1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* 27 * This file is part of the core Kernel Cryptographic Framework. 28 * It implements the management of tables of Providers. Entries to 29 * added and removed when cryptographic providers register with 30 * and unregister from the framework, respectively. The KCF scheduler 31 * and ioctl pseudo driver call this function to obtain the list 32 * of available providers. 33 * 34 * The provider table is indexed by crypto_provider_id_t. Each 35 * element of the table contains a pointer to a provider descriptor, 36 * or NULL if the entry is free. 37 * 38 * This file also implements helper functions to allocate and free 39 * provider descriptors. 40 */ 41 42 #include <sys/zfs_context.h> 43 #include <sys/crypto/common.h> 44 #include <sys/crypto/impl.h> 45 #include <sys/crypto/sched_impl.h> 46 #include <sys/crypto/spi.h> 47 48 #define KCF_MAX_PROVIDERS 512 /* max number of providers */ 49 50 /* 51 * Prov_tab is an array of providers which is updated when 52 * a crypto provider registers with kcf. The provider calls the 53 * SPI routine, crypto_register_provider(), which in turn calls 54 * kcf_prov_tab_add_provider(). 55 * 56 * A provider unregisters by calling crypto_unregister_provider() 57 * which triggers the removal of the prov_tab entry. 58 * It also calls kcf_remove_mech_provider(). 59 * 60 * prov_tab entries are not updated from kcf.conf or by cryptoadm(1M). 61 */ 62 static kcf_provider_desc_t **prov_tab = NULL; 63 static kmutex_t prov_tab_mutex; /* ensure exclusive access to the table */ 64 static uint_t prov_tab_num = 0; /* number of providers in table */ 65 static uint_t prov_tab_max = KCF_MAX_PROVIDERS; 66 67 void 68 kcf_prov_tab_destroy(void) 69 { 70 mutex_destroy(&prov_tab_mutex); 71 72 if (prov_tab) 73 kmem_free(prov_tab, prov_tab_max * 74 sizeof (kcf_provider_desc_t *)); 75 } 76 77 /* 78 * Initialize a mutex and the KCF providers table, prov_tab. 79 * The providers table is dynamically allocated with prov_tab_max entries. 80 * Called from kcf module _init(). 81 */ 82 void 83 kcf_prov_tab_init(void) 84 { 85 mutex_init(&prov_tab_mutex, NULL, MUTEX_DEFAULT, NULL); 86 87 prov_tab = kmem_zalloc(prov_tab_max * sizeof (kcf_provider_desc_t *), 88 KM_SLEEP); 89 } 90 91 /* 92 * Add a provider to the provider table. If no free entry can be found 93 * for the new provider, returns CRYPTO_HOST_MEMORY. Otherwise, add 94 * the provider to the table, initialize the pd_prov_id field 95 * of the specified provider descriptor to the index in that table, 96 * and return CRYPTO_SUCCESS. Note that a REFHOLD is done on the 97 * provider when pointed to by a table entry. 98 */ 99 int 100 kcf_prov_tab_add_provider(kcf_provider_desc_t *prov_desc) 101 { 102 uint_t i; 103 104 ASSERT(prov_tab != NULL); 105 106 mutex_enter(&prov_tab_mutex); 107 108 /* find free slot in providers table */ 109 for (i = 1; i < KCF_MAX_PROVIDERS && prov_tab[i] != NULL; i++) 110 ; 111 if (i == KCF_MAX_PROVIDERS) { 112 /* ran out of providers entries */ 113 mutex_exit(&prov_tab_mutex); 114 cmn_err(CE_WARN, "out of providers entries"); 115 return (CRYPTO_HOST_MEMORY); 116 } 117 118 /* initialize entry */ 119 prov_tab[i] = prov_desc; 120 KCF_PROV_REFHOLD(prov_desc); 121 KCF_PROV_IREFHOLD(prov_desc); 122 prov_tab_num++; 123 124 mutex_exit(&prov_tab_mutex); 125 126 /* update provider descriptor */ 127 prov_desc->pd_prov_id = i; 128 129 /* 130 * The KCF-private provider handle is defined as the internal 131 * provider id. 132 */ 133 prov_desc->pd_kcf_prov_handle = 134 (crypto_kcf_provider_handle_t)prov_desc->pd_prov_id; 135 136 return (CRYPTO_SUCCESS); 137 } 138 139 /* 140 * Remove the provider specified by its id. A REFRELE is done on the 141 * corresponding provider descriptor before this function returns. 142 * Returns CRYPTO_UNKNOWN_PROVIDER if the provider id is not valid. 143 */ 144 int 145 kcf_prov_tab_rem_provider(crypto_provider_id_t prov_id) 146 { 147 kcf_provider_desc_t *prov_desc; 148 149 ASSERT(prov_tab != NULL); 150 ASSERT(prov_tab_num >= 0); 151 152 /* 153 * Validate provider id, since it can be specified by a 3rd-party 154 * provider. 155 */ 156 157 mutex_enter(&prov_tab_mutex); 158 if (prov_id >= KCF_MAX_PROVIDERS || 159 ((prov_desc = prov_tab[prov_id]) == NULL)) { 160 mutex_exit(&prov_tab_mutex); 161 return (CRYPTO_INVALID_PROVIDER_ID); 162 } 163 mutex_exit(&prov_tab_mutex); 164 165 /* 166 * The provider id must remain valid until the associated provider 167 * descriptor is freed. For this reason, we simply release our 168 * reference to the descriptor here. When the reference count 169 * reaches zero, kcf_free_provider_desc() will be invoked and 170 * the associated entry in the providers table will be released 171 * at that time. 172 */ 173 174 KCF_PROV_REFRELE(prov_desc); 175 KCF_PROV_IREFRELE(prov_desc); 176 177 return (CRYPTO_SUCCESS); 178 } 179 180 /* 181 * Returns the provider descriptor corresponding to the specified 182 * provider id. A REFHOLD is done on the descriptor before it is 183 * returned to the caller. It is the responsibility of the caller 184 * to do a REFRELE once it is done with the provider descriptor. 185 */ 186 kcf_provider_desc_t * 187 kcf_prov_tab_lookup(crypto_provider_id_t prov_id) 188 { 189 kcf_provider_desc_t *prov_desc; 190 191 mutex_enter(&prov_tab_mutex); 192 193 prov_desc = prov_tab[prov_id]; 194 195 if (prov_desc == NULL) { 196 mutex_exit(&prov_tab_mutex); 197 return (NULL); 198 } 199 200 KCF_PROV_REFHOLD(prov_desc); 201 202 mutex_exit(&prov_tab_mutex); 203 204 return (prov_desc); 205 } 206 207 static void 208 allocate_ops_v1(crypto_ops_t *src, crypto_ops_t *dst, uint_t *mech_list_count) 209 { 210 if (src->co_control_ops != NULL) 211 dst->co_control_ops = kmem_alloc(sizeof (crypto_control_ops_t), 212 KM_SLEEP); 213 214 if (src->co_digest_ops != NULL) 215 dst->co_digest_ops = kmem_alloc(sizeof (crypto_digest_ops_t), 216 KM_SLEEP); 217 218 if (src->co_cipher_ops != NULL) 219 dst->co_cipher_ops = kmem_alloc(sizeof (crypto_cipher_ops_t), 220 KM_SLEEP); 221 222 if (src->co_mac_ops != NULL) 223 dst->co_mac_ops = kmem_alloc(sizeof (crypto_mac_ops_t), 224 KM_SLEEP); 225 226 if (src->co_sign_ops != NULL) 227 dst->co_sign_ops = kmem_alloc(sizeof (crypto_sign_ops_t), 228 KM_SLEEP); 229 230 if (src->co_verify_ops != NULL) 231 dst->co_verify_ops = kmem_alloc(sizeof (crypto_verify_ops_t), 232 KM_SLEEP); 233 234 if (src->co_dual_ops != NULL) 235 dst->co_dual_ops = kmem_alloc(sizeof (crypto_dual_ops_t), 236 KM_SLEEP); 237 238 if (src->co_dual_cipher_mac_ops != NULL) 239 dst->co_dual_cipher_mac_ops = kmem_alloc( 240 sizeof (crypto_dual_cipher_mac_ops_t), KM_SLEEP); 241 242 if (src->co_random_ops != NULL) { 243 dst->co_random_ops = kmem_alloc( 244 sizeof (crypto_random_number_ops_t), KM_SLEEP); 245 246 /* 247 * Allocate storage to store the array of supported mechanisms 248 * specified by provider. We allocate extra mechanism storage 249 * if the provider has random_ops since we keep an internal 250 * mechanism, SUN_RANDOM, in this case. 251 */ 252 (*mech_list_count)++; 253 } 254 255 if (src->co_session_ops != NULL) 256 dst->co_session_ops = kmem_alloc(sizeof (crypto_session_ops_t), 257 KM_SLEEP); 258 259 if (src->co_object_ops != NULL) 260 dst->co_object_ops = kmem_alloc(sizeof (crypto_object_ops_t), 261 KM_SLEEP); 262 263 if (src->co_key_ops != NULL) 264 dst->co_key_ops = kmem_alloc(sizeof (crypto_key_ops_t), 265 KM_SLEEP); 266 267 if (src->co_provider_ops != NULL) 268 dst->co_provider_ops = kmem_alloc( 269 sizeof (crypto_provider_management_ops_t), KM_SLEEP); 270 271 if (src->co_ctx_ops != NULL) 272 dst->co_ctx_ops = kmem_alloc(sizeof (crypto_ctx_ops_t), 273 KM_SLEEP); 274 } 275 276 static void 277 allocate_ops_v2(crypto_ops_t *src, crypto_ops_t *dst) 278 { 279 if (src->co_mech_ops != NULL) 280 dst->co_mech_ops = kmem_alloc(sizeof (crypto_mech_ops_t), 281 KM_SLEEP); 282 } 283 284 static void 285 allocate_ops_v3(crypto_ops_t *src, crypto_ops_t *dst) 286 { 287 if (src->co_nostore_key_ops != NULL) 288 dst->co_nostore_key_ops = 289 kmem_alloc(sizeof (crypto_nostore_key_ops_t), KM_SLEEP); 290 } 291 292 /* 293 * Allocate a provider descriptor. mech_list_count specifies the 294 * number of mechanisms supported by the providers, and is used 295 * to allocate storage for the mechanism table. 296 * This function may sleep while allocating memory, which is OK 297 * since it is invoked from user context during provider registration. 298 */ 299 kcf_provider_desc_t * 300 kcf_alloc_provider_desc(crypto_provider_info_t *info) 301 { 302 int i, j; 303 kcf_provider_desc_t *desc; 304 uint_t mech_list_count = info->pi_mech_list_count; 305 crypto_ops_t *src_ops = info->pi_ops_vector; 306 307 desc = kmem_zalloc(sizeof (kcf_provider_desc_t), KM_SLEEP); 308 309 /* 310 * pd_description serves two purposes 311 * - Appears as a blank padded PKCS#11 style string, that will be 312 * returned to applications in CK_SLOT_INFO.slotDescription. 313 * This means that we should not have a null character in the 314 * first CRYPTO_PROVIDER_DESCR_MAX_LEN bytes. 315 * - Appears as a null-terminated string that can be used by 316 * other kcf routines. 317 * 318 * So, we allocate enough room for one extra null terminator 319 * which keeps every one happy. 320 */ 321 desc->pd_description = kmem_alloc(CRYPTO_PROVIDER_DESCR_MAX_LEN + 1, 322 KM_SLEEP); 323 (void) memset(desc->pd_description, ' ', 324 CRYPTO_PROVIDER_DESCR_MAX_LEN); 325 desc->pd_description[CRYPTO_PROVIDER_DESCR_MAX_LEN] = '\0'; 326 327 /* 328 * Since the framework does not require the ops vector specified 329 * by the providers during registration to be persistent, 330 * KCF needs to allocate storage where copies of the ops 331 * vectors are copied. 332 */ 333 desc->pd_ops_vector = kmem_zalloc(sizeof (crypto_ops_t), KM_SLEEP); 334 335 if (info->pi_provider_type != CRYPTO_LOGICAL_PROVIDER) { 336 allocate_ops_v1(src_ops, desc->pd_ops_vector, &mech_list_count); 337 if (info->pi_interface_version >= CRYPTO_SPI_VERSION_2) 338 allocate_ops_v2(src_ops, desc->pd_ops_vector); 339 if (info->pi_interface_version == CRYPTO_SPI_VERSION_3) 340 allocate_ops_v3(src_ops, desc->pd_ops_vector); 341 } 342 343 desc->pd_mech_list_count = mech_list_count; 344 desc->pd_mechanisms = kmem_zalloc(sizeof (crypto_mech_info_t) * 345 mech_list_count, KM_SLEEP); 346 for (i = 0; i < KCF_OPS_CLASSSIZE; i++) 347 for (j = 0; j < KCF_MAXMECHTAB; j++) 348 desc->pd_mech_indx[i][j] = KCF_INVALID_INDX; 349 350 desc->pd_prov_id = KCF_PROVID_INVALID; 351 desc->pd_state = KCF_PROV_ALLOCATED; 352 353 mutex_init(&desc->pd_lock, NULL, MUTEX_DEFAULT, NULL); 354 cv_init(&desc->pd_resume_cv, NULL, CV_DEFAULT, NULL); 355 cv_init(&desc->pd_remove_cv, NULL, CV_DEFAULT, NULL); 356 357 return (desc); 358 } 359 360 /* 361 * Called by KCF_PROV_REFRELE when a provider's reference count drops 362 * to zero. We free the descriptor when the last reference is released. 363 * However, for software providers, we do not free it when there is an 364 * unregister thread waiting. We signal that thread in this case and 365 * that thread is responsible for freeing the descriptor. 366 */ 367 void 368 kcf_provider_zero_refcnt(kcf_provider_desc_t *desc) 369 { 370 mutex_enter(&desc->pd_lock); 371 switch (desc->pd_prov_type) { 372 case CRYPTO_SW_PROVIDER: 373 if (desc->pd_state == KCF_PROV_REMOVED || 374 desc->pd_state == KCF_PROV_DISABLED) { 375 desc->pd_state = KCF_PROV_FREED; 376 cv_broadcast(&desc->pd_remove_cv); 377 mutex_exit(&desc->pd_lock); 378 break; 379 } 380 /* FALLTHRU */ 381 382 case CRYPTO_HW_PROVIDER: 383 case CRYPTO_LOGICAL_PROVIDER: 384 mutex_exit(&desc->pd_lock); 385 kcf_free_provider_desc(desc); 386 } 387 } 388 389 /* 390 * Free a provider descriptor. 391 */ 392 void 393 kcf_free_provider_desc(kcf_provider_desc_t *desc) 394 { 395 if (desc == NULL) 396 return; 397 398 mutex_enter(&prov_tab_mutex); 399 if (desc->pd_prov_id != KCF_PROVID_INVALID) { 400 /* release the associated providers table entry */ 401 ASSERT(prov_tab[desc->pd_prov_id] != NULL); 402 prov_tab[desc->pd_prov_id] = NULL; 403 prov_tab_num--; 404 } 405 mutex_exit(&prov_tab_mutex); 406 407 /* free the kernel memory associated with the provider descriptor */ 408 409 if (desc->pd_description != NULL) 410 kmem_free(desc->pd_description, 411 CRYPTO_PROVIDER_DESCR_MAX_LEN + 1); 412 413 if (desc->pd_ops_vector != NULL) { 414 415 if (desc->pd_ops_vector->co_control_ops != NULL) 416 kmem_free(desc->pd_ops_vector->co_control_ops, 417 sizeof (crypto_control_ops_t)); 418 419 if (desc->pd_ops_vector->co_digest_ops != NULL) 420 kmem_free(desc->pd_ops_vector->co_digest_ops, 421 sizeof (crypto_digest_ops_t)); 422 423 if (desc->pd_ops_vector->co_cipher_ops != NULL) 424 kmem_free(desc->pd_ops_vector->co_cipher_ops, 425 sizeof (crypto_cipher_ops_t)); 426 427 if (desc->pd_ops_vector->co_mac_ops != NULL) 428 kmem_free(desc->pd_ops_vector->co_mac_ops, 429 sizeof (crypto_mac_ops_t)); 430 431 if (desc->pd_ops_vector->co_sign_ops != NULL) 432 kmem_free(desc->pd_ops_vector->co_sign_ops, 433 sizeof (crypto_sign_ops_t)); 434 435 if (desc->pd_ops_vector->co_verify_ops != NULL) 436 kmem_free(desc->pd_ops_vector->co_verify_ops, 437 sizeof (crypto_verify_ops_t)); 438 439 if (desc->pd_ops_vector->co_dual_ops != NULL) 440 kmem_free(desc->pd_ops_vector->co_dual_ops, 441 sizeof (crypto_dual_ops_t)); 442 443 if (desc->pd_ops_vector->co_dual_cipher_mac_ops != NULL) 444 kmem_free(desc->pd_ops_vector->co_dual_cipher_mac_ops, 445 sizeof (crypto_dual_cipher_mac_ops_t)); 446 447 if (desc->pd_ops_vector->co_random_ops != NULL) 448 kmem_free(desc->pd_ops_vector->co_random_ops, 449 sizeof (crypto_random_number_ops_t)); 450 451 if (desc->pd_ops_vector->co_session_ops != NULL) 452 kmem_free(desc->pd_ops_vector->co_session_ops, 453 sizeof (crypto_session_ops_t)); 454 455 if (desc->pd_ops_vector->co_object_ops != NULL) 456 kmem_free(desc->pd_ops_vector->co_object_ops, 457 sizeof (crypto_object_ops_t)); 458 459 if (desc->pd_ops_vector->co_key_ops != NULL) 460 kmem_free(desc->pd_ops_vector->co_key_ops, 461 sizeof (crypto_key_ops_t)); 462 463 if (desc->pd_ops_vector->co_provider_ops != NULL) 464 kmem_free(desc->pd_ops_vector->co_provider_ops, 465 sizeof (crypto_provider_management_ops_t)); 466 467 if (desc->pd_ops_vector->co_ctx_ops != NULL) 468 kmem_free(desc->pd_ops_vector->co_ctx_ops, 469 sizeof (crypto_ctx_ops_t)); 470 471 if (desc->pd_ops_vector->co_mech_ops != NULL) 472 kmem_free(desc->pd_ops_vector->co_mech_ops, 473 sizeof (crypto_mech_ops_t)); 474 475 if (desc->pd_ops_vector->co_nostore_key_ops != NULL) 476 kmem_free(desc->pd_ops_vector->co_nostore_key_ops, 477 sizeof (crypto_nostore_key_ops_t)); 478 479 kmem_free(desc->pd_ops_vector, sizeof (crypto_ops_t)); 480 } 481 482 if (desc->pd_mechanisms != NULL) 483 /* free the memory associated with the mechanism info's */ 484 kmem_free(desc->pd_mechanisms, sizeof (crypto_mech_info_t) * 485 desc->pd_mech_list_count); 486 487 if (desc->pd_sched_info.ks_taskq != NULL) 488 taskq_destroy(desc->pd_sched_info.ks_taskq); 489 490 mutex_destroy(&desc->pd_lock); 491 cv_destroy(&desc->pd_resume_cv); 492 cv_destroy(&desc->pd_remove_cv); 493 494 kmem_free(desc, sizeof (kcf_provider_desc_t)); 495 } 496 497 /* 498 * Returns an array of hardware and logical provider descriptors, 499 * a.k.a the PKCS#11 slot list. A REFHOLD is done on each descriptor 500 * before the array is returned. The entire table can be freed by 501 * calling kcf_free_provider_tab(). 502 */ 503 int 504 kcf_get_slot_list(uint_t *count, kcf_provider_desc_t ***array, 505 boolean_t unverified) 506 { 507 kcf_provider_desc_t *prov_desc; 508 kcf_provider_desc_t **p = NULL; 509 char *last; 510 uint_t cnt = 0; 511 uint_t i, j; 512 int rval = CRYPTO_SUCCESS; 513 size_t n, final_size; 514 515 /* count the providers */ 516 mutex_enter(&prov_tab_mutex); 517 for (i = 0; i < KCF_MAX_PROVIDERS; i++) { 518 if ((prov_desc = prov_tab[i]) != NULL && 519 ((prov_desc->pd_prov_type == CRYPTO_HW_PROVIDER && 520 (prov_desc->pd_flags & CRYPTO_HIDE_PROVIDER) == 0) || 521 prov_desc->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)) { 522 if (KCF_IS_PROV_USABLE(prov_desc) || 523 (unverified && KCF_IS_PROV_UNVERIFIED(prov_desc))) { 524 cnt++; 525 } 526 } 527 } 528 mutex_exit(&prov_tab_mutex); 529 530 if (cnt == 0) 531 goto out; 532 533 n = cnt * sizeof (kcf_provider_desc_t *); 534 again: 535 p = kmem_zalloc(n, KM_SLEEP); 536 537 /* pointer to last entry in the array */ 538 last = (char *)&p[cnt-1]; 539 540 mutex_enter(&prov_tab_mutex); 541 /* fill the slot list */ 542 for (i = 0, j = 0; i < KCF_MAX_PROVIDERS; i++) { 543 if ((prov_desc = prov_tab[i]) != NULL && 544 ((prov_desc->pd_prov_type == CRYPTO_HW_PROVIDER && 545 (prov_desc->pd_flags & CRYPTO_HIDE_PROVIDER) == 0) || 546 prov_desc->pd_prov_type == CRYPTO_LOGICAL_PROVIDER)) { 547 if (KCF_IS_PROV_USABLE(prov_desc) || 548 (unverified && KCF_IS_PROV_UNVERIFIED(prov_desc))) { 549 if ((char *)&p[j] > last) { 550 mutex_exit(&prov_tab_mutex); 551 kcf_free_provider_tab(cnt, p); 552 n = n << 1; 553 cnt = cnt << 1; 554 goto again; 555 } 556 p[j++] = prov_desc; 557 KCF_PROV_REFHOLD(prov_desc); 558 } 559 } 560 } 561 mutex_exit(&prov_tab_mutex); 562 563 final_size = j * sizeof (kcf_provider_desc_t *); 564 cnt = j; 565 ASSERT(final_size <= n); 566 567 /* check if buffer we allocated is too large */ 568 if (final_size < n) { 569 char *final_buffer = NULL; 570 571 if (final_size > 0) { 572 final_buffer = kmem_alloc(final_size, KM_SLEEP); 573 bcopy(p, final_buffer, final_size); 574 } 575 kmem_free(p, n); 576 p = (kcf_provider_desc_t **)final_buffer; 577 } 578 out: 579 *count = cnt; 580 *array = p; 581 return (rval); 582 } 583 584 /* 585 * Free an array of hardware provider descriptors. A REFRELE 586 * is done on each descriptor before the table is freed. 587 */ 588 void 589 kcf_free_provider_tab(uint_t count, kcf_provider_desc_t **array) 590 { 591 kcf_provider_desc_t *prov_desc; 592 int i; 593 594 for (i = 0; i < count; i++) { 595 if ((prov_desc = array[i]) != NULL) { 596 KCF_PROV_REFRELE(prov_desc); 597 } 598 } 599 kmem_free(array, count * sizeof (kcf_provider_desc_t *)); 600 } 601 602 /* 603 * Returns in the location pointed to by pd a pointer to the descriptor 604 * for the software provider for the specified mechanism. 605 * The provider descriptor is returned held and it is the caller's 606 * responsibility to release it when done. The mechanism entry 607 * is returned if the optional argument mep is non NULL. 608 * 609 * Returns one of the CRYPTO_ * error codes on failure, and 610 * CRYPTO_SUCCESS on success. 611 */ 612 int 613 kcf_get_sw_prov(crypto_mech_type_t mech_type, kcf_provider_desc_t **pd, 614 kcf_mech_entry_t **mep, boolean_t log_warn) 615 { 616 kcf_mech_entry_t *me; 617 618 /* get the mechanism entry for this mechanism */ 619 if (kcf_get_mech_entry(mech_type, &me) != KCF_SUCCESS) 620 return (CRYPTO_MECHANISM_INVALID); 621 622 /* 623 * Get the software provider for this mechanism. 624 * Lock the mech_entry until we grab the 'pd'. 625 */ 626 mutex_enter(&me->me_mutex); 627 628 if (me->me_sw_prov == NULL || 629 (*pd = me->me_sw_prov->pm_prov_desc) == NULL) { 630 /* no SW provider for this mechanism */ 631 if (log_warn) 632 cmn_err(CE_WARN, "no SW provider for \"%s\"\n", 633 me->me_name); 634 mutex_exit(&me->me_mutex); 635 return (CRYPTO_MECH_NOT_SUPPORTED); 636 } 637 638 KCF_PROV_REFHOLD(*pd); 639 mutex_exit(&me->me_mutex); 640 641 if (mep != NULL) 642 *mep = me; 643 644 return (CRYPTO_SUCCESS); 645 } 646