			eu_flags;
} crypto_encrypt_update32_t;

typedef struct crypto_encrypt_final32 {
	uint32_t		ef_return_value;
	crypto_session_id_t	ef_session;
	size32_t		ef_encrlen;
	caddr32_t		ef_encrbuf;
} crypto_encrypt_final32_t;

typedef struct crypto_decrypt32 {
	uint32_t		cd_return_value;
	crypto_session_id_t	cd_session;
	size32_t		cd_encrlen;
	caddr32_t		cd_encrbuf;
	size32_t		cd_datalen;
	caddr32_t		cd_databuf;
	uint32_t		cd_flags;
} crypto_decrypt32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_decrypt_init32 {
	uint32_t		di_return_value;
	crypto_session_id_t	di_session;
	crypto_mechanism32_t	di_mech;
	crypto_key32_t		di_key;
} crypto_decrypt_init32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

typedef struct crypto_decrypt_update32 {
	uint32_t		du_return_value;
	crypto_session_id_t	du_session;
	size32_t		du_encrlen;
	caddr32_t		du_encrbuf;
	size32_t		du_datalen;
	caddr32_t		du_databuf;
	uint_t			du_flags;
} crypto_decrypt_update32_t;

typedef struct crypto_decrypt_final32 {
	uint32_t		df_return_value;
	crypto_session_id_t	df_session;
	size32_t		df_datalen;
	caddr32_t		df_databuf;
} crypto_decrypt_final32_t;

typedef struct crypto_digest32 {
	uint32_t		cd_return_value;
	crypto_session_id_t	cd_session;
	size32_t		cd_datalen;
	caddr32_t		cd_databuf;
	size32_t		cd_digestlen;
	caddr32_t		cd_digestbuf;
} crypto_digest32_t;

typedef struct crypto_digest_init32 {
	uint32_t		di_return_value;
	crypto_session_id_t	di_session;
	crypto_mechanism32_t	di_mech;
} crypto_digest_init32_t;

typedef struct crypto_digest_update32 {
	uint32_t		du_return_value;
	crypto_session_id_t	du_session;
	size32_t		du_datalen;
	caddr32_t		du_databuf;
} crypto_digest_update32_t;

typedef struct crypto_digest_key32 {
	uint32_t		dk_return_value;
	crypto_session_id_t	dk_session;
	crypto_key32_t		dk_key;
} crypto_digest_key32_t;

typedef struct crypto_digest_final32 {
	uint32_t		df_return_value;
	crypto_session_id_t	df_session;
	size32_t		df_digestlen;
	caddr32_t		df_digestbuf;
} crypto_digest_final32_t;

typedef struct crypto_mac32 {
	uint32_t		cm_return_value;
	crypto_session_id_t	cm_session;
	size32_t		cm_datalen;
	caddr32_t		cm_databuf;
	size32_t		cm_maclen;
	caddr32_t		cm_macbuf;
} crypto_mac32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_mac_init32 {
	uint32_t		mi_return_value;
	crypto_session_id_t	mi_session;
	crypto_mechanism32_t	mi_mech;
	crypto_key32_t		mi_key;
} crypto_mac_init32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

typedef struct crypto_mac_update32 {
	uint32_t		mu_return_value;
	crypto_session_id_t	mu_session;
	size32_t		mu_datalen;
	caddr32_t		mu_databuf;
} crypto_mac_update32_t;

typedef struct crypto_mac_final32 {
	uint32_t		mf_return_value;
	crypto_session_id_t	mf_session;
	size32_t		mf_maclen;
	caddr32_t		mf_macbuf;
} crypto_mac_final32_t;

typedef struct crypto_sign32 {
	uint32_t		cs_return_value;
	crypto_session_id_t	cs_session;
	size32_t		cs_datalen;
	caddr32_t		cs_databuf;
	size32_t		cs_signlen;
	caddr32_t		cs_signbuf;
} crypto_sign32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_sign_init32 {
	uint32_t		si_return_value;
	crypto_session_id_t	si_session;
	crypto_mechanism32_t	si_mech;
	crypto_key32_t		si_key;
} crypto_sign_init32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

typedef struct crypto_sign_update32 {
	uint32_t		su_return_value;
	crypto_session_id_t	su_session;
	size32_t		su_datalen;
	caddr32_t		su_databuf;
} crypto_sign_update32_t;

typedef struct crypto_sign_final32 {
	uint32_t		sf_return_value;
	crypto_session_id_t	sf_session;
	size32_t		sf_signlen;
	caddr32_t		sf_signbuf;
} crypto_sign_final32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_sign_recover_init32 {
	uint32_t		ri_return_value;
	crypto_session_id_t	ri_session;
	crypto_mechanism32_t	ri_mech;
	crypto_key32_t		ri_key;
} crypto_sign_recover_init32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

typedef struct crypto_sign_recover32 {
	uint32_t		sr_return_value;
	crypto_session_id_t	sr_session;
	size32_t		sr_datalen;
	caddr32_t		sr_databuf;
	size32_t		sr_signlen;
	caddr32_t		sr_signbuf;
} crypto_sign_recover32_t;

typedef struct crypto_verify32 {
	uint32_t		cv_return_value;
	crypto_session_id_t	cv_session;
	size32_t		cv_datalen;
	caddr32_t		cv_databuf;
	size32_t		cv_signlen;
	caddr32_t		cv_signbuf;
} crypto_verify32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_verify_init32 {
	uint32_t		vi_return_value;
	crypto_session_id_t	vi_session;
	crypto_mechanism32_t	vi_mech;
	crypto_key32_t		vi_key;
} crypto_verify_init32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

typedef struct crypto_verify_update32 {
	uint32_t		vu_return_value;
	crypto_session_id_t	vu_session;
	size32_t		vu_datalen;
	caddr32_t		vu_databuf;
} crypto_verify_update32_t;

typedef struct crypto_verify_final32 {
	uint32_t		vf_return_value;
	crypto_session_id_t	vf_session;
	size32_t		vf_signlen;
	caddr32_t		vf_signbuf;
} crypto_verify_final32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_verify_recover_init32 {
	uint32_t		ri_return_value;
	crypto_session_id_t	ri_session;
	crypto_mechanism32_t	ri_mech;
	crypto_key32_t		ri_key;
} crypto_verify_recover_init32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

typedef struct crypto_verify_recover32 {
	uint32_t		vr_return_value;
	crypto_session_id_t	vr_session;
	size32_t		vr_signlen;
	caddr32_t		vr_signbuf;
	size32_t		vr_datalen;
	caddr32_t		vr_databuf;
} crypto_verify_recover32_t;

typedef struct crypto_digest_encrypt_update32 {
	uint32_t		eu_return_value;
	crypto_session_id_t	eu_session;
	size32_t		eu_datalen;
	caddr32_t		eu_databuf;
	size32_t		eu_encrlen;
	caddr32_t		eu_encrbuf;
} crypto_digest_encrypt_update32_t;

typedef struct crypto_decrypt_digest_update32 {
	uint32_t		du_return_value;
	crypto_session_id_t	du_session;
	size32_t		du_encrlen;
	caddr32_t		du_encrbuf;
	size32_t		du_datalen;
	caddr32_t		du_databuf;
} crypto_decrypt_digest_update32_t;

typedef struct crypto_sign_encrypt_update32 {
	uint32_t		eu_return_value;
	crypto_session_id_t	eu_session;
	size32_t		eu_datalen;
	caddr32_t		eu_databuf;
	size32_t		eu_encrlen;
	caddr32_t		eu_encrbuf;
} crypto_sign_encrypt_update32_t;

typedef struct crypto_decrypt_verify_update32 {
	uint32_t		vu_return_value;
	crypto_session_id_t	vu_session;
	size32_t		vu_encrlen;
	caddr32_t		vu_encrbuf;
	size32_t		vu_datalen;
	caddr32_t		vu_databuf;
} crypto_decrypt_verify_update32_t;

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_ENCRYPT			CRYPTO(50)
#define	CRYPTO_ENCRYPT_INIT		CRYPTO(51)
#define	CRYPTO_ENCRYPT_UPDATE		CRYPTO(52)
#define	CRYPTO_ENCRYPT_FINAL		CRYPTO(53)
#define	CRYPTO_DECRYPT			CRYPTO(54)
#define	CRYPTO_DECRYPT_INIT		CRYPTO(55)
#define	CRYPTO_DECRYPT_UPDATE		CRYPTO(56)
#define	CRYPTO_DECRYPT_FINAL		CRYPTO(57)

#define	CRYPTO_DIGEST			CRYPTO(58)
#define	CRYPTO_DIGEST_INIT		CRYPTO(59)
#define	CRYPTO_DIGEST_UPDATE		CRYPTO(60)
#define	CRYPTO_DIGEST_KEY		CRYPTO(61)
#define	CRYPTO_DIGEST_FINAL		CRYPTO(62)
#define	CRYPTO_MAC			CRYPTO(63)
#define	CRYPTO_MAC_INIT			CRYPTO(64)
#define	CRYPTO_MAC_UPDATE		CRYPTO(65)
#define	CRYPTO_MAC_FINAL		CRYPTO(66)

#define	CRYPTO_SIGN			CRYPTO(67)
#define	CRYPTO_SIGN_INIT		CRYPTO(68)
#define	CRYPTO_SIGN_UPDATE		CRYPTO(69)
#define	CRYPTO_SIGN_FINAL		CRYPTO(70)
#define	CRYPTO_SIGN_RECOVER_INIT	CRYPTO(71)
#define	CRYPTO_SIGN_RECOVER		CRYPTO(72)
#define	CRYPTO_VERIFY			CRYPTO(73)
#define	CRYPTO_VERIFY_INIT		CRYPTO(74)
#define	CRYPTO_VERIFY_UPDATE		CRYPTO(75)
#define	CRYPTO_VERIFY_FINAL		CRYPTO(76)
#define	CRYPTO_VERIFY_RECOVER_INIT	CRYPTO(77)
#define	CRYPTO_VERIFY_RECOVER		CRYPTO(78)

#define	CRYPTO_DIGEST_ENCRYPT_UPDATE	CRYPTO(79)
#define	CRYPTO_DECRYPT_DIGEST_UPDATE	CRYPTO(80)
#define	CRYPTO_SIGN_ENCRYPT_UPDATE	CRYPTO(81)
#define	CRYPTO_DECRYPT_VERIFY_UPDATE	CRYPTO(82)

/*
 * Random Number Ioctls
 */
typedef struct crypto_seed_random {
	uint_t			sr_return_value;
	crypto_session_id_t	sr_session;
	size_t			sr_seedlen;
	caddr_t			sr_seedbuf;
} crypto_seed_random_t;

typedef struct crypto_generate_random {
	uint_t			gr_return_value;
	crypto_session_id_t	gr_session;
	caddr_t			gr_buf;
	size_t			gr_buflen;
} crypto_generate_random_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

typedef struct crypto_seed_random32 {
	uint32_t		sr_return_value;
	crypto_session_id_t	sr_session;
	size32_t		sr_seedlen;
	caddr32_t		sr_seedbuf;
} crypto_seed_random32_t;

typedef struct crypto_generate_random32 {
	uint32_t		gr_return_value;
	crypto_session_id_t	gr_session;
	caddr32_t		gr_buf;
	size32_t		gr_buflen;
} crypto_generate_random32_t;

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_SEED_RANDOM		CRYPTO(90)
#define	CRYPTO_GENERATE_RANDOM		CRYPTO(91)

/*
 * Object Management Ioctls
 */
typedef struct crypto_object_create {
	uint_t			oc_return_value;
	crypto_session_id_t	oc_session;
	crypto_object_id_t	oc_handle;
	uint_t			oc_count;
	caddr_t			oc_attributes;
} crypto_object_create_t;

typedef struct crypto_object_copy {
	uint_t			oc_return_value;
	crypto_session_id_t	oc_session;
	crypto_object_id_t	oc_handle;
	crypto_object_id_t	oc_new_handle;
	uint_t			oc_count;
	caddr_t			oc_new_attributes;
} crypto_object_copy_t;

typedef struct crypto_object_destroy {
	uint_t			od_return_value;
	crypto_session_id_t	od_session;
	crypto_object_id_t	od_handle;
} crypto_object_destroy_t;

typedef struct crypto_object_get_attribute_value {
	uint_t			og_return_value;
	crypto_session_id_t	og_session;
	crypto_object_id_t	og_handle;
	uint_t			og_count;
	caddr_t			og_attributes;
} crypto_object_get_attribute_value_t;

typedef struct crypto_object_get_size {
	uint_t			gs_return_value;
	crypto_session_id_t	gs_session;
	crypto_object_id_t	gs_handle;
	size_t			gs_size;
} crypto_object_get_size_t;

typedef struct crypto_object_set_attribute_value {
	uint_t			sa_return_value;
	crypto_session_id_t	sa_session;
	crypto_object_id_t	sa_handle;
	uint_t			sa_count;
	caddr_t			sa_attributes;
} crypto_object_set_attribute_value_t;

typedef struct crypto_object_find_init {
	uint_t			fi_return_value;
	crypto_session_id_t	fi_session;
	uint_t			fi_count;
	caddr_t			fi_attributes;
} crypto_object_find_init_t;

typedef struct crypto_object_find_update {
	uint_t			fu_return_value;
	crypto_session_id_t	fu_session;
	uint_t			fu_max_count;
	uint_t			fu_count;
	caddr_t			fu_handles;
} crypto_object_find_update_t;

typedef struct crypto_object_find_final {
	uint_t			ff_return_value;
	crypto_session_id_t	ff_session;
} crypto_object_find_final_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

typedef struct crypto_object_create32 {
	uint32_t		oc_return_value;
	crypto_session_id_t	oc_session;
	crypto_object_id_t	oc_handle;
	uint32_t		oc_count;
	caddr32_t		oc_attributes;
} crypto_object_create32_t;

typedef struct crypto_object_copy32 {
	uint32_t		oc_return_value;
	crypto_session_id_t	oc_session;
	crypto_object_id_t	oc_handle;
	crypto_object_id_t	oc_new_handle;
	uint32_t		oc_count;
	caddr32_t		oc_new_attributes;
} crypto_object_copy32_t;

typedef struct crypto_object_destroy32 {
	uint32_t		od_return_value;
	crypto_session_id_t	od_session;
	crypto_object_id_t	od_handle;
} crypto_object_destroy32_t;

typedef struct crypto_object_get_attribute_value32 {
	uint32_t		og_return_value;
	crypto_session_id_t	og_session;
	crypto_object_id_t	og_handle;
	uint32_t		og_count;
	caddr32_t		og_attributes;
} crypto_object_get_attribute_value32_t;

typedef struct crypto_object_get_size32 {
	uint32_t		gs_return_value;
	crypto_session_id_t	gs_session;
	crypto_object_id_t	gs_handle;
	size32_t		gs_size;
} crypto_object_get_size32_t;

typedef struct crypto_object_set_attribute_value32 {
	uint32_t		sa_return_value;
	crypto_session_id_t	sa_session;
	crypto_object_id_t	sa_handle;
	uint32_t		sa_count;
	caddr32_t		sa_attributes;
} crypto_object_set_attribute_value32_t;

typedef struct crypto_object_find_init32 {
	uint32_t		fi_return_value;
	crypto_session_id_t	fi_session;
	uint32_t		fi_count;
	caddr32_t		fi_attributes;
} crypto_object_find_init32_t;

typedef struct crypto_object_find_update32 {
	uint32_t		fu_return_value;
	crypto_session_id_t	fu_session;
	uint32_t		fu_max_count;
	uint32_t		fu_count;
	caddr32_t		fu_handles;
} crypto_object_find_update32_t;

typedef struct crypto_object_find_final32 {
	uint32_t		ff_return_value;
	crypto_session_id_t	ff_session;
} crypto_object_find_final32_t;

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_OBJECT_CREATE			CRYPTO(100)
#define	CRYPTO_OBJECT_COPY			CRYPTO(101)
#define	CRYPTO_OBJECT_DESTROY			CRYPTO(102)
#define	CRYPTO_OBJECT_GET_ATTRIBUTE_VALUE	CRYPTO(103)
#define	CRYPTO_OBJECT_GET_SIZE			CRYPTO(104)
#define	CRYPTO_OBJECT_SET_ATTRIBUTE_VALUE	CRYPTO(105)
#define	CRYPTO_OBJECT_FIND_INIT			CRYPTO(106)
#define	CRYPTO_OBJECT_FIND_UPDATE		CRYPTO(107)
#define	CRYPTO_OBJECT_FIND_FINAL		CRYPTO(108)

/*
 * Key Generation Ioctls
 */
typedef struct crypto_object_generate_key {
	uint_t			gk_return_value;
	crypto_session_id_t	gk_session;
	crypto_object_id_t	gk_handle;
	crypto_mechanism_t	gk_mechanism;
	uint_t			gk_count;
	caddr_t			gk_attributes;
} crypto_object_generate_key_t;

typedef struct crypto_object_generate_key_pair {
	uint_t			kp_return_value;
	crypto_session_id_t	kp_session;
	crypto_object_id_t	kp_public_handle;
	crypto_object_id_t	kp_private_handle;
	uint_t			kp_public_count;
	uint_t			kp_private_count;
	caddr_t			kp_public_attributes;
	caddr_t			kp_private_attributes;
	crypto_mechanism_t	kp_mechanism;
} crypto_object_generate_key_pair_t;

typedef struct crypto_object_wrap_key {
	uint_t			wk_return_value;
	crypto_session_id_t	wk_session;
	crypto_mechanism_t	wk_mechanism;
	crypto_key_t		wk_wrapping_key;
	crypto_object_id_t	wk_object_handle;
	size_t			wk_wrapped_key_len;
	caddr_t			wk_wrapped_key;
} crypto_object_wrap_key_t;

typedef struct crypto_object_unwrap_key {
	uint_t			uk_return_value;
	crypto_session_id_t	uk_session;
	crypto_mechanism_t	uk_mechanism;
	crypto_key_t		uk_unwrapping_key;
	crypto_object_id_t	uk_object_handle;
	size_t			uk_wrapped_key_len;
	caddr_t			uk_wrapped_key;
	uint_t			uk_count;
	caddr_t			uk_attributes;
} crypto_object_unwrap_key_t;

typedef struct crypto_derive_key {
	uint_t			dk_return_value;
	crypto_session_id_t	dk_session;
	crypto_mechanism_t	dk_mechanism;
	crypto_key_t		dk_base_key;
	crypto_object_id_t	dk_object_handle;
	uint_t			dk_count;
	caddr_t			dk_attributes;
} crypto_derive_key_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_object_generate_key32 {
	uint32_t		gk_return_value;
	crypto_session_id_t	gk_session;
	crypto_object_id_t	gk_handle;
	crypto_mechanism32_t	gk_mechanism;
	uint32_t		gk_count;
	caddr32_t		gk_attributes;
} crypto_object_generate_key32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

typedef struct crypto_object_generate_key_pair32 {
	uint32_t		kp_return_value;
	crypto_session_id_t	kp_session;
	crypto_object_id_t	kp_public_handle;
	crypto_object_id_t	kp_private_handle;
	uint32_t		kp_public_count;
	uint32_t		kp_private_count;
	caddr32_t		kp_public_attributes;
	caddr32_t		kp_private_attributes;
	crypto_mechanism32_t	kp_mechanism;
} crypto_object_generate_key_pair32_t;

typedef struct crypto_object_wrap_key32 {
	uint32_t		wk_return_value;
	crypto_session_id_t	wk_session;
	crypto_mechanism32_t	wk_mechanism;
	crypto_key32_t		wk_wrapping_key;
	crypto_object_id_t	wk_object_handle;
	size32_t		wk_wrapped_key_len;
	caddr32_t		wk_wrapped_key;
} crypto_object_wrap_key32_t;

typedef struct crypto_object_unwrap_key32 {
	uint32_t		uk_return_value;
	crypto_session_id_t	uk_session;
	crypto_mechanism32_t	uk_mechanism;
	crypto_key32_t		uk_unwrapping_key;
	crypto_object_id_t	uk_object_handle;
	size32_t		uk_wrapped_key_len;
	caddr32_t		uk_wrapped_key;
	uint32_t		uk_count;
	caddr32_t		uk_attributes;
} crypto_object_unwrap_key32_t;

typedef struct crypto_derive_key32 {
	uint32_t		dk_return_value;
	crypto_session_id_t	dk_session;
	crypto_mechanism32_t	dk_mechanism;
	crypto_key32_t		dk_base_key;
	crypto_object_id_t	dk_object_handle;
	uint32_t		dk_count;
	caddr32_t		dk_attributes;
} crypto_derive_key32_t;

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_GENERATE_KEY		CRYPTO(110)
#define	CRYPTO_GENERATE_KEY_PAIR	CRYPTO(111)
#define	CRYPTO_WRAP_KEY			CRYPTO(112)
#define	CRYPTO_UNWRAP_KEY		CRYPTO(113)
#define	CRYPTO_DERIVE_KEY		CRYPTO(114)

/*
 * Provider Management Ioctls
 */

typedef struct crypto_get_provider_list {
	uint_t			pl_return_value;
	uint_t			pl_count;
	crypto_provider_entry_t	pl_list[1];
} crypto_get_provider_list_t;

typedef struct crypto_provider_data {
	uchar_t			pd_prov_desc[CRYPTO_PROVIDER_DESCR_MAX_LEN];
	uchar_t			pd_label[CRYPTO_EXT_SIZE_LABEL];
	uchar_t			pd_manufacturerID[CRYPTO_EXT_SIZE_MANUF];
	uchar_t			pd_model[CRYPTO_EXT_SIZE_MODEL];
	uchar_t			pd_serial_number[CRYPTO_EXT_SIZE_SERIAL];
	ulong_t			pd_flags;
	ulong_t			pd_max_session_count;
	ulong_t			pd_session_count;
	ulong_t			pd_max_rw_session_count;
	ulong_t			pd_rw_session_count;
	ulong_t			pd_max_pin_len;
	ulong_t			pd_min_pin_len;
	ulong_t			pd_total_public_memory;
	ulong_t			pd_free_public_memory;
	ulong_t			pd_total_private_memory;
	ulong_t			pd_free_private_memory;
	crypto_version_t	pd_hardware_version;
	crypto_version_t	pd_firmware_version;
	uchar_t			pd_time[CRYPTO_EXT_SIZE_TIME];
} crypto_provider_data_t;

typedef struct crypto_get_provider_info {
	uint_t			gi_return_value;
	crypto_provider_id_t	gi_provider_id;
	crypto_provider_data_t	gi_provider_data;
} crypto_get_provider_info_t;

typedef struct crypto_get_provider_mechanisms {
	uint_t			pm_return_value;
	crypto_provider_id_t	pm_provider_id;
	uint_t			pm_count;
	crypto_mech_name_t	pm_list[1];
} crypto_get_provider_mechanisms_t;

typedef struct crypto_get_provider_mechanism_info {
	uint_t			mi_return_value;
	crypto_provider_id_t	mi_provider_id;
	crypto_mech_name_t	mi_mechanism_name;
	uint32_t		mi_min_key_size;
	uint32_t		mi_max_key_size;
	uint32_t		mi_flags;
} crypto_get_provider_mechanism_info_t;

typedef struct crypto_init_token {
	uint_t			it_return_value;
	crypto_provider_id_t	it_provider_id;
	caddr_t			it_pin;
	size_t			it_pin_len;
	caddr_t			it_label;
} crypto_init_token_t;

typedef struct crypto_init_pin {
	uint_t			ip_return_value;
	crypto_session_id_t	ip_session;
	caddr_t			ip_pin;
	size_t			ip_pin_len;
} crypto_init_pin_t;

typedef struct crypto_set_pin {
	uint_t			sp_return_value;
	crypto_session_id_t	sp_session;
	caddr_t			sp_old_pin;
	size_t			sp_old_len;
	caddr_t			sp_new_pin;
	size_t			sp_new_len;
} crypto_set_pin_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

typedef struct crypto_get_provider_list32 {
	uint32_t		pl_return_value;
	uint32_t		pl_count;
	crypto_provider_entry_t pl_list[1];
} crypto_get_provider_list32_t;

typedef struct crypto_version32 {
	uchar_t	cv_major;
	uchar_t	cv_minor;
} crypto_version32_t;

typedef struct crypto_provider_data32 {
	uchar_t			pd_prov_desc[CRYPTO_PROVIDER_DESCR_MAX_LEN];
	uchar_t			pd_label[CRYPTO_EXT_SIZE_LABEL];
	uchar_t			pd_manufacturerID[CRYPTO_EXT_SIZE_MANUF];
	uchar_t			pd_model[CRYPTO_EXT_SIZE_MODEL];
	uchar_t			pd_serial_number[CRYPTO_EXT_SIZE_SERIAL];
	uint32_t		pd_flags;
	uint32_t		pd_max_session_count;
	uint32_t		pd_session_count;
	uint32_t		pd_max_rw_session_count;
	uint32_t		pd_rw_session_count;
	uint32_t		pd_max_pin_len;
	uint32_t		pd_min_pin_len;
	uint32_t		pd_total_public_memory;
	uint32_t		pd_free_public_memory;
	uint32_t		pd_total_private_memory;
	uint32_t		pd_free_private_memory;
	crypto_version32_t	pd_hardware_version;
	crypto_version32_t	pd_firmware_version;
	uchar_t			pd_time[CRYPTO_EXT_SIZE_TIME];
} crypto_provider_data32_t;

typedef struct crypto_get_provider_info32 {
	uint32_t		gi_return_value;
	crypto_provider_id_t	gi_provider_id;
	crypto_provider_data32_t gi_provider_data;
} crypto_get_provider_info32_t;

typedef struct crypto_get_provider_mechanisms32 {
	uint32_t		pm_return_value;
	crypto_provider_id_t	pm_provider_id;
	uint32_t		pm_count;
	crypto_mech_name_t	pm_list[1];
} crypto_get_provider_mechanisms32_t;

typedef struct crypto_init_token32 {
	uint32_t		it_return_value;
	crypto_provider_id_t	it_provider_id;
	caddr32_t		it_pin;
	size32_t		it_pin_len;
	caddr32_t		it_label;
} crypto_init_token32_t;

typedef struct crypto_init_pin32 {
	uint32_t		ip_return_value;
	crypto_session_id_t	ip_session;
	caddr32_t		ip_pin;
	size32_t		ip_pin_len;
} crypto_init_pin32_t;

typedef struct crypto_set_pin32 {
	uint32_t		sp_return_value;
	crypto_session_id_t	sp_session;
	caddr32_t		sp_old_pin;
	size32_t		sp_old_len;
	caddr32_t		sp_new_pin;
	size32_t		sp_new_len;
} crypto_set_pin32_t;

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_GET_PROVIDER_LIST		CRYPTO(120)
#define	CRYPTO_GET_PROVIDER_INFO		CRYPTO(121)
#define	CRYPTO_GET_PROVIDER_MECHANISMS		CRYPTO(122)
#define	CRYPTO_GET_PROVIDER_MECHANISM_INFO	CRYPTO(123)
#define	CRYPTO_INIT_TOKEN			CRYPTO(124)
#define	CRYPTO_INIT_PIN				CRYPTO(125)
#define	CRYPTO_SET_PIN				CRYPTO(126)

/*
 * No (Key) Store Key Generation Ioctls
 */
typedef struct crypto_nostore_generate_key {
	uint_t			ngk_return_value;
	crypto_session_id_t	ngk_session;
	crypto_mechanism_t	ngk_mechanism;
	uint_t			ngk_in_count;
	uint_t			ngk_out_count;
	caddr_t			ngk_in_attributes;
	caddr_t			ngk_out_attributes;
} crypto_nostore_generate_key_t;

typedef struct crypto_nostore_generate_key_pair {
	uint_t			nkp_return_value;
	crypto_session_id_t	nkp_session;
	uint_t			nkp_in_public_count;
	uint_t			nkp_in_private_count;
	uint_t			nkp_out_public_count;
	uint_t			nkp_out_private_count;
	caddr_t			nkp_in_public_attributes;
	caddr_t			nkp_in_private_attributes;
	caddr_t			nkp_out_public_attributes;
	caddr_t			nkp_out_private_attributes;
	crypto_mechanism_t	nkp_mechanism;
} crypto_nostore_generate_key_pair_t;

typedef struct crypto_nostore_derive_key {
	uint_t			ndk_return_value;
	crypto_session_id_t	ndk_session;
	crypto_mechanism_t	ndk_mechanism;
	crypto_key_t		ndk_base_key;
	uint_t			ndk_in_count;
	uint_t			ndk_out_count;
	caddr_t			ndk_in_attributes;
	caddr_t			ndk_out_attributes;
} crypto_nostore_derive_key_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

typedef struct crypto_nostore_generate_key32 {
	uint32_t		ngk_return_value;
	crypto_session_id_t	ngk_session;
	crypto_mechanism32_t	ngk_mechanism;
	uint32_t		ngk_in_count;
	uint32_t		ngk_out_count;
	caddr32_t		ngk_in_attributes;
	caddr32_t		ngk_out_attributes;
} crypto_nostore_generate_key32_t;

typedef struct crypto_nostore_generate_key_pair32 {
	uint32_t		nkp_return_value;
	crypto_session_id_t	nkp_session;
	uint32_t		nkp_in_public_count;
	uint32_t		nkp_in_private_count;
	uint32_t		nkp_out_public_count;
	uint32_t		nkp_out_private_count;
	caddr32_t		nkp_in_public_attributes;
	caddr32_t		nkp_in_private_attributes;
	caddr32_t		nkp_out_public_attributes;
	caddr32_t		nkp_out_private_attributes;
	crypto_mechanism32_t	nkp_mechanism;
} crypto_nostore_generate_key_pair32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack(4)
#endif

typedef struct crypto_nostore_derive_key32 {
	uint32_t		ndk_return_value;
	crypto_session_id_t	ndk_session;
	crypto_mechanism32_t	ndk_mechanism;
	crypto_key32_t		ndk_base_key;
	uint32_t		ndk_in_count;
	uint32_t		ndk_out_count;
	caddr32_t		ndk_in_attributes;
	caddr32_t		ndk_out_attributes;
} crypto_nostore_derive_key32_t;

#if _LONG_LONG_ALIGNMENT == 8 && _LONG_LONG_ALIGNMENT_32 == 4
#pragma pack()
#endif

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_NOSTORE_GENERATE_KEY		CRYPTO(127)
#define	CRYPTO_NOSTORE_GENERATE_KEY_PAIR	CRYPTO(128)
#define	CRYPTO_NOSTORE_DERIVE_KEY		CRYPTO(129)

/*
 * Mechanism Ioctls
 */

typedef struct crypto_get_mechanism_list {
	uint_t			ml_return_value;
	uint_t			ml_count;
	crypto_mech_name_t	ml_list[1];
} crypto_get_mechanism_list_t;

typedef struct crypto_get_all_mechanism_info {
	uint_t			mi_return_value;
	crypto_mech_name_t	mi_mechanism_name;
	uint_t			mi_count;
	crypto_mechanism_info_t	mi_list[1];
} crypto_get_all_mechanism_info_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

typedef struct crypto_get_mechanism_list32 {
	uint32_t		ml_return_value;
	uint32_t		ml_count;
	crypto_mech_name_t	ml_list[1];
} crypto_get_mechanism_list32_t;

typedef struct crypto_get_all_mechanism_info32 {
	uint32_t		mi_return_value;
	crypto_mech_name_t	mi_mechanism_name;
	uint32_t		mi_count;
	crypto_mechanism_info32_t mi_list[1];
} crypto_get_all_mechanism_info32_t;

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

#define	CRYPTO_GET_MECHANISM_LIST		CRYPTO(140)
#define	CRYPTO_GET_ALL_MECHANISM_INFO		CRYPTO(141)

#define	CRYPTO_GET_PROVIDER_BY_MECH		CRYPTO(142)

typedef struct crypto_by_mech {
	int rv;
	int res;
	crypto_mech_type_t mech_type;
	uint_t mech_keylen;
	crypto_func_group_t mech_fg;
	crypto_session_id_t session_id;
} crypto_by_mech_t;

#ifdef	__cplusplus
}
#endif

#endif	/* _SYS_CRYPTO_IOCTL_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef	_SYS_CRYPTO_IOCTLADMIN_H
#define	_SYS_CRYPTO_IOCTLADMIN_H

#ifdef	__cplusplus
extern "C" {
#endif

#include <sys/types.h>
#include <sys/crypto/common.h>

#define	ADMIN_IOCTL_DEVICE	"/dev/cryptoadm"

#define	CRYPTOADMIN(x)		(('y' << 8) | (x))

/*
 * Administrative IOCTLs
 */

typedef struct crypto_get_dev_list {
	uint_t			dl_return_value;
	uint_t			dl_dev_count;
	crypto_dev_list_entry_t	dl_devs[1];
} crypto_get_dev_list_t;

typedef struct crypto_get_soft_list {
	uint_t			sl_return_value;
	uint_t			sl_soft_count;
	size_t			sl_soft_len;
	caddr_t			sl_soft_names;
} crypto_get_soft_list_t;

typedef struct crypto_get_dev_info {
	uint_t			di_return_value;
	char			di_dev_name[MAXNAMELEN];
	uint_t			di_dev_instance;
	uint_t			di_count;
	crypto_mech_name_t	di_list[1];
} crypto_get_dev_info_t;

typedef struct crypto_get_soft_info {
	uint_t			si_return_value;
	char			si_name[MAXNAMELEN];
	uint_t			si_count;
	crypto_mech_name_t	si_list[1];
} crypto_get_soft_info_t;

typedef struct crypto_load_dev_disabled {
	uint_t			dd_return_value;
	char			dd_dev_name[MAXNAMELEN];
	uint_t			dd_dev_instance;
	uint_t			dd_count;
	crypto_mech_name_t	dd_list[1];
} crypto_load_dev_disabled_t;

typedef struct crypto_load_soft_disabled {
	uint_t			sd_return_value;
	char			sd_name[MAXNAMELEN];
	uint_t			sd_count;
	crypto_mech_name_t	sd_list[1];
} crypto_load_soft_disabled_t;

typedef struct crypto_unload_soft_module {
	uint_t			sm_return_value;
	char			sm_name[MAXNAMELEN];
} crypto_unload_soft_module_t;

typedef struct crypto_load_soft_config {
	uint_t			sc_return_value;
	char			sc_name[MAXNAMELEN];
	uint_t			sc_count;
	crypto_mech_name_t	sc_list[1];
} crypto_load_soft_config_t;

typedef struct crypto_load_door {
	uint_t			ld_return_value;
	uint_t			ld_did;
} crypto_load_door_t;

typedef struct crypto_fips140 {
	uint_t			fips140_return_value;
	uint_t			fips140_op;
	uint_t			fips140_status;
} crypto_fips140_t;

#ifdef	_KERNEL
#ifdef	_SYSCALL32

typedef struct crypto_get_soft_list32 {
	uint32_t		sl_return_value;
	uint32_t		sl_soft_count;
	size32_t		sl_soft_len;
	caddr32_t		sl_soft_names;
} crypto_get_soft_list32_t;

#endif	/* _SYSCALL32 */
#endif	/* _KERNEL */

/*
 * FIPS140 ioctl operations
 */
enum {
	FIPS140_STATUS,		/* get current fips140 mode */
	FIPS140_ENABLE,		/* enable fips140 mode */
	FIPS140_DISABLE		/* disable fips140 mode */


};

/*
 * FIPS140 Mode Status
 */
enum {
	FIPS140_MODE_UNSET,	 /* userland has not told us the mode */
	FIPS140_MODE_VALIDATING, /* In the process of validation to enable */
	FIPS140_MODE_SHUTDOWN,	 /* Failure has occurred, shutdown framework */
	FIPS140_MODE_ENABLED,	 /* Validation is complete and we are running */
	FIPS140_MODE_DISABLED	 /* Not running in FIPS 140 mode */
};

#define	CRYPTO_GET_VERSION		CRYPTOADMIN(1)
#define	CRYPTO_GET_DEV_LIST		CRYPTOADMIN(2)
#define	CRYPTO_GET_SOFT_LIST		CRYPTOADMIN(3)
#define	CRYPTO_GET_DEV_INFO		CRYPTOADMIN(4)
#define	CRYPTO_GET_SOFT_INFO		CRYPTOADMIN(5)
#define	CRYPTO_LOAD_DEV_DISABLED	CRYPTOADMIN(8)
#define	CRYPTO_LOAD_SOFT_DISABLED	CRYPTOADMIN(9)
#define	CRYPTO_UNLOAD_SOFT_MODULE	CRYPTOADMIN(10)
#define	CRYPTO_LOAD_SOFT_CONFIG		CRYPTOADMIN(11)
#define	CRYPTO_POOL_CREATE		CRYPTOADMIN(12)
#define	CRYPTO_POOL_WAIT		CRYPTOADMIN(13)
#define	CRYPTO_POOL_RUN			CRYPTOADMIN(14)
#define	CRYPTO_LOAD_DOOR		CRYPTOADMIN(15)
#define	CRYPTO_FIPS140_STATUS		CRYPTOADMIN(16)
#define	CRYPTO_FIPS140_SET		CRYPTOADMIN(17)

#ifdef	__cplusplus
}
#endif

#endif	/* _SYS_CRYPTO_IOCTLADMIN_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef _SYS_CRYPTO_OPS_IMPL_H
#define	_SYS_CRYPTO_OPS_IMPL_H

/*
 * Scheduler internal structures.
 */

#ifdef __cplusplus
extern "C" {
#endif

#include <sys/types.h>
#include <sys/mutex.h>
#include <sys/condvar.h>
#include <sys/crypto/api.h>
#include <sys/crypto/spi.h>
#include <sys/crypto/impl.h>
#include <sys/crypto/common.h>

/*
 * The parameters needed for each function group are batched
 * in one structure. This is much simpler than having a
 * separate structure for each function.
 *
 * In some cases, a field is generically named to keep the
 * structure small. The comments indicate these cases.
 */
typedef struct kcf_digest_ops_params {
	crypto_session_id_t	do_sid;
	crypto_mech_type_t	do_framework_mechtype;
	crypto_mechanism_t	do_mech;
	crypto_data_t		*do_data;
	crypto_data_t		*do_digest;
	crypto_key_t		*do_digest_key;	/* Argument for digest_key() */
} kcf_digest_ops_params_t;

typedef struct kcf_mac_ops_params {
	crypto_session_id_t		mo_sid;
	crypto_mech_type_t		mo_framework_mechtype;
	crypto_mechanism_t		mo_mech;
	crypto_key_t			*mo_key;
	crypto_data_t			*mo_data;
	crypto_data_t			*mo_mac;
	crypto_spi_ctx_template_t	mo_templ;
} kcf_mac_ops_params_t;

typedef struct kcf_encrypt_ops_params {
	crypto_session_id_t		eo_sid;
	crypto_mech_type_t		eo_framework_mechtype;
	crypto_mechanism_t		eo_mech;
	crypto_key_t			*eo_key;
	crypto_data_t			*eo_plaintext;
	crypto_data_t			*eo_ciphertext;
	crypto_spi_ctx_template_t	eo_templ;
} kcf_encrypt_ops_params_t;

typedef struct kcf_decrypt_ops_params {
	crypto_session_id_t		dop_sid;
	crypto_mech_type_t		dop_framework_mechtype;
	crypto_mechanism_t		dop_mech;
	crypto_key_t			*dop_key;
	crypto_data_t			*dop_ciphertext;
	crypto_data_t			*dop_plaintext;
	crypto_spi_ctx_template_t	dop_templ;
} kcf_decrypt_ops_params_t;

typedef struct kcf_sign_ops_params {
	crypto_session_id_t		so_sid;
	crypto_mech_type_t		so_framework_mechtype;
	crypto_mechanism_t		so_mech;
	crypto_key_t			*so_key;
	crypto_data_t			*so_data;
	crypto_data_t			*so_signature;
	crypto_spi_ctx_template_t	so_templ;
} kcf_sign_ops_params_t;

typedef struct kcf_verify_ops_params {
	crypto_session_id_t		vo_sid;
	crypto_mech_type_t		vo_framework_mechtype;
	crypto_mechanism_t		vo_mech;
	crypto_key_t			*vo_key;
	crypto_data_t			*vo_data;
	crypto_data_t			*vo_signature;
	crypto_spi_ctx_template_t	vo_templ;
} kcf_verify_ops_params_t;

typedef struct kcf_encrypt_mac_ops_params {
	crypto_session_id_t 		em_sid;
	crypto_mech_type_t		em_framework_encr_mechtype;
	crypto_mechanism_t		em_encr_mech;
	crypto_key_t			*em_encr_key;
	crypto_mech_type_t		em_framework_mac_mechtype;
	crypto_mechanism_t		em_mac_mech;
	crypto_key_t			*em_mac_key;
	crypto_data_t			*em_plaintext;
	crypto_dual_data_t		*em_ciphertext;
	crypto_data_t			*em_mac;
	crypto_spi_ctx_template_t	em_encr_templ;
	crypto_spi_ctx_template_t	em_mac_templ;
} kcf_encrypt_mac_ops_params_t;

typedef struct kcf_mac_decrypt_ops_params {
	crypto_session_id_t 		md_sid;
	crypto_mech_type_t		md_framework_mac_mechtype;
	crypto_mechanism_t		md_mac_mech;
	crypto_key_t			*md_mac_key;
	crypto_mech_type_t		md_framework_decr_mechtype;
	crypto_mechanism_t		md_decr_mech;
	crypto_key_t			*md_decr_key;
	crypto_dual_data_t		*md_ciphertext;
	crypto_data_t			*md_mac;
	crypto_data_t			*md_plaintext;
	crypto_spi_ctx_template_t	md_mac_templ;
	crypto_spi_ctx_template_t	md_decr_templ;
} kcf_mac_decrypt_ops_params_t;

typedef struct kcf_random_number_ops_params {
	crypto_session_id_t	rn_sid;
	uchar_t			*rn_buf;
	size_t			rn_buflen;
	uint_t			rn_entropy_est;
	uint32_t		rn_flags;
} kcf_random_number_ops_params_t;

/*
 * so_pd is useful when the provider descriptor (pd) supplying the
 * provider handle is different from the pd supplying the ops vector.
 * This is the case for session open/close where so_pd can be the pd
 * of a logical provider. The pd supplying the ops vector is passed
 * as an argument to kcf_submit_request().
 */
typedef struct kcf_session_ops_params {
	crypto_session_id_t	*so_sid_ptr;
	crypto_session_id_t	so_sid;
	crypto_user_type_t	so_user_type;
	char			*so_pin;
	size_t			so_pin_len;
	kcf_provider_desc_t	*so_pd;
} kcf_session_ops_params_t;

typedef struct kcf_object_ops_params {
	crypto_session_id_t		oo_sid;
	crypto_object_id_t		oo_object_id;
	crypto_object_attribute_t	*oo_template;
	uint_t 				oo_attribute_count;
	crypto_object_id_t		*oo_object_id_ptr;
	size_t				*oo_object_size;
	void				**oo_find_init_pp_ptr;
	void				*oo_find_pp;
	uint_t				oo_max_object_count;
	uint_t				*oo_object_count_ptr;
} kcf_object_ops_params_t;

/*
 * ko_key is used to encode wrapping key in key_wrap() and
 * unwrapping key in key_unwrap(). ko_key_template and
 * ko_key_attribute_count are used to encode public template
 * and public template attr count in key_generate_pair().
 * kops->ko_key_object_id_ptr is used to encode public key
 * in key_generate_pair().
 */
typedef struct kcf_key_ops_params {
	crypto_session_id_t		ko_sid;
	crypto_mech_type_t		ko_framework_mechtype;
	crypto_mechanism_t		ko_mech;
	crypto_object_attribute_t	*ko_key_template;
	uint_t				ko_key_attribute_count;
	crypto_object_id_t		*ko_key_object_id_ptr;
	crypto_object_attribute_t	*ko_private_key_template;
	uint_t				ko_private_key_attribute_count;
	crypto_object_id_t		*ko_private_key_object_id_ptr;
	crypto_key_t			*ko_key;
	uchar_t				*ko_wrapped_key;
	size_t				*ko_wrapped_key_len_ptr;
	crypto_object_attribute_t	*ko_out_template1;
	crypto_object_attribute_t	*ko_out_template2;
	uint_t				ko_out_attribute_count1;
	uint_t				ko_out_attribute_count2;
} kcf_key_ops_params_t;

/*
 * po_pin and po_pin_len are used to encode new_pin and new_pin_len
 * when wrapping set_pin() function parameters.
 *
 * po_pd is useful when the provider descriptor (pd) supplying the
 * provider handle is different from the pd supplying the ops vector.
 * This is true for the ext_info provider entry point where po_pd
 * can be the pd of a logical provider. The pd supplying the ops vector
 * is passed as an argument to kcf_submit_request().
 */
typedef struct kcf_provmgmt_ops_params {
	crypto_session_id_t 		po_sid;
	char				*po_pin;
	size_t				po_pin_len;
	char				*po_old_pin;
	size_t				po_old_pin_len;
	char				*po_label;
	crypto_provider_ext_info_t	*po_ext_info;
	kcf_provider_desc_t		*po_pd;
} kcf_provmgmt_ops_params_t;

/*
 * The operation type within a function group.
 */
typedef enum kcf_op_type {
	/* common ops for all mechanisms */
	KCF_OP_INIT = 1,
	KCF_OP_SINGLE,	/* pkcs11 sense. So, INIT is already done */
	KCF_OP_UPDATE,
	KCF_OP_FINAL,
	KCF_OP_ATOMIC,

	/* digest_key op */
	KCF_OP_DIGEST_KEY,

	/* mac specific op */
	KCF_OP_MAC_VERIFY_ATOMIC,

	/* mac/cipher specific op */
	KCF_OP_MAC_VERIFY_DECRYPT_ATOMIC,

	/* sign_recover ops */
	KCF_OP_SIGN_RECOVER_INIT,
	KCF_OP_SIGN_RECOVER,
	KCF_OP_SIGN_RECOVER_ATOMIC,

	/* verify_recover ops */
	KCF_OP_VERIFY_RECOVER_INIT,
	KCF_OP_VERIFY_RECOVER,
	KCF_OP_VERIFY_RECOVER_ATOMIC,

	/* random number ops */
	KCF_OP_RANDOM_SEED,
	KCF_OP_RANDOM_GENERATE,

	/* session management ops */
	KCF_OP_SESSION_OPEN,
	KCF_OP_SESSION_CLOSE,
	KCF_OP_SESSION_LOGIN,
	KCF_OP_SESSION_LOGOUT,

	/* object management ops */
	KCF_OP_OBJECT_CREATE,
	KCF_OP_OBJECT_COPY,
	KCF_OP_OBJECT_DESTROY,
	KCF_OP_OBJECT_GET_SIZE,
	KCF_OP_OBJECT_GET_ATTRIBUTE_VALUE,
	KCF_OP_OBJECT_SET_ATTRIBUTE_VALUE,
	KCF_OP_OBJECT_FIND_INIT,
	KCF_OP_OBJECT_FIND,
	KCF_OP_OBJECT_FIND_FINAL,

	/* key management ops */
	KCF_OP_KEY_GENERATE,
	KCF_OP_KEY_GENERATE_PAIR,
	KCF_OP_KEY_WRAP,
	KCF_OP_KEY_UNWRAP,
	KCF_OP_KEY_DERIVE,
	KCF_OP_KEY_CHECK,

	/* provider management ops */
	KCF_OP_MGMT_EXTINFO,
	KCF_OP_MGMT_INITTOKEN,
	KCF_OP_MGMT_INITPIN,
	KCF_OP_MGMT_SETPIN
} kcf_op_type_t;

/*
 * The operation groups that need wrapping of parameters. This is somewhat
 * similar to the function group type in spi.h except that this also includes
 * all the functions that don't have a mechanism.
 *
 * The wrapper macros should never take these enum values as an argument.
 * Rather, they are assigned in the macro itself since they are known
 * from the macro name.
 */
typedef enum kcf_op_group {
	KCF_OG_DIGEST = 1,
	KCF_OG_MAC,
	KCF_OG_ENCRYPT,
	KCF_OG_DECRYPT,
	KCF_OG_SIGN,
	KCF_OG_VERIFY,
	KCF_OG_ENCRYPT_MAC,
	KCF_OG_MAC_DECRYPT,
	KCF_OG_RANDOM,
	KCF_OG_SESSION,
	KCF_OG_OBJECT,
	KCF_OG_KEY,
	KCF_OG_PROVMGMT,
	KCF_OG_NOSTORE_KEY
} kcf_op_group_t;

/*
 * The kcf_op_type_t enum values used here should be only for those
 * operations for which there is a k-api routine in sys/crypto/api.h.
 */
#define	IS_INIT_OP(ftype)	((ftype) == KCF_OP_INIT)
#define	IS_SINGLE_OP(ftype)	((ftype) == KCF_OP_SINGLE)
#define	IS_UPDATE_OP(ftype)	((ftype) == KCF_OP_UPDATE)
#define	IS_FINAL_OP(ftype)	((ftype) == KCF_OP_FINAL)
#define	IS_ATOMIC_OP(ftype)	( \
	(ftype) == KCF_OP_ATOMIC || (ftype) == KCF_OP_MAC_VERIFY_ATOMIC || \
	(ftype) == KCF_OP_MAC_VERIFY_DECRYPT_ATOMIC || \
	(ftype) == KCF_OP_SIGN_RECOVER_ATOMIC || \
	(ftype) == KCF_OP_VERIFY_RECOVER_ATOMIC)

/*
 * Keep the parameters associated with a request around.
 * We need to pass them to the SPI.
 */
typedef struct kcf_req_params {
	kcf_op_group_t		rp_opgrp;
	kcf_op_type_t		rp_optype;

	union {
		kcf_digest_ops_params_t		digest_params;
		kcf_mac_ops_params_t		mac_params;
		kcf_encrypt_ops_params_t	encrypt_params;
		kcf_decrypt_ops_params_t	decrypt_params;
		kcf_sign_ops_params_t		sign_params;
		kcf_verify_ops_params_t		verify_params;
		kcf_encrypt_mac_ops_params_t	encrypt_mac_params;
		kcf_mac_decrypt_ops_params_t	mac_decrypt_params;
		kcf_random_number_ops_params_t	random_number_params;
		kcf_session_ops_params_t	session_params;
		kcf_object_ops_params_t		object_params;
		kcf_key_ops_params_t		key_params;
		kcf_provmgmt_ops_params_t	provmgmt_params;
	} rp_u;
} kcf_req_params_t;


/*
 * The ioctl/k-api code should bundle the parameters into a kcf_req_params_t
 * structure before calling a scheduler routine. The following macros are
 * available for that purpose.
 *
 * For the most part, the macro arguments closely correspond to the
 * function parameters. In some cases, we use generic names. The comments
 * for the structure should indicate these cases.
 */
#define	KCF_WRAP_DIGEST_OPS_PARAMS(req, ftype, _sid, _mech, _key,	\
	_data, _digest) {						\
	kcf_digest_ops_params_t *dops = &(req)->rp_u.digest_params;	\
	crypto_mechanism_t *mechp = _mech;				\
									\
	(req)->rp_opgrp = KCF_OG_DIGEST;				\
	(req)->rp_optype = ftype;					\
	dops->do_sid = _sid;						\
	if (mechp != NULL) {						\
		dops->do_mech = *mechp;					\
		dops->do_framework_mechtype = mechp->cm_type;		\
	}								\
	dops->do_digest_key = _key;					\
	dops->do_data = _data;						\
	dops->do_digest = _digest;					\
}

#define	KCF_WRAP_MAC_OPS_PARAMS(req, ftype, _sid, _mech, _key,		\
	_data, _mac, _templ) {						\
	kcf_mac_ops_params_t *mops = &(req)->rp_u.mac_params;		\
	crypto_mechanism_t *mechp = _mech;				\
									\
	(req)->rp_opgrp = KCF_OG_MAC;					\
	(req)->rp_optype = ftype;					\
	mops->mo_sid = _sid;						\
	if (mechp != NULL) {						\
		mops->mo_mech = *mechp;					\
		mops->mo_framework_mechtype = mechp->cm_type;		\
	}								\
	mops->mo_key = _key;						\
	mops->mo_data = _data;						\
	mops->mo_mac = _mac;						\
	mops->mo_templ = _templ;					\
}

#define	KCF_WRAP_ENCRYPT_OPS_PARAMS(req, ftype, _sid, _mech, _key,	\
	_plaintext, _ciphertext, _templ) {				\
	kcf_encrypt_ops_params_t *cops = &(req)->rp_u.encrypt_params;	\
	crypto_mechanism_t *mechp = _mech;				\
									\
	(req)->rp_opgrp = KCF_OG_ENCRYPT;				\
	(req)->rp_optype = ftype;					\
	cops->eo_sid = _sid;						\
	if (mechp != NULL) {						\
		cops->eo_mech = *mechp;					\
		cops->eo_framework_mechtype = mechp->cm_type;		\
	}								\
	cops->eo_key = _key;						\
	cops->eo_plaintext = _plaintext;				\
	cops->eo_ciphertext = _ciphertext;				\
	cops->eo_templ = _templ;					\
}

#define	KCF_WRAP_DECRYPT_OPS_PARAMS(req, ftype, _sid, _mech, _key,	\
	_ciphertext, _plaintext, _templ) {				\
	kcf_decrypt_ops_params_t *cops = &(req)->rp_u.decrypt_params;	\
	crypto_mechanism_t *mechp = _mech;				\
									\
	(req)->rp_opgrp = KCF_OG_DECRYPT;				\
	(req)->rp_optype = ftype;					\
	cops->dop_sid = _sid;						\
	if (mechp != NULL) {						\
		cops->dop_mech = *mechp;				\
		cops->dop_framework_mechtype = mechp->cm_type;		\
	}								\
	cops->dop_key = _key;						\
	cops->dop_ciphertext = _ciphertext;				\
	cops->dop_plaintext = _plaintext;				\
	cops->dop_templ = _templ;					\
}

#define	KCF_WRAP_SIGN_OPS_PARAMS(req, ftype, _sid, _mech, _key,		\
	_data, _signature, _templ) {					\
	kcf_sign_ops_params_t *sops = &(req)->rp_u.sign_params;		\
	crypto_mechanism_t *mechp = _mech;				\
									\
	(req)->rp_opgrp = KCF_OG_SIGN;					\
	(req)->rp_optype = ftype;					\
	sops->so_sid = _sid;						\
	if (mechp != NULL) {						\
		sops->so_mech = *mechp;					\
		sops->so_framework_mechtype = mechp->cm_type;		\
	}								\
	sops->so_key = _key;						\
	sops->so_data = _data;						\
	sops->so_signature = _signature;				\
	sops->so_templ = _templ;					\
}

#define	KCF_WRAP_VERIFY_OPS_PARAMS(req, ftype, _sid, _mech, _key,	\
	_data, _signature, _templ) {					\
	kcf_verify_ops_params_t *vops = &(req)->rp_u.verify_params;	\
	crypto_mechanism_t *mechp = _mech;				\
									\
	(req)->rp_opgrp = KCF_OG_VERIFY;				\
	(req)->rp_optype = ftype;					\
	vops->vo_sid = _sid;						\
	if (mechp != NULL) {						\
		vops->vo_mech = *mechp;					\
		vops->vo_framework_mechtype = mechp->cm_type;		\
	}								\
	vops->vo_key = _key;						\
	vops->vo_data = _data;						\
	vops->vo_signature = _signature;				\
	vops->vo_templ = _templ;					\
}

#define	KCF_WRAP_ENCRYPT_MAC_OPS_PARAMS(req, ftype, _sid, _encr_key,	\
	_mac_key, _plaintext, _ciphertext, _mac, _encr_templ, _mac_templ) { \
	kcf_encrypt_mac_ops_params_t *cmops = &(req)->rp_u.encrypt_mac_params; \
									\
	(req)->rp_opgrp = KCF_OG_ENCRYPT_MAC;				\
	(req)->rp_optype = ftype;					\
	cmops->em_sid = _sid;						\
	cmops->em_encr_key = _encr_key;					\
	cmops->em_mac_key = _mac_key;					\
	cmops->em_plaintext = _plaintext;				\
	cmops->em_ciphertext = _ciphertext;				\
	cmops->em_mac = _mac;						\
	cmops->em_encr_templ = _encr_templ;				\
	cmops->em_mac_templ = _mac_templ;				\
}

#define	KCF_WRAP_MAC_DECRYPT_OPS_PARAMS(req, ftype, _sid, _mac_key,	\
	_decr_key, _ciphertext, _mac, _plaintext, _mac_templ, _decr_templ) { \
	kcf_mac_decrypt_ops_params_t *cmops = &(req)->rp_u.mac_decrypt_params; \
									\
	(req)->rp_opgrp = KCF_OG_MAC_DECRYPT;				\
	(req)->rp_optype = ftype;					\
	cmops->md_sid = _sid;						\
	cmops->md_mac_key = _mac_key;					\
	cmops->md_decr_key = _decr_key;					\
	cmops->md_ciphertext = _ciphertext;				\
	cmops->md_mac = _mac;						\
	cmops->md_plaintext = _plaintext;				\
	cmops->md_mac_templ = _mac_templ;				\
	cmops->md_decr_templ = _decr_templ;				\
}

#define	KCF_WRAP_RANDOM_OPS_PARAMS(req, ftype, _sid, _buf, _buflen,	\
	_est, _flags) {							\
	kcf_random_number_ops_params_t *rops =				\
		&(req)->rp_u.random_number_params;			\
									\
	(req)->rp_opgrp = KCF_OG_RANDOM;				\
	(req)->rp_optype = ftype;					\
	rops->rn_sid = _sid;						\
	rops->rn_buf = _buf;						\
	rops->rn_buflen = _buflen;					\
	rops->rn_entropy_est = _est;					\
	rops->rn_flags = _flags;					\
}

#define	KCF_WRAP_SESSION_OPS_PARAMS(req, ftype, _sid_ptr, _sid,		\
	_user_type, _pin, _pin_len, _pd) {				\
	kcf_session_ops_params_t *sops = &(req)->rp_u.session_params;	\
									\
	(req)->rp_opgrp = KCF_OG_SESSION;				\
	(req)->rp_optype = ftype;					\
	sops->so_sid_ptr = _sid_ptr;					\
	sops->so_sid = _sid;						\
	sops->so_user_type = _user_type;				\
	sops->so_pin = _pin;						\
	sops->so_pin_len = _pin_len;					\
	sops->so_pd = _pd;						\
}

#define	KCF_WRAP_OBJECT_OPS_PARAMS(req, ftype, _sid, _object_id,	\
	_template, _attribute_count, _object_id_ptr, _object_size,	\
	_find_init_pp_ptr, _find_pp, _max_object_count, _object_count_ptr) { \
	kcf_object_ops_params_t *jops = &(req)->rp_u.object_params;	\
									\
	(req)->rp_opgrp = KCF_OG_OBJECT;				\
	(req)->rp_optype = ftype;					\
	jops->oo_sid = _sid;						\
	jops->oo_object_id = _object_id;				\
	jops->oo_template = _template;					\
	jops->oo_attribute_count = _attribute_count;			\
	jops->oo_object_id_ptr = _object_id_ptr;			\
	jops->oo_object_size = _object_size;				\
	jops->oo_find_init_pp_ptr = _find_init_pp_ptr;			\
	jops->oo_find_pp = _find_pp;					\
	jops->oo_max_object_count = _max_object_count;			\
	jops->oo_object_count_ptr = _object_count_ptr;			\
}

#define	KCF_WRAP_KEY_OPS_PARAMS(req, ftype, _sid, _mech, _key_template, \
	_key_attribute_count, _key_object_id_ptr, _private_key_template, \
	_private_key_attribute_count, _private_key_object_id_ptr,	\
	_key, _wrapped_key, _wrapped_key_len_ptr) {			\
	kcf_key_ops_params_t *kops = &(req)->rp_u.key_params;		\
	crypto_mechanism_t *mechp = _mech;				\
									\
	(req)->rp_opgrp = KCF_OG_KEY;					\
	(req)->rp_optype = ftype;					\
	kops->ko_sid = _sid;						\
	if (mechp != NULL) {						\
		kops->ko_mech = *mechp;					\
		kops->ko_framework_mechtype = mechp->cm_type;		\
	}								\
	kops->ko_key_template = _key_template;				\
	kops->ko_key_attribute_count = _key_attribute_count;		\
	kops->ko_key_object_id_ptr = _key_object_id_ptr;		\
	kops->ko_private_key_template = _private_key_template;		\
	kops->ko_private_key_attribute_count = _private_key_attribute_count; \
	kops->ko_private_key_object_id_ptr = _private_key_object_id_ptr; \
	kops->ko_key = _key;						\
	kops->ko_wrapped_key = _wrapped_key;				\
	kops->ko_wrapped_key_len_ptr = _wrapped_key_len_ptr;		\
}

#define	KCF_WRAP_PROVMGMT_OPS_PARAMS(req, ftype, _sid, _old_pin,	\
	_old_pin_len, _pin, _pin_len, _label, _ext_info, _pd) {		\
	kcf_provmgmt_ops_params_t *pops = &(req)->rp_u.provmgmt_params;	\
									\
	(req)->rp_opgrp = KCF_OG_PROVMGMT;				\
	(req)->rp_optype = ftype;					\
	pops->po_sid = _sid;						\
	pops->po_pin = _pin;						\
	pops->po_pin_len = _pin_len;					\
	pops->po_old_pin = _old_pin;					\
	pops->po_old_pin_len = _old_pin_len;				\
	pops->po_label = _label;					\
	pops->po_ext_info = _ext_info;					\
	pops->po_pd = _pd;						\
}

#define	KCF_WRAP_NOSTORE_KEY_OPS_PARAMS(req, ftype, _sid, _mech,	\
	_key_template, _key_attribute_count, _private_key_template,	\
	_private_key_attribute_count, _key, _out_template1,		\
	_out_attribute_count1, _out_template2, _out_attribute_count2) {	\
	kcf_key_ops_params_t *kops = &(req)->rp_u.key_params;		\
	crypto_mechanism_t *mechp = _mech;				\
									\
	(req)->rp_opgrp = KCF_OG_NOSTORE_KEY;				\
	(req)->rp_optype = ftype;					\
	kops->ko_sid = _sid;						\
	if (mechp != NULL) {						\
		kops->ko_mech = *mechp;					\
		kops->ko_framework_mechtype = mechp->cm_type;		\
	}								\
	kops->ko_key_template = _key_template;				\
	kops->ko_key_attribute_count = _key_attribute_count;		\
	kops->ko_key_object_id_ptr = NULL;				\
	kops->ko_private_key_template = _private_key_template;		\
	kops->ko_private_key_attribute_count = _private_key_attribute_count; \
	kops->ko_private_key_object_id_ptr = NULL;			\
	kops->ko_key = _key;						\
	kops->ko_wrapped_key = NULL;					\
	kops->ko_wrapped_key_len_ptr = 0;				\
	kops->ko_out_template1 = _out_template1;			\
	kops->ko_out_template2 = _out_template2;			\
	kops->ko_out_attribute_count1 = _out_attribute_count1;		\
	kops->ko_out_attribute_count2 = _out_attribute_count2;		\
}

#define	KCF_SET_PROVIDER_MECHNUM(fmtype, pd, mechp)			\
	(mechp)->cm_type =						\
	    KCF_TO_PROV_MECHNUM(pd, fmtype);

#ifdef __cplusplus
}
#endif

#endif /* _SYS_CRYPTO_OPS_IMPL_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
 */

#ifndef _SYS_CRYPTO_SCHED_IMPL_H
#define	_SYS_CRYPTO_SCHED_IMPL_H

/*
 * Scheduler internal structures.
 */

#ifdef __cplusplus
extern "C" {
#endif

#include <sys/types.h>
#include <sys/mutex.h>
#include <sys/condvar.h>
#include <sys/door.h>
#include <sys/crypto/api.h>
#include <sys/crypto/spi.h>
#include <sys/crypto/impl.h>
#include <sys/crypto/common.h>
#include <sys/crypto/ops_impl.h>

typedef void (kcf_func_t)(void *, int);

typedef enum kcf_req_status {
	REQ_ALLOCATED = 1,
	REQ_WAITING,		/* At the framework level */
	REQ_INPROGRESS,		/* At the provider level */
	REQ_DONE,
	REQ_CANCELED
} kcf_req_status_t;

typedef enum kcf_call_type {
	CRYPTO_SYNCH = 1,
	CRYPTO_ASYNCH
} kcf_call_type_t;

#define	CHECK_FASTPATH(crq, pd) ((crq) == NULL ||	\
	!((crq)->cr_flag & CRYPTO_ALWAYS_QUEUE)) &&	\
	(pd)->pd_prov_type == CRYPTO_SW_PROVIDER

#define	KCF_KMFLAG(crq)	(((crq) == NULL) ? KM_SLEEP : KM_NOSLEEP)

/*
 * The framework keeps an internal handle to use in the adaptive
 * asynchronous case. This is the case when a client has the
 * CRYPTO_ALWAYS_QUEUE bit clear and a software provider is used for
 * the request. The request is completed in the context of the calling
 * thread and kernel memory must be allocated with KM_NOSLEEP.
 *
 * The framework passes a pointer to the handle in crypto_req_handle_t
 * argument when it calls the SPI of the software provider. The macros
 * KCF_RHNDL() and KCF_SWFP_RHNDL() are used to do this.
 *
 * When a provider asks the framework for kmflag value via
 * crypto_kmflag(9S) we use REQHNDL2_KMFLAG() macro.
 */
extern ulong_t kcf_swprov_hndl;
#define	KCF_RHNDL(kmflag) (((kmflag) == KM_SLEEP) ? NULL : &kcf_swprov_hndl)
#define	KCF_SWFP_RHNDL(crq) (((crq) == NULL) ? NULL : &kcf_swprov_hndl)
#define	REQHNDL2_KMFLAG(rhndl) \
	((rhndl == &kcf_swprov_hndl) ? KM_NOSLEEP : KM_SLEEP)

/* Internal call_req flags. They start after the public ones in api.h */

#define	CRYPTO_SETDUAL	0x00001000	/* Set the 'cont' boolean before */
					/* submitting the request */
#define	KCF_ISDUALREQ(crq)	\
	(((crq) == NULL) ? B_FALSE : (crq->cr_flag & CRYPTO_SETDUAL))

typedef struct kcf_prov_tried {
	kcf_provider_desc_t	*pt_pd;
	struct kcf_prov_tried	*pt_next;
} kcf_prov_tried_t;

/* Must be different from KM_SLEEP and KM_NOSLEEP */
#define	KCF_HOLD_PROV	0x1000

#define	IS_FG_SUPPORTED(mdesc, fg)		\
	(((mdesc)->pm_mech_info.cm_func_group_mask & (fg)) != 0)

#define	IS_PROVIDER_TRIED(pd, tlist)		\
	(tlist != NULL && is_in_triedlist(pd, tlist))

#define	IS_RECOVERABLE(error)			\
	(error == CRYPTO_BUFFER_TOO_BIG ||	\
	error == CRYPTO_BUSY ||			\
	error == CRYPTO_DEVICE_ERROR ||		\
	error == CRYPTO_DEVICE_MEMORY ||	\
	error == CRYPTO_KEY_SIZE_RANGE ||	\
	error == CRYPTO_NO_PERMISSION)

#define	KCF_ATOMIC_INCR(x)	atomic_inc_32(&(x))
#define	KCF_ATOMIC_DECR(x)	atomic_dec_32(&(x))

/*
 * Node structure for synchronous requests.
 */
typedef struct kcf_sreq_node {
	/* Should always be the first field in this structure */
	kcf_call_type_t		sn_type;
	/*
	 * sn_cv and sr_lock are used to wait for the
	 * operation to complete. sn_lock also protects
	 * the sn_state field.
	 */
	kcondvar_t		sn_cv;
	kmutex_t		sn_lock;
	kcf_req_status_t	sn_state;

	/*
	 * Return value from the operation. This will be
	 * one of the CRYPTO_* errors defined in common.h.
	 */
	int			sn_rv;

	/*
	 * parameters to call the SPI with. This can be
	 * a pointer as we know the caller context/stack stays.
	 */
	struct kcf_req_params	*sn_params;

	/* Internal context for this request */
	struct kcf_context	*sn_context;

	/* Provider handling this request */
	kcf_provider_desc_t	*sn_provider;

	kcf_prov_cpu_t		*sn_mp;
} kcf_sreq_node_t;

/*
 * Node structure for asynchronous requests. A node can be on
 * on a chain of requests hanging of the internal context
 * structure and can be in the global software provider queue.
 */
typedef struct kcf_areq_node {
	/* Should always be the first field in this structure */
	kcf_call_type_t		an_type;

	/* an_lock protects the field an_state  */
	kmutex_t		an_lock;
	kcf_req_status_t	an_state;
	crypto_call_req_t	an_reqarg;

	/*
	 * parameters to call the SPI with. We need to
	 * save the params since the caller stack can go away.
	 */
	struct kcf_req_params	an_params;

	/*
	 * The next two fields should be NULL for operations that
	 * don't need a context.
	 */
	/* Internal context for this request */
	struct kcf_context	*an_context;

	/* next in chain of requests for context */
	struct kcf_areq_node	*an_ctxchain_next;

	kcondvar_t		an_turn_cv;
	boolean_t		an_is_my_turn;
	boolean_t		an_isdual;	/* for internal reuse */

	/*
	 * Next and previous nodes in the global software
	 * queue. These fields are NULL for a hardware
	 * provider since we use a taskq there.
	 */
	struct kcf_areq_node	*an_next;
	struct kcf_areq_node	*an_prev;

	/* Provider handling this request */
	kcf_provider_desc_t	*an_provider;
	kcf_prov_cpu_t		*an_mp;
	kcf_prov_tried_t	*an_tried_plist;

	struct kcf_areq_node	*an_idnext;	/* Next in ID hash */
	struct kcf_areq_node	*an_idprev;	/* Prev in ID hash */
	kcondvar_t		an_done;	/* Signal request completion */
	uint_t			an_refcnt;
} kcf_areq_node_t;

#define	KCF_AREQ_REFHOLD(areq) {		\
	atomic_inc_32(&(areq)->an_refcnt);	\
	ASSERT((areq)->an_refcnt != 0);		\
}

#define	KCF_AREQ_REFRELE(areq) {				\
	ASSERT((areq)->an_refcnt != 0);				\
	membar_exit();						\
	if (atomic_dec_32_nv(&(areq)->an_refcnt) == 0)	\
		kcf_free_req(areq);				\
}

#define	GET_REQ_TYPE(arg) *((kcf_call_type_t *)(arg))

#define	NOTIFY_CLIENT(areq, err) (*(areq)->an_reqarg.cr_callback_func)(\
	(areq)->an_reqarg.cr_callback_arg, err);

/* For internally generated call requests for dual operations */
typedef	struct kcf_call_req {
	crypto_call_req_t	kr_callreq;	/* external client call req */
	kcf_req_params_t	kr_params;	/* Params saved for next call */
	kcf_areq_node_t		*kr_areq;	/* Use this areq */
	off_t			kr_saveoffset;
	size_t			kr_savelen;
} kcf_dual_req_t;

/*
 * The following are some what similar to macros in callo.h, which implement
 * callout tables.
 *
 * The lower four bits of the ID are used to encode the table ID to
 * index in to. The REQID_COUNTER_HIGH bit is used to avoid any check for
 * wrap around when generating ID. We assume that there won't be a request
 * which takes more time than 2^^(sizeof (long) - 5) other requests submitted
 * after it. This ensures there won't be any ID collision.
 */
#define	REQID_COUNTER_HIGH	(1UL << (8 * sizeof (long) - 1))
#define	REQID_COUNTER_SHIFT	4
#define	REQID_COUNTER_LOW	(1 << REQID_COUNTER_SHIFT)
#define	REQID_TABLES		16
#define	REQID_TABLE_MASK	(REQID_TABLES - 1)

#define	REQID_BUCKETS		512
#define	REQID_BUCKET_MASK	(REQID_BUCKETS - 1)
#define	REQID_HASH(id)	(((id) >> REQID_COUNTER_SHIFT) & REQID_BUCKET_MASK)

#define	GET_REQID(areq) (areq)->an_reqarg.cr_reqid
#define	SET_REQID(areq, val)	GET_REQID(areq) = val

/*
 * Hash table for async requests.
 */
typedef struct kcf_reqid_table {
	kmutex_t		rt_lock;
	crypto_req_id_t		rt_curid;
	kcf_areq_node_t		*rt_idhash[REQID_BUCKETS];
} kcf_reqid_table_t;

/*
 * Global software provider queue structure. Requests to be
 * handled by a SW provider and have the ALWAYS_QUEUE flag set
 * get queued here.
 */
typedef struct kcf_global_swq {
	/*
	 * gs_cv and gs_lock are used to wait for new requests.
	 * gs_lock protects the changes to the queue.
	 */
	kcondvar_t		gs_cv;
	kmutex_t		gs_lock;
	uint_t			gs_njobs;
	uint_t			gs_maxjobs;
	kcf_areq_node_t		*gs_first;
	kcf_areq_node_t		*gs_last;
} kcf_global_swq_t;


/*
 * Internal representation of a canonical context. We contain crypto_ctx_t
 * structure in order to have just one memory allocation. The SPI
 * ((crypto_ctx_t *)ctx)->cc_framework_private maps to this structure.
 */
typedef struct kcf_context {
	crypto_ctx_t		kc_glbl_ctx;
	uint_t			kc_refcnt;
	kmutex_t		kc_in_use_lock;
	/*
	 * kc_req_chain_first and kc_req_chain_last are used to chain
	 * multiple async requests using the same context. They should be
	 * NULL for sync requests.
	 */
	kcf_areq_node_t		*kc_req_chain_first;
	kcf_areq_node_t		*kc_req_chain_last;
	kcf_provider_desc_t	*kc_prov_desc;	/* Prov. descriptor */
	kcf_provider_desc_t	*kc_sw_prov_desc;	/* Prov. descriptor */
	kcf_mech_entry_t	*kc_mech;
	struct kcf_context	*kc_secondctx;	/* for dual contexts */
} kcf_context_t;

/*
 * Bump up the reference count on the framework private context. A
 * global context or a request that references this structure should
 * do a hold.
 */
#define	KCF_CONTEXT_REFHOLD(ictx) {		\
	atomic_inc_32(&(ictx)->kc_refcnt);	\
	ASSERT((ictx)->kc_refcnt != 0);		\
}

/*
 * Decrement the reference count on the framework private context.
 * When the last reference is released, the framework private
 * context structure is freed along with the global context.
 */
#define	KCF_CONTEXT_REFRELE(ictx) {				\
	ASSERT((ictx)->kc_refcnt != 0);				\
	membar_exit();						\
	if (atomic_dec_32_nv(&(ictx)->kc_refcnt) == 0)	\
		kcf_free_context(ictx);				\
}

/*
 * Check if we can release the context now. In case of CRYPTO_QUEUED
 * we do not release it as we can do it only after the provider notified
 * us. In case of CRYPTO_BUSY, the client can retry the request using
 * the context, so we do not release the context.
 *
 * This macro should be called only from the final routine in
 * an init/update/final sequence. We do not release the context in case
 * of update operations. We require the consumer to free it
 * explicitly, in case it wants to abandon the operation. This is done
 * as there may be mechanisms in ECB mode that can continue even if
 * an operation on a block fails.
 */
#define	KCF_CONTEXT_COND_RELEASE(rv, kcf_ctx) {			\
	if (KCF_CONTEXT_DONE(rv))				\
		KCF_CONTEXT_REFRELE(kcf_ctx);			\
}

/*
 * This macro determines whether we're done with a context.
 */
#define	KCF_CONTEXT_DONE(rv)					\
	((rv) != CRYPTO_QUEUED && (rv) != CRYPTO_BUSY &&	\
	    (rv) != CRYPTO_BUFFER_TOO_SMALL)

/*
 * A crypto_ctx_template_t is internally a pointer to this struct
 */
typedef	struct kcf_ctx_template {
	crypto_kcf_provider_handle_t	ct_prov_handle;	/* provider handle */
	uint_t				ct_generation;	/* generation # */
	size_t				ct_size;	/* for freeing */
	crypto_spi_ctx_template_t	ct_prov_tmpl;	/* context template */
							/* from the SW prov */
} kcf_ctx_template_t;

/*
 * Structure for pool of threads working on global software queue.
 */
typedef struct kcf_pool {
	uint32_t	kp_threads;		/* Number of threads in pool */
	uint32_t	kp_idlethreads;		/* Idle threads in pool */
	uint32_t	kp_blockedthreads;	/* Blocked threads in pool */

	/*
	 * cv & lock for the condition where more threads need to be created.
	 */
	kcondvar_t	kp_cv;		/* Creator cond. variable */
	kmutex_t	kp_lock;		/* Creator lock */

} kcf_pool_t;


/*
 * State of a crypto bufcall element.
 */
typedef enum cbuf_state {
	CBUF_FREE = 1,
	CBUF_WAITING,
	CBUF_RUNNING
} cbuf_state_t;

/*
 * Structure of a crypto bufcall element.
 */
typedef struct kcf_cbuf_elem {
	/*
	 * lock and cv to wait for CBUF_RUNNING to be done
	 * kc_lock also protects kc_state.
	 */
	kmutex_t		kc_lock;
	kcondvar_t		kc_cv;
	cbuf_state_t		kc_state;

	struct kcf_cbuf_elem	*kc_next;
	struct kcf_cbuf_elem	*kc_prev;

	void			(*kc_func)(void *arg);
	void			*kc_arg;
} kcf_cbuf_elem_t;

/*
 * State of a notify element.
 */
typedef enum ntfy_elem_state {
	NTFY_WAITING = 1,
	NTFY_RUNNING
} ntfy_elem_state_t;

/*
 * Structure of a notify list element.
 */
typedef struct kcf_ntfy_elem {
	/*
	 * lock and cv to wait for NTFY_RUNNING to be done.
	 * kn_lock also protects kn_state.
	 */
	kmutex_t			kn_lock;
	kcondvar_t			kn_cv;
	ntfy_elem_state_t		kn_state;

	struct kcf_ntfy_elem		*kn_next;
	struct kcf_ntfy_elem		*kn_prev;

	crypto_notify_callback_t	kn_func;
	uint32_t			kn_event_mask;
} kcf_ntfy_elem_t;


/*
 * The following values are based on the assumption that it would
 * take around eight cpus to load a hardware provider (This is true for
 * at least one product) and a kernel client may come from different
 * low-priority interrupt levels. We will have CYRPTO_TASKQ_MIN number
 * of cached taskq entries. The CRYPTO_TASKQ_MAX number is based on
 * a throughput of 1GB/s using 512-byte buffers. These are just
 * reasonable estimates and might need to change in future.
 */
#define	CRYPTO_TASKQ_THREADS	8
#define	CYRPTO_TASKQ_MIN	64
#define	CRYPTO_TASKQ_MAX	2 * 1024 * 1024

extern int crypto_taskq_threads;
extern int crypto_taskq_minalloc;
extern int crypto_taskq_maxalloc;
extern kcf_global_swq_t *gswq;
extern int kcf_maxthreads;
extern int kcf_minthreads;

/*
 * All pending crypto bufcalls are put on a list. cbuf_list_lock
 * protects changes to this list.
 */
extern kmutex_t cbuf_list_lock;
extern kcondvar_t cbuf_list_cv;

/*
 * All event subscribers are put on a list. kcf_notify_list_lock
 * protects changes to this list.
 */
extern kmutex_t ntfy_list_lock;
extern kcondvar_t ntfy_list_cv;

boolean_t kcf_get_next_logical_provider_member(kcf_provider_desc_t *,
    kcf_provider_desc_t *, kcf_provider_desc_t **);
extern int kcf_get_hardware_provider(crypto_mech_type_t, crypto_key_t *,
    crypto_mech_type_t, crypto_key_t *,
    kcf_provider_desc_t *, kcf_provider_desc_t **,
    crypto_func_group_t);
extern int kcf_get_hardware_provider_nomech(offset_t, offset_t,
    kcf_provider_desc_t *, kcf_provider_desc_t **);
extern void kcf_free_triedlist(kcf_prov_tried_t *);
extern kcf_prov_tried_t *kcf_insert_triedlist(kcf_prov_tried_t **,
    kcf_provider_desc_t *, int);
extern kcf_provider_desc_t *kcf_get_mech_provider(crypto_mech_type_t,
    crypto_key_t *, kcf_mech_entry_t **, int *, kcf_prov_tried_t *,
    crypto_func_group_t, size_t);
extern kcf_provider_desc_t *kcf_get_dual_provider(crypto_mechanism_t *,
    crypto_key_t *, crypto_mechanism_t *, crypto_key_t *,
    kcf_mech_entry_t **, crypto_mech_type_t *,
    crypto_mech_type_t *, int *, kcf_prov_tried_t *,
    crypto_func_group_t, crypto_func_group_t, size_t);
extern crypto_ctx_t *kcf_new_ctx(crypto_call_req_t  *, kcf_provider_desc_t *,
    crypto_session_id_t);
extern int kcf_submit_request(kcf_provider_desc_t *, crypto_ctx_t *,
    crypto_call_req_t *, kcf_req_params_t *, boolean_t);
extern void kcf_sched_init(void);
extern void kcf_sched_start(void);
extern void kcf_sop_done(kcf_sreq_node_t *, int);
extern void kcf_aop_done(kcf_areq_node_t *, int);
extern int common_submit_request(kcf_provider_desc_t *,
    crypto_ctx_t *, kcf_req_params_t *, crypto_req_handle_t);
extern void kcf_free_context(kcf_context_t *);

extern struct modctl *kcf_get_modctl(crypto_provider_info_t *);
extern void kcf_free_req(kcf_areq_node_t *areq);
extern void crypto_bufcall_service(void);

extern void kcf_walk_ntfylist(uint32_t, void *);
extern void kcf_do_notify(kcf_provider_desc_t *, boolean_t);

extern kcf_dual_req_t *kcf_alloc_req(crypto_call_req_t *);
extern void kcf_next_req(void *, int);
extern void kcf_last_req(void *, int);

#ifdef __cplusplus
}
#endif

#endif /* _SYS_CRYPTO_SCHED_IMPL_H */
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef	_SYS_CRYPTO_SPI_H
#define	_SYS_CRYPTO_SPI_H

/*
 * CSPI: Cryptographic Service Provider Interface.
 */

#include <sys/types.h>
#include <sys/dditypes.h>
#include <sys/ddi.h>
#include <sys/kmem.h>
#include <sys/crypto/common.h>

#ifdef	__cplusplus
extern "C" {
#endif

#ifdef	_KERNEL

#define	CRYPTO_SPI_VERSION_1	1
#define	CRYPTO_SPI_VERSION_2	2
#define	CRYPTO_SPI_VERSION_3	3
#define	CRYPTO_SPI_VERSION_4	4

/*
 * Provider-private handle. This handle is specified by a provider
 * when it registers by means of the pi_provider_handle field of
 * the crypto_provider_info structure, and passed to the provider
 * when its entry points are invoked.
 */
typedef void *crypto_provider_handle_t;

/*
 * Context templates can be used to by software providers to pre-process
 * keying material, such as key schedules. They are allocated by
 * a software provider create_ctx_template(9E) entry point, and passed
 * as argument to initialization and atomic provider entry points.
 */
typedef void *crypto_spi_ctx_template_t;

/*
 * Request handles are used by the kernel to identify an asynchronous
 * request being processed by a provider. It is passed by the kernel
 * to a hardware provider when submitting a request, and must be
 * specified by a provider when calling crypto_op_notification(9F)
 */
typedef void *crypto_req_handle_t;

/* Values for cc_flags field */
#define	CRYPTO_INIT_OPSTATE	0x00000001 /* allocate and init cc_opstate */
#define	CRYPTO_USE_OPSTATE	0x00000002 /* .. start using it as context */

/*
 * The context structure is passed from the kernel to a provider.
 * It contains the information needed to process a multi-part or
 * single part operation. The context structure is not used
 * by atomic operations.
 *
 * Parameters needed to perform a cryptographic operation, such
 * as keys, mechanisms, input and output buffers, are passed
 * as separate arguments to Provider routines.
 */
typedef struct crypto_ctx {
	crypto_provider_handle_t cc_provider;
	crypto_session_id_t	cc_session;
	void			*cc_provider_private;	/* owned by provider */
	void			*cc_framework_private;	/* owned by framework */
	uint32_t		cc_flags;		/* flags */
	void			*cc_opstate;		/* state */
} crypto_ctx_t;

/*
 * Extended provider information.
 */

/*
 * valid values for ei_flags field of extended info structure
 * They match the RSA Security, Inc PKCS#11 tokenInfo flags.
 */
#define	CRYPTO_EXTF_RNG					0x00000001
#define	CRYPTO_EXTF_WRITE_PROTECTED			0x00000002
#define	CRYPTO_EXTF_LOGIN_REQUIRED			0x00000004
#define	CRYPTO_EXTF_USER_PIN_INITIALIZED		0x00000008
#define	CRYPTO_EXTF_CLOCK_ON_TOKEN			0x00000040
#define	CRYPTO_EXTF_PROTECTED_AUTHENTICATION_PATH	0x00000100
#define	CRYPTO_EXTF_DUAL_CRYPTO_OPERATIONS		0x00000200
#define	CRYPTO_EXTF_TOKEN_INITIALIZED			0x00000400
#define	CRYPTO_EXTF_USER_PIN_COUNT_LOW			0x00010000
#define	CRYPTO_EXTF_USER_PIN_FINAL_TRY			0x00020000
#define	CRYPTO_EXTF_USER_PIN_LOCKED			0x00040000
#define	CRYPTO_EXTF_USER_PIN_TO_BE_CHANGED		0x00080000
#define	CRYPTO_EXTF_SO_PIN_COUNT_LOW			0x00100000
#define	CRYPTO_EXTF_SO_PIN_FINAL_TRY			0x00200000
#define	CRYPTO_EXTF_SO_PIN_LOCKED			0x00400000
#define	CRYPTO_EXTF_SO_PIN_TO_BE_CHANGED		0x00800000

/*
 * The crypto_control_ops structure contains pointers to control
 * operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_control_ops {
	void (*provider_status)(crypto_provider_handle_t, uint_t *);
} crypto_control_ops_t;

/*
 * The crypto_ctx_ops structure contains points to context and context
 * templates management operations for cryptographic providers. It is
 * passed through the crypto_ops(9S) structure when providers register
 * with the kernel using crypto_register_provider(9F).
 */
typedef struct crypto_ctx_ops {
	int (*create_ctx_template)(crypto_provider_handle_t,
	    crypto_mechanism_t *, crypto_key_t *,
	    crypto_spi_ctx_template_t *, size_t *, crypto_req_handle_t);
	int (*free_context)(crypto_ctx_t *);
} crypto_ctx_ops_t;

/*
 * The crypto_digest_ops structure contains pointers to digest
 * operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_digest_ops {
	int (*digest_init)(crypto_ctx_t *, crypto_mechanism_t *,
	    crypto_req_handle_t);
	int (*digest)(crypto_ctx_t *, crypto_data_t *, crypto_data_t *,
	    crypto_req_handle_t);
	int (*digest_update)(crypto_ctx_t *, crypto_data_t *,
	    crypto_req_handle_t);
	int (*digest_key)(crypto_ctx_t *, crypto_key_t *, crypto_req_handle_t);
	int (*digest_final)(crypto_ctx_t *, crypto_data_t *,
	    crypto_req_handle_t);
	int (*digest_atomic)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_data_t *,
	    crypto_data_t *, crypto_req_handle_t);
} crypto_digest_ops_t;

/*
 * The crypto_cipher_ops structure contains pointers to encryption
 * and decryption operations for cryptographic providers.  It is
 * passed through the crypto_ops(9S) structure when providers register
 * with the kernel using crypto_register_provider(9F).
 */
typedef struct crypto_cipher_ops {
	int (*encrypt_init)(crypto_ctx_t *,
	    crypto_mechanism_t *, crypto_key_t *,
	    crypto_spi_ctx_template_t, crypto_req_handle_t);
	int (*encrypt)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*encrypt_update)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*encrypt_final)(crypto_ctx_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*encrypt_atomic)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
	    crypto_data_t *, crypto_spi_ctx_template_t, crypto_req_handle_t);

	int (*decrypt_init)(crypto_ctx_t *,
	    crypto_mechanism_t *, crypto_key_t *,
	    crypto_spi_ctx_template_t, crypto_req_handle_t);
	int (*decrypt)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*decrypt_update)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*decrypt_final)(crypto_ctx_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*decrypt_atomic)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
	    crypto_data_t *, crypto_spi_ctx_template_t, crypto_req_handle_t);
} crypto_cipher_ops_t;

/*
 * The crypto_mac_ops structure contains pointers to MAC
 * operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_mac_ops {
	int (*mac_init)(crypto_ctx_t *,
	    crypto_mechanism_t *, crypto_key_t *,
	    crypto_spi_ctx_template_t, crypto_req_handle_t);
	int (*mac)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*mac_update)(crypto_ctx_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*mac_final)(crypto_ctx_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*mac_atomic)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
	    crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
	int (*mac_verify_atomic)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
	    crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
} crypto_mac_ops_t;

/*
 * The crypto_sign_ops structure contains pointers to signing
 * operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_sign_ops {
	int (*sign_init)(crypto_ctx_t *,
	    crypto_mechanism_t *, crypto_key_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
	int (*sign)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*sign_update)(crypto_ctx_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*sign_final)(crypto_ctx_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*sign_atomic)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
	    crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
	int (*sign_recover_init)(crypto_ctx_t *, crypto_mechanism_t *,
	    crypto_key_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
	int (*sign_recover)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*sign_recover_atomic)(crypto_provider_handle_t,
	    crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *,
	    crypto_data_t *, crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
} crypto_sign_ops_t;

/*
 * The crypto_verify_ops structure contains pointers to verify
 * operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_verify_ops {
	int (*verify_init)(crypto_ctx_t *,
	    crypto_mechanism_t *, crypto_key_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
	int (*verify)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*verify_update)(crypto_ctx_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*verify_final)(crypto_ctx_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*verify_atomic)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
	    crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
	int (*verify_recover_init)(crypto_ctx_t *, crypto_mechanism_t *,
	    crypto_key_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
	int (*verify_recover)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*verify_recover_atomic)(crypto_provider_handle_t,
	    crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *,
	    crypto_data_t *, crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_req_handle_t);
} crypto_verify_ops_t;

/*
 * The crypto_dual_ops structure contains pointers to dual
 * cipher and sign/verify operations for cryptographic providers.
 * It is passed through the crypto_ops(9S) structure when
 * providers register with the kernel using
 * crypto_register_provider(9F).
 */
typedef struct crypto_dual_ops {
	int (*digest_encrypt_update)(
	    crypto_ctx_t *, crypto_ctx_t *, crypto_data_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*decrypt_digest_update)(
	    crypto_ctx_t *, crypto_ctx_t *, crypto_data_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*sign_encrypt_update)(
	    crypto_ctx_t *, crypto_ctx_t *, crypto_data_t *,
	    crypto_data_t *, crypto_req_handle_t);
	int (*decrypt_verify_update)(
	    crypto_ctx_t *, crypto_ctx_t *, crypto_data_t *,
	    crypto_data_t *, crypto_req_handle_t);
} crypto_dual_ops_t;

/*
 * The crypto_dual_cipher_mac_ops structure contains pointers to dual
 * cipher and MAC operations for cryptographic providers.
 * It is passed through the crypto_ops(9S) structure when
 * providers register with the kernel using
 * crypto_register_provider(9F).
 */
typedef struct crypto_dual_cipher_mac_ops {
	int (*encrypt_mac_init)(crypto_ctx_t *,
	    crypto_mechanism_t *, crypto_key_t *, crypto_mechanism_t *,
	    crypto_key_t *, crypto_spi_ctx_template_t,
	    crypto_spi_ctx_template_t, crypto_req_handle_t);
	int (*encrypt_mac)(crypto_ctx_t *,
	    crypto_data_t *, crypto_dual_data_t *, crypto_data_t *,
	    crypto_req_handle_t);
	int (*encrypt_mac_update)(crypto_ctx_t *,
	    crypto_data_t *, crypto_dual_data_t *, crypto_req_handle_t);
	int (*encrypt_mac_final)(crypto_ctx_t *,
	    crypto_dual_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*encrypt_mac_atomic)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_mechanism_t *,
	    crypto_key_t *, crypto_data_t *, crypto_dual_data_t *,
	    crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_spi_ctx_template_t, crypto_req_handle_t);

	int (*mac_decrypt_init)(crypto_ctx_t *,
	    crypto_mechanism_t *, crypto_key_t *, crypto_mechanism_t *,
	    crypto_key_t *, crypto_spi_ctx_template_t,
	    crypto_spi_ctx_template_t, crypto_req_handle_t);
	int (*mac_decrypt)(crypto_ctx_t *,
	    crypto_dual_data_t *, crypto_data_t *, crypto_data_t *,
	    crypto_req_handle_t);
	int (*mac_decrypt_update)(crypto_ctx_t *,
	    crypto_dual_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*mac_decrypt_final)(crypto_ctx_t *,
	    crypto_data_t *, crypto_data_t *, crypto_req_handle_t);
	int (*mac_decrypt_atomic)(crypto_provider_handle_t,
	    crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *,
	    crypto_mechanism_t *, crypto_key_t *, crypto_dual_data_t *,
	    crypto_data_t *, crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_spi_ctx_template_t, crypto_req_handle_t);
	int (*mac_verify_decrypt_atomic)(crypto_provider_handle_t,
	    crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *,
	    crypto_mechanism_t *, crypto_key_t *, crypto_dual_data_t *,
	    crypto_data_t *, crypto_data_t *, crypto_spi_ctx_template_t,
	    crypto_spi_ctx_template_t, crypto_req_handle_t);
} crypto_dual_cipher_mac_ops_t;

/*
 * The crypto_random_number_ops structure contains pointers to random
 * number operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_random_number_ops {
	int (*seed_random)(crypto_provider_handle_t, crypto_session_id_t,
	    uchar_t *, size_t, uint_t, uint32_t, crypto_req_handle_t);
	int (*generate_random)(crypto_provider_handle_t, crypto_session_id_t,
	    uchar_t *, size_t, crypto_req_handle_t);
} crypto_random_number_ops_t;

/*
 * Flag values for seed_random.
 */
#define	CRYPTO_SEED_NOW		0x00000001

/*
 * The crypto_session_ops structure contains pointers to session
 * operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_session_ops {
	int (*session_open)(crypto_provider_handle_t, crypto_session_id_t *,
	    crypto_req_handle_t);
	int (*session_close)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_req_handle_t);
	int (*session_login)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_user_type_t, char *, size_t, crypto_req_handle_t);
	int (*session_logout)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_req_handle_t);
} crypto_session_ops_t;

/*
 * The crypto_object_ops structure contains pointers to object
 * operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_object_ops {
	int (*object_create)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_object_attribute_t *, uint_t, crypto_object_id_t *,
	    crypto_req_handle_t);
	int (*object_copy)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_object_id_t, crypto_object_attribute_t *, uint_t,
	    crypto_object_id_t *, crypto_req_handle_t);
	int (*object_destroy)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_object_id_t, crypto_req_handle_t);
	int (*object_get_size)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_object_id_t, size_t *, crypto_req_handle_t);
	int (*object_get_attribute_value)(crypto_provider_handle_t,
	    crypto_session_id_t, crypto_object_id_t,
	    crypto_object_attribute_t *, uint_t, crypto_req_handle_t);
	int (*object_set_attribute_value)(crypto_provider_handle_t,
	    crypto_session_id_t, crypto_object_id_t,
	    crypto_object_attribute_t *,  uint_t, crypto_req_handle_t);
	int (*object_find_init)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_object_attribute_t *, uint_t, void **,
	    crypto_req_handle_t);
	int (*object_find)(crypto_provider_handle_t, void *,
	    crypto_object_id_t *, uint_t, uint_t *, crypto_req_handle_t);
	int (*object_find_final)(crypto_provider_handle_t, void *,
	    crypto_req_handle_t);
} crypto_object_ops_t;

/*
 * The crypto_key_ops structure contains pointers to key
 * operations for cryptographic providers.  It is passed through
 * the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_key_ops {
	int (*key_generate)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_object_attribute_t *, uint_t,
	    crypto_object_id_t *, crypto_req_handle_t);
	int (*key_generate_pair)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_object_attribute_t *, uint_t,
	    crypto_object_attribute_t *, uint_t, crypto_object_id_t *,
	    crypto_object_id_t *, crypto_req_handle_t);
	int (*key_wrap)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_object_id_t *,
	    uchar_t *, size_t *, crypto_req_handle_t);
	int (*key_unwrap)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, uchar_t *, size_t *,
	    crypto_object_attribute_t *, uint_t,
	    crypto_object_id_t *, crypto_req_handle_t);
	int (*key_derive)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_object_attribute_t *,
	    uint_t, crypto_object_id_t *, crypto_req_handle_t);
	int (*key_check)(crypto_provider_handle_t, crypto_mechanism_t *,
	    crypto_key_t *);
} crypto_key_ops_t;

/*
 * The crypto_provider_management_ops structure contains pointers
 * to management operations for cryptographic providers.  It is passed
 * through the crypto_ops(9S) structure when providers register with the
 * kernel using crypto_register_provider(9F).
 */
typedef struct crypto_provider_management_ops {
	int (*ext_info)(crypto_provider_handle_t,
	    crypto_provider_ext_info_t *, crypto_req_handle_t);
	int (*init_token)(crypto_provider_handle_t, char *, size_t,
	    char *, crypto_req_handle_t);
	int (*init_pin)(crypto_provider_handle_t, crypto_session_id_t,
	    char *, size_t, crypto_req_handle_t);
	int (*set_pin)(crypto_provider_handle_t, crypto_session_id_t,
	    char *, size_t, char *, size_t, crypto_req_handle_t);
} crypto_provider_management_ops_t;

typedef struct crypto_mech_ops {
	int (*copyin_mechanism)(crypto_provider_handle_t,
	    crypto_mechanism_t *, crypto_mechanism_t *, int *, int);
	int (*copyout_mechanism)(crypto_provider_handle_t,
	    crypto_mechanism_t *, crypto_mechanism_t *, int *, int);
	int (*free_mechanism)(crypto_provider_handle_t, crypto_mechanism_t *);
} crypto_mech_ops_t;

typedef struct crypto_nostore_key_ops {
	int (*nostore_key_generate)(crypto_provider_handle_t,
	    crypto_session_id_t, crypto_mechanism_t *,
	    crypto_object_attribute_t *, uint_t, crypto_object_attribute_t *,
	    uint_t, crypto_req_handle_t);
	int (*nostore_key_generate_pair)(crypto_provider_handle_t,
	    crypto_session_id_t, crypto_mechanism_t *,
	    crypto_object_attribute_t *, uint_t, crypto_object_attribute_t *,
	    uint_t, crypto_object_attribute_t *, uint_t,
	    crypto_object_attribute_t *, uint_t, crypto_req_handle_t);
	int (*nostore_key_derive)(crypto_provider_handle_t, crypto_session_id_t,
	    crypto_mechanism_t *, crypto_key_t *, crypto_object_attribute_t *,
	    uint_t, crypto_object_attribute_t *, uint_t, crypto_req_handle_t);
} crypto_nostore_key_ops_t;

/*
 * crypto_fips140_ops provides a function for FIPS 140 Power-On Self Test for
 * those providers that are part of the Cryptographic Framework bounday.  See
 * crypto_fips140_ops(9s) for details.
 */
typedef struct crypto_fips140_ops {
	void (*fips140_post)(int *);
} crypto_fips140_ops_t;

/*
 * The crypto_ops(9S) structure contains the structures containing
 * the pointers to functions implemented by cryptographic providers.
 * It is specified as part of the crypto_provider_info(9S)
 * supplied by a provider when it registers with the kernel
 * by calling crypto_register_provider(9F).
 */
typedef struct crypto_ops_v1 {
	crypto_control_ops_t			*co_control_ops;
	crypto_digest_ops_t			*co_digest_ops;
	crypto_cipher_ops_t			*co_cipher_ops;
	crypto_mac_ops_t			*co_mac_ops;
	crypto_sign_ops_t			*co_sign_ops;
	crypto_verify_ops_t			*co_verify_ops;
	crypto_dual_ops_t			*co_dual_ops;
	crypto_dual_cipher_mac_ops_t		*co_dual_cipher_mac_ops;
	crypto_random_number_ops_t		*co_random_ops;
	crypto_session_ops_t			*co_session_ops;
	crypto_object_ops_t			*co_object_ops;
	crypto_key_ops_t			*co_key_ops;
	crypto_provider_management_ops_t	*co_provider_ops;
	crypto_ctx_ops_t			*co_ctx_ops;
} crypto_ops_v1_t;

typedef struct crypto_ops_v2 {
	crypto_ops_v1_t				v1_ops;
	crypto_mech_ops_t			*co_mech_ops;
} crypto_ops_v2_t;

typedef struct crypto_ops_v3 {
	crypto_ops_v2_t				v2_ops;
	crypto_nostore_key_ops_t		*co_nostore_key_ops;
} crypto_ops_v3_t;

typedef struct crypto_ops_v4 {
	crypto_ops_v3_t				v3_ops;
	crypto_fips140_ops_t			*co_fips140_ops;
} crypto_ops_v4_t;

typedef struct crypto_ops {
	union {
		crypto_ops_v4_t	cou_v4;
		crypto_ops_v3_t	cou_v3;
		crypto_ops_v2_t	cou_v2;
		crypto_ops_v1_t	cou_v1;
	} cou;
} crypto_ops_t;

#define	co_control_ops			cou.cou_v1.co_control_ops
#define	co_digest_ops			cou.cou_v1.co_digest_ops
#define	co_cipher_ops			cou.cou_v1.co_cipher_ops
#define	co_mac_ops			cou.cou_v1.co_mac_ops
#define	co_sign_ops			cou.cou_v1.co_sign_ops
#define	co_verify_ops			cou.cou_v1.co_verify_ops
#define	co_dual_ops			cou.cou_v1.co_dual_ops
#define	co_dual_cipher_mac_ops		cou.cou_v1.co_dual_cipher_mac_ops
#define	co_random_ops			cou.cou_v1.co_random_ops
#define	co_session_ops			cou.cou_v1.co_session_ops
#define	co_object_ops			cou.cou_v1.co_object_ops
#define	co_key_ops			cou.cou_v1.co_key_ops
#define	co_provider_ops			cou.cou_v1.co_provider_ops
#define	co_ctx_ops			cou.cou_v1.co_ctx_ops
#define	co_mech_ops			cou.cou_v2.co_mech_ops
#define	co_nostore_key_ops		cou.cou_v3.co_nostore_key_ops
#define	co_fips140_ops			cou.cou_v4.co_fips140_ops

/*
 * Provider device specification passed during registration.
 *
 * Software providers set the pi_provider_type field of provider_info_t
 * to CRYPTO_SW_PROVIDER, and set the pd_sw field of
 * crypto_provider_dev_t to the address of their modlinkage.
 *
 * Hardware providers set the pi_provider_type field of provider_info_t
 * to CRYPTO_HW_PROVIDER, and set the pd_hw field of
 * crypto_provider_dev_t to the dev_info structure corresponding
 * to the device instance being registered.
 *
 * Logical providers set the pi_provider_type field of provider_info_t
 * to CRYPTO_LOGICAL_PROVIDER, and set the pd_hw field of
 * crypto_provider_dev_t to the dev_info structure corresponding
 * to the device instance being registered.
 */

typedef union crypto_provider_dev {
	struct modlinkage	*pd_sw; /* for CRYPTO_SW_PROVIDER */
	dev_info_t		*pd_hw; /* for CRYPTO_HW_PROVIDER */
} crypto_provider_dev_t;

#endif /* _KERNEL */

/*
 * The mechanism info structure crypto_mech_info_t contains a function group
 * bit mask cm_func_group_mask. This field, of type crypto_func_group_t,
 * specifies the provider entry point that can be used a particular
 * mechanism. The function group mask is a combination of the following values.
 */

typedef uint32_t crypto_func_group_t;

#define	CRYPTO_FG_ENCRYPT		0x00000001 /* encrypt_init() */
#define	CRYPTO_FG_DECRYPT		0x00000002 /* decrypt_init() */
#define	CRYPTO_FG_DIGEST		0x00000004 /* digest_init() */
#define	CRYPTO_FG_SIGN			0x00000008 /* sign_init() */
#define	CRYPTO_FG_SIGN_RECOVER		0x00000010 /* sign_recover_init() */
#define	CRYPTO_FG_VERIFY		0x00000020 /* verify_init() */
#define	CRYPTO_FG_VERIFY_RECOVER	0x00000040 /* verify_recover_init() */
#define	CRYPTO_FG_GENERATE		0x00000080 /* key_generate() */
#define	CRYPTO_FG_GENERATE_KEY_PAIR	0x00000100 /* key_generate_pair() */
#define	CRYPTO_FG_WRAP			0x00000200 /* key_wrap() */
#define	CRYPTO_FG_UNWRAP		0x00000400 /* key_unwrap() */
#define	CRYPTO_FG_DERIVE		0x00000800 /* key_derive() */
#define	CRYPTO_FG_MAC			0x00001000 /* mac_init() */
#define	CRYPTO_FG_ENCRYPT_MAC		0x00002000 /* encrypt_mac_init() */
#define	CRYPTO_FG_MAC_DECRYPT		0x00004000 /* decrypt_mac_init() */
#define	CRYPTO_FG_ENCRYPT_ATOMIC	0x00008000 /* encrypt_atomic() */
#define	CRYPTO_FG_DECRYPT_ATOMIC	0x00010000 /* decrypt_atomic() */
#define	CRYPTO_FG_MAC_ATOMIC		0x00020000 /* mac_atomic() */
#define	CRYPTO_FG_DIGEST_ATOMIC		0x00040000 /* digest_atomic() */
#define	CRYPTO_FG_SIGN_ATOMIC		0x00080000 /* sign_atomic() */
#define	CRYPTO_FG_SIGN_RECOVER_ATOMIC   0x00100000 /* sign_recover_atomic() */
#define	CRYPTO_FG_VERIFY_ATOMIC		0x00200000 /* verify_atomic() */
#define	CRYPTO_FG_VERIFY_RECOVER_ATOMIC	0x00400000 /* verify_recover_atomic() */
#define	CRYPTO_FG_ENCRYPT_MAC_ATOMIC	0x00800000 /* encrypt_mac_atomic() */
#define	CRYPTO_FG_MAC_DECRYPT_ATOMIC	0x01000000 /* mac_decrypt_atomic() */
#define	CRYPTO_FG_RESERVED		0x80000000

/*
 * Maximum length of the pi_provider_description field of the
 * crypto_provider_info structure.
 */
#define	CRYPTO_PROVIDER_DESCR_MAX_LEN	64

#ifdef _KERNEL

/* Bit mask for all the simple operations */
#define	CRYPTO_FG_SIMPLEOP_MASK	(CRYPTO_FG_ENCRYPT | CRYPTO_FG_DECRYPT | \
    CRYPTO_FG_DIGEST | CRYPTO_FG_SIGN | CRYPTO_FG_VERIFY | CRYPTO_FG_MAC | \
    CRYPTO_FG_ENCRYPT_ATOMIC | CRYPTO_FG_DECRYPT_ATOMIC |		\
    CRYPTO_FG_MAC_ATOMIC | CRYPTO_FG_DIGEST_ATOMIC | CRYPTO_FG_SIGN_ATOMIC | \
    CRYPTO_FG_VERIFY_ATOMIC)

/* Bit mask for all the dual operations */
#define	CRYPTO_FG_MAC_CIPHER_MASK	(CRYPTO_FG_ENCRYPT_MAC |	\
    CRYPTO_FG_MAC_DECRYPT | CRYPTO_FG_ENCRYPT_MAC_ATOMIC |		\
    CRYPTO_FG_MAC_DECRYPT_ATOMIC)

/* Add other combos to CRYPTO_FG_DUAL_MASK */
#define	CRYPTO_FG_DUAL_MASK	CRYPTO_FG_MAC_CIPHER_MASK

/*
 * The crypto_mech_info structure specifies one of the mechanisms
 * supported by a cryptographic provider. The pi_mechanisms field of
 * the crypto_provider_info structure contains a pointer to an array
 * of crypto_mech_info's.
 */
typedef struct crypto_mech_info {
	crypto_mech_name_t	cm_mech_name;
	crypto_mech_type_t	cm_mech_number;
	crypto_func_group_t	cm_func_group_mask;
	ssize_t			cm_min_key_length;
	ssize_t			cm_max_key_length;
	uint32_t		cm_mech_flags;
} crypto_mech_info_t;

/* Alias the old name to the new name for compatibility. */
#define	cm_keysize_unit	cm_mech_flags

/*
 * crypto_kcf_provider_handle_t is a handle allocated by the kernel.
 * It is returned after the provider registers with
 * crypto_register_provider(), and must be specified by the provider
 * when calling crypto_unregister_provider(), and
 * crypto_provider_notification().
 */
typedef uint_t crypto_kcf_provider_handle_t;

/*
 * Provider information. Passed as argument to crypto_register_provider(9F).
 * Describes the provider and its capabilities. Multiple providers can
 * register for the same device instance. In this case, the same
 * pi_provider_dev must be specified with a different pi_provider_handle.
 */
typedef struct crypto_provider_info_v1 {
	uint_t				pi_interface_version;
	char				*pi_provider_description;
	crypto_provider_type_t		pi_provider_type;
	crypto_provider_dev_t		pi_provider_dev;
	crypto_provider_handle_t	pi_provider_handle;
	crypto_ops_t			*pi_ops_vector;
	uint_t				pi_mech_list_count;
	crypto_mech_info_t		*pi_mechanisms;
	uint_t				pi_logical_provider_count;
	crypto_kcf_provider_handle_t	*pi_logical_providers;
} crypto_provider_info_v1_t;

typedef struct crypto_provider_info_v2 {
	crypto_provider_info_v1_t	v1_info;
	uint_t				pi_flags;
} crypto_provider_info_v2_t;

typedef struct crypto_provider_info {
	union {
		crypto_provider_info_v2_t piu_v2;
		crypto_provider_info_v1_t piu_v1;
	} piu;
} crypto_provider_info_t;

#define	pi_interface_version		piu.piu_v1.pi_interface_version
#define	pi_provider_description		piu.piu_v1.pi_provider_description
#define	pi_provider_type		piu.piu_v1.pi_provider_type
#define	pi_provider_dev			piu.piu_v1.pi_provider_dev
#define	pi_provider_handle		piu.piu_v1.pi_provider_handle
#define	pi_ops_vector			piu.piu_v1.pi_ops_vector
#define	pi_mech_list_count		piu.piu_v1.pi_mech_list_count
#define	pi_mechanisms			piu.piu_v1.pi_mechanisms
#define	pi_logical_provider_count	piu.piu_v1.pi_logical_provider_count
#define	pi_logical_providers		piu.piu_v1.pi_logical_providers
#define	pi_flags			piu.piu_v2.pi_flags

/* hidden providers can only be accessed via a logical provider */
#define	CRYPTO_HIDE_PROVIDER		0x00000001
/*
 * provider can not do multi-part digest (updates) and has a limit
 * on maximum input data that it can digest. The provider sets
 * this value in crypto_provider_ext_info_t by implementing
 * the ext_info entry point in the co_provider_ops vector.
 */
#define	CRYPTO_HASH_NO_UPDATE		0x00000002
/*
 * provider can not do multi-part HMAC (updates) and has a limit
 * on maximum input data that it can hmac. The provider sets
 * this value in crypto_provider_ext_info_t by implementing
 * the ext_info entry point in the co_provider_ops vector.
 */
#define	CRYPTO_HMAC_NO_UPDATE		0x00000008

/* provider can handle the request without returning a CRYPTO_QUEUED */
#define	CRYPTO_SYNCHRONOUS		0x00000004

#define	CRYPTO_PIFLAGS_RESERVED2	0x40000000
#define	CRYPTO_PIFLAGS_RESERVED1	0x80000000

/*
 * Provider status passed by a provider to crypto_provider_notification(9F)
 * and returned by the provider_status(9E) entry point.
 */
#define	CRYPTO_PROVIDER_READY		0
#define	CRYPTO_PROVIDER_BUSY		1
#define	CRYPTO_PROVIDER_FAILED		2

/*
 * Functions exported by Solaris to cryptographic providers. Providers
 * call these functions to register and unregister, notify the kernel
 * of state changes, and notify the kernel when a asynchronous request
 * completed.
 */
extern int crypto_register_provider(crypto_provider_info_t *,
		crypto_kcf_provider_handle_t *);
extern int crypto_unregister_provider(crypto_kcf_provider_handle_t);
extern void crypto_provider_notification(crypto_kcf_provider_handle_t, uint_t);
extern void crypto_op_notification(crypto_req_handle_t, int);
extern int crypto_kmflag(crypto_req_handle_t);

#endif	/* _KERNEL */

#ifdef	__cplusplus
}
#endif

#endif	/* _SYS_CRYPTO_SPI_H */