LinuxKPI: add devcoredump.h

[bz]

Summary

Add linux/devcoredump.h with stub implementation of dev_coredumpv()
and dev_coredumpsg() which only free the passed in SG table.

Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Reviewed by:
Differential Revision:

[• hselasky]

sys/compat/linuxkpi/common/include/linux/devcoredump.h

41

__inline -> inline

These functions are always inline ??

[bz]

sys/compat/linuxkpi/common/include/linux/devcoredump.h

41

I'll change the inline. Not sure I understand the question. I don't think putting them into a C file makes sense (at least not until someone actually implements the dump parts) [if that is what you meant].

[bz]

s/__inline/inline/g

sys/compat/linuxkpi/common/include/linux/devcoredump.h

  */
 static int
 swcr_encdec(struct swcr_session *ses, struct cryptop *crp)
 {
         unsigned char iv[EALG_MAX_BLOCK_LEN], blk[EALG_MAX_BLOCK_LEN];
         unsigned char *ivp, *nivp, iv2[EALG_MAX_BLOCK_LEN];
         const struct crypto_session_params *csp;
         const struct enc_xform *exf;
-        struct swcr_encdec *sw;
+        const struct swcr_encdec *sw;
+        void *ctx;
         size_t inlen, outlen;
         int i, blks, resid;
         struct crypto_buffer_cursor cc_in, cc_out;
         const unsigned char *inblk;
         unsigned char *outblk;
         int error;
         bool encrypting;
 
if (exf->native_blocksize == 0) {
                 blks = exf->blocksize;
         } else
                 blks = exf->native_blocksize;
 
         if (exf == &enc_xform_aes_icm &&
             (crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
                 return (EINVAL);
 
+        ctx = __builtin_alloca(exf->ctxsize);
         if (crp->crp_cipher_key != NULL) {
-                error = exf->setkey(sw->sw_ctx,
-                    crp->crp_cipher_key, csp->csp_cipher_klen);
+                error = exf->setkey(ctx, crp->crp_cipher_key,
+                    csp->csp_cipher_klen);
                 if (error)
                         return (error);
-        }
+        } else
+                memcpy(ctx, sw->sw_ctx, exf->ctxsize);
 
         crypto_read_iv(crp, iv);
 
         if (exf->reinit) {
                 /*
                  * xforms that provide a reinit method perform all IV
                  * handling themselves.
                  */
-                exf->reinit(sw->sw_ctx, iv, csp->csp_ivlen);
+                exf->reinit(ctx, iv, csp->csp_ivlen);
         }
 
         ivp = iv;
 
         crypto_cursor_init(&cc_in, &crp->crp_buf);
         crypto_cursor_advance(&cc_in, crp->crp_payload_start);
         inblk = crypto_cursor_segment(&cc_in, &inlen);
         if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
if (outlen < blks)
                         outblk = blk;
 
                 /*
                  * Ciphers without a 'reinit' hook are assumed to be
                  * used in CBC mode where the chaining is done here.
                  */
                 if (exf->reinit != NULL) {
                         if (encrypting)
-                                exf->encrypt(sw->sw_ctx, inblk, outblk);
+                                exf->encrypt(ctx, inblk, outblk);
                         else
-                                exf->decrypt(sw->sw_ctx, inblk, outblk);
+                                exf->decrypt(ctx, inblk, outblk);
                 } else if (encrypting) {
                         /* XOR with previous block */
                         for (i = 0; i < blks; i++)
                                 outblk[i] = inblk[i] ^ ivp[i];
 
-                        exf->encrypt(sw->sw_ctx, outblk, outblk);
+                        exf->encrypt(ctx, outblk, outblk);
 
                         /*
                          * Keep encrypted block for XOR'ing
                          * with next block
                          */
                         memcpy(iv, outblk, blks);
                         ivp = iv;
                 } else {        /* decrypt */
                         /*
                          * Keep encrypted block for XOR'ing
                          * with next block
                          */
                         nivp = (ivp == iv) ? iv2 : iv;
                         memcpy(nivp, inblk, blks);
 
-                        exf->decrypt(sw->sw_ctx, inblk, outblk);
+                        exf->decrypt(ctx, inblk, outblk);
 
                         /* XOR with previous block */
                         for (i = 0; i < blks; i++)
                                 outblk[i] ^= ivp[i];
 
                         ivp = nivp;
                 }
 
if (resid > 0) {
                 outblk = crypto_cursor_segment(&cc_out, &outlen);
                 if (inlen < resid) {
                         crypto_cursor_copydata(&cc_in, resid, blk);
                         inblk = blk;
                 }
                 if (outlen < resid)
                         outblk = blk;
                 if (encrypting)
-                        exf->encrypt_last(sw->sw_ctx, inblk, outblk,
+                        exf->encrypt_last(ctx, inblk, outblk,
                             resid);
                 else
-                        exf->decrypt_last(sw->sw_ctx, inblk, outblk,
+                        exf->decrypt_last(ctx, inblk, outblk,
                             resid);
                 if (outlen < resid)
                         crypto_cursor_copyback(&cc_out, resid, blk);
         }
 
+        explicit_bzero(ctx, exf->ctxsize);
         explicit_bzero(blk, sizeof(blk));
         explicit_bzero(iv, sizeof(iv));
         explicit_bzero(iv2, sizeof(iv2));
         return (0);
 }
 
 static void
 swcr_authprepare(const struct auth_hash *axf, struct swcr_auth *sw,

 swcr_gcm(struct swcr_session *ses, struct cryptop *crp)
 {
         uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))];
         u_char *blk = (u_char *)blkbuf;
         u_char tag[GMAC_DIGEST_LEN];
         struct crypto_buffer_cursor cc_in, cc_out;
         const u_char *inblk;
         u_char *outblk;
-        struct swcr_auth *swa;
-        struct swcr_encdec *swe;
+        const struct swcr_auth *swa;
+        const struct swcr_encdec *swe;
         const struct enc_xform *exf;
+        void *ctx;
         uint32_t *blkp;
         size_t len;
         int blksz, error, ivlen, r, resid;
 
         swa = &ses->swcr_auth;
         swe = &ses->swcr_encdec;
         exf = swe->sw_exf;
         blksz = GMAC_BLOCK_LEN;
         KASSERT(blksz == exf->native_blocksize,
             ("%s: blocksize mismatch", __func__));
 
         if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
                 return (EINVAL);
 
         ivlen = AES_GCM_IV_LEN;
 
-        /* Supply cipher with nonce. */
+        ctx = __builtin_alloca(exf->ctxsize);
         if (crp->crp_cipher_key != NULL)
-                exf->setkey(swe->sw_ctx, crp->crp_cipher_key,
+                exf->setkey(ctx, crp->crp_cipher_key,
                     crypto_get_params(crp->crp_session)->csp_cipher_klen);
-        exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen);
+        else
+                memcpy(ctx, swe->sw_ctx, exf->ctxsize);
+        exf->reinit(ctx, crp->crp_iv, ivlen);
 
         /* Supply MAC with AAD */
         if (crp->crp_aad != NULL) {
                 len = rounddown(crp->crp_aad_length, blksz);
                 if (len != 0)
-                        exf->update(swe->sw_ctx, crp->crp_aad, len);
+                        exf->update(ctx, crp->crp_aad, len);
                 if (crp->crp_aad_length != len) {
                         memset(blk, 0, blksz);
                         memcpy(blk, (char *)crp->crp_aad + len,
                             crp->crp_aad_length - len);
-                        exf->update(swe->sw_ctx, blk, blksz);
+                        exf->update(ctx, blk, blksz);
                 }
         } else {
                 crypto_cursor_init(&cc_in, &crp->crp_buf);
                 crypto_cursor_advance(&cc_in, crp->crp_aad_start);
                 for (resid = crp->crp_aad_length; resid >= blksz;
                      resid -= len) {
                         inblk = crypto_cursor_segment(&cc_in, &len);
                         if (len >= blksz) {
                                 len = rounddown(MIN(len, resid), blksz);
                                 crypto_cursor_advance(&cc_in, len);
                         } else {
                                 len = blksz;
                                 crypto_cursor_copydata(&cc_in, len, blk);
                                 inblk = blk;
                         }
-                        exf->update(swe->sw_ctx, inblk, len);
+                        exf->update(ctx, inblk, len);
                 }
                 if (resid > 0) {
                         memset(blk, 0, blksz);
                         crypto_cursor_copydata(&cc_in, resid, blk);
-                        exf->update(swe->sw_ctx, blk, blksz);
+                        exf->update(ctx, blk, blksz);
                 }
         }
 
         /* Do encryption with MAC */
         crypto_cursor_init(&cc_in, &crp->crp_buf);
         crypto_cursor_advance(&cc_in, crp->crp_payload_start);
         if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
                 crypto_cursor_init(&cc_out, &crp->crp_obuf);
                 crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
         } else
                 cc_out = cc_in;
         for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
                 inblk = crypto_cursor_segment(&cc_in, &len);
                 if (len < blksz) {
                         crypto_cursor_copydata(&cc_in, blksz, blk);
                         inblk = blk;
                 } else {
                         crypto_cursor_advance(&cc_in, blksz);
                 }
                 if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
                         outblk = crypto_cursor_segment(&cc_out, &len);
                         if (len < blksz)
                                 outblk = blk;
-                        exf->encrypt(swe->sw_ctx, inblk, outblk);
-                        exf->update(swe->sw_ctx, outblk, blksz);
+                        exf->encrypt(ctx, inblk, outblk);
+                        exf->update(ctx, outblk, blksz);
                         if (outblk == blk)
                                 crypto_cursor_copyback(&cc_out, blksz, blk);
                         else
                                 crypto_cursor_advance(&cc_out, blksz);
                 } else {
-                        exf->update(swe->sw_ctx, inblk, blksz);
+                        exf->update(ctx, inblk, blksz);
                 }
         }
         if (resid > 0) {
                 crypto_cursor_copydata(&cc_in, resid, blk);
                 if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
-                        exf->encrypt_last(swe->sw_ctx, blk, blk, resid);
+                        exf->encrypt_last(ctx, blk, blk, resid);
                         crypto_cursor_copyback(&cc_out, resid, blk);
                 }
-                exf->update(swe->sw_ctx, blk, resid);
+                exf->update(ctx, blk, resid);
         }
 
         /* length block */
         memset(blk, 0, blksz);
         blkp = (uint32_t *)blk + 1;
         *blkp = htobe32(crp->crp_aad_length * 8);
         blkp = (uint32_t *)blk + 3;
         *blkp = htobe32(crp->crp_payload_length * 8);
-        exf->update(swe->sw_ctx, blk, blksz);
+        exf->update(ctx, blk, blksz);
 
         /* Finalize MAC */
-        exf->final(tag, swe->sw_ctx);
+        exf->final(tag, ctx);
 
         /* Validate tag */
         error = 0;
         if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
                 u_char tag2[GMAC_DIGEST_LEN];
 
                 crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2);
 
for (resid = crp->crp_payload_length; resid > blksz;
                         if (len < blksz) {
                                 crypto_cursor_copydata(&cc_in, blksz, blk);
                                 inblk = blk;
                         } else
                                 crypto_cursor_advance(&cc_in, blksz);
                         outblk = crypto_cursor_segment(&cc_out, &len);
                         if (len < blksz)
                                 outblk = blk;
-                        exf->decrypt(swe->sw_ctx, inblk, outblk);
+                        exf->decrypt(ctx, inblk, outblk);
                         if (outblk == blk)
                                 crypto_cursor_copyback(&cc_out, blksz, blk);
                         else
                                 crypto_cursor_advance(&cc_out, blksz);
                 }
                 if (resid > 0) {
                         crypto_cursor_copydata(&cc_in, resid, blk);
-                        exf->decrypt_last(swe->sw_ctx, blk, blk, resid);
+                        exf->decrypt_last(ctx, blk, blk, resid);
                         crypto_cursor_copyback(&cc_out, resid, blk);
                 }
         } else {
                 /* Inject the authentication data */
                 crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
         }
 
 out:
+        explicit_bzero(ctx, exf->ctxsize);
         explicit_bzero(blkbuf, sizeof(blkbuf));
         explicit_bzero(tag, sizeof(tag));
 
         return (error);
 }
 
 static void
 build_ccm_b0(const char *nonce, u_int nonce_length, u_int aad_length,

 {
         const struct crypto_session_params *csp;
         uint32_t blkbuf[howmany(AES_BLOCK_LEN, sizeof(uint32_t))];
         u_char *blk = (u_char *)blkbuf;
         u_char tag[AES_CBC_MAC_HASH_LEN];
         struct crypto_buffer_cursor cc_in, cc_out;
         const u_char *inblk;
         u_char *outblk;
-        struct swcr_auth *swa;
-        struct swcr_encdec *swe;
+        const struct swcr_auth *swa;
+        const struct swcr_encdec *swe;
         const struct enc_xform *exf;
+        void *ctx;
         size_t len;
         int blksz, error, ivlen, r, resid;
 
         csp = crypto_get_params(crp->crp_session);
         swa = &ses->swcr_auth;
         swe = &ses->swcr_encdec;
         exf = swe->sw_exf;
         blksz = AES_BLOCK_LEN;
         KASSERT(blksz == exf->native_blocksize,
             ("%s: blocksize mismatch", __func__));
 
         if (crp->crp_payload_length > ccm_max_payload_length(csp))
                 return (EMSGSIZE);
 
         if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
                 return (EINVAL);
 
         ivlen = csp->csp_ivlen;
 
+        ctx = __builtin_alloca(exf->ctxsize);
         if (crp->crp_cipher_key != NULL)
-                exf->setkey(swe->sw_ctx, crp->crp_cipher_key,
+                exf->setkey(ctx, crp->crp_cipher_key,
                     crypto_get_params(crp->crp_session)->csp_cipher_klen);
-        exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen);
+        else
+                memcpy(ctx, swe->sw_ctx, exf->ctxsize);
+        exf->reinit(ctx, crp->crp_iv, ivlen);
 
         /* Supply MAC with b0. */
         _Static_assert(sizeof(blkbuf) >= CCM_CBC_BLOCK_LEN,
             "blkbuf too small for b0");
         build_ccm_b0(crp->crp_iv, ivlen, crp->crp_aad_length,
             crp->crp_payload_length, swa->sw_mlen, blk);
-        exf->update(swe->sw_ctx, blk, CCM_CBC_BLOCK_LEN);
+        exf->update(ctx, blk, CCM_CBC_BLOCK_LEN);
 
         /* Supply MAC with AAD */
         if (crp->crp_aad_length != 0) {
                 len = build_ccm_aad_length(crp->crp_aad_length, blk);
-                exf->update(swe->sw_ctx, blk, len);
+                exf->update(ctx, blk, len);
                 if (crp->crp_aad != NULL)
-                        exf->update(swe->sw_ctx, crp->crp_aad,
-                            crp->crp_aad_length);
+                        exf->update(ctx, crp->crp_aad, crp->crp_aad_length);
                 else
                         crypto_apply(crp, crp->crp_aad_start,
-                            crp->crp_aad_length, exf->update,
-                            swe->sw_ctx);
+                            crp->crp_aad_length, exf->update, ctx);
 
                 /* Pad the AAD (including length field) to a full block. */
                 len = (len + crp->crp_aad_length) % CCM_CBC_BLOCK_LEN;
                 if (len != 0) {
                         len = CCM_CBC_BLOCK_LEN - len;
                         memset(blk, 0, CCM_CBC_BLOCK_LEN);
-                        exf->update(swe->sw_ctx, blk, len);
+                        exf->update(ctx, blk, len);
                 }
         }
 
         /* Do encryption/decryption with MAC */
         crypto_cursor_init(&cc_in, &crp->crp_buf);
         crypto_cursor_advance(&cc_in, crp->crp_payload_start);
         if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
                 crypto_cursor_init(&cc_out, &crp->crp_obuf);
                 crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
         } else
                 cc_out = cc_in;
         for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
                 inblk = crypto_cursor_segment(&cc_in, &len);
                 if (len < blksz) {
                         crypto_cursor_copydata(&cc_in, blksz, blk);
                         inblk = blk;
                 } else
                         crypto_cursor_advance(&cc_in, blksz);
                 if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
                         outblk = crypto_cursor_segment(&cc_out, &len);
                         if (len < blksz)
                                 outblk = blk;
-                        exf->update(swe->sw_ctx, inblk, blksz);
-                        exf->encrypt(swe->sw_ctx, inblk, outblk);
+                        exf->update(ctx, inblk, blksz);
+                        exf->encrypt(ctx, inblk, outblk);
                         if (outblk == blk)
                                 crypto_cursor_copyback(&cc_out, blksz, blk);
                         else
                                 crypto_cursor_advance(&cc_out, blksz);
                 } else {
                         /*
                          * One of the problems with CCM+CBC is that
                          * the authentication is done on the
                          * unencrypted data.  As a result, we have to
                          * decrypt the data twice: once to generate
                          * the tag and a second time after the tag is
                          * verified.
                          */
-                        exf->decrypt(swe->sw_ctx, inblk, blk);
-                        exf->update(swe->sw_ctx, blk, blksz);
+                        exf->decrypt(ctx, inblk, blk);
+                        exf->update(ctx, blk, blksz);
                 }
         }
         if (resid > 0) {
                 crypto_cursor_copydata(&cc_in, resid, blk);
                 if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
-                        exf->update(swe->sw_ctx, blk, resid);
-                        exf->encrypt_last(swe->sw_ctx, blk, blk, resid);
+                        exf->update(ctx, blk, resid);
+                        exf->encrypt_last(ctx, blk, blk, resid);
                         crypto_cursor_copyback(&cc_out, resid, blk);
                 } else {
-                        exf->decrypt_last(swe->sw_ctx, blk, blk, resid);
-                        exf->update(swe->sw_ctx, blk, resid);
+                        exf->decrypt_last(ctx, blk, blk, resid);
+                        exf->update(ctx, blk, resid);
                 }
         }
 
         /* Finalize MAC */
-        exf->final(tag, swe->sw_ctx);
+        exf->final(tag, ctx);
 
         /* Validate tag */
         error = 0;
         if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
                 u_char tag2[AES_CBC_MAC_HASH_LEN];
 
                 crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen,
                     tag2);
 
                 r = timingsafe_bcmp(tag, tag2, swa->sw_mlen);
                 explicit_bzero(tag2, sizeof(tag2));
                 if (r != 0) {
                         error = EBADMSG;
                         goto out;
                 }
 
                 /* tag matches, decrypt data */
-                exf->reinit(swe->sw_ctx, crp->crp_iv, ivlen);
+                exf->reinit(ctx, crp->crp_iv, ivlen);
                 crypto_cursor_init(&cc_in, &crp->crp_buf);
                 crypto_cursor_advance(&cc_in, crp->crp_payload_start);
                 for (resid = crp->crp_payload_length; resid > blksz;
                      resid -= blksz) {
                         inblk = crypto_cursor_segment(&cc_in, &len);
                         if (len < blksz) {
                                 crypto_cursor_copydata(&cc_in, blksz, blk);
                                 inblk = blk;
                         } else
                                 crypto_cursor_advance(&cc_in, blksz);
                         outblk = crypto_cursor_segment(&cc_out, &len);
                         if (len < blksz)
                                 outblk = blk;
-                        exf->decrypt(swe->sw_ctx, inblk, outblk);
+                        exf->decrypt(ctx, inblk, outblk);
                         if (outblk == blk)
                                 crypto_cursor_copyback(&cc_out, blksz, blk);
                         else
                                 crypto_cursor_advance(&cc_out, blksz);
                 }
                 if (resid > 0) {
                         crypto_cursor_copydata(&cc_in, resid, blk);
-                        exf->decrypt_last(swe->sw_ctx, blk, blk, resid);
+                        exf->decrypt_last(ctx, blk, blk, resid);
                         crypto_cursor_copyback(&cc_out, resid, blk);
                 }
         } else {
                 /* Inject the authentication data */
                 crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
         }
 
 out:
+        explicit_bzero(ctx, exf->ctxsize);
         explicit_bzero(blkbuf, sizeof(blkbuf));
         explicit_bzero(tag, sizeof(tag));
         return (error);
 }
 
 static int
 swcr_chacha20_poly1305(struct swcr_session *ses, struct cryptop *crp)
 {
         const struct crypto_session_params *csp;
         uint64_t blkbuf[howmany(CHACHA20_NATIVE_BLOCK_LEN, sizeof(uint64_t))];
         u_char *blk = (u_char *)blkbuf;
         u_char tag[POLY1305_HASH_LEN];
         struct crypto_buffer_cursor cc_in, cc_out;
         const u_char *inblk;
         u_char *outblk;
         uint64_t *blkp;
-        struct swcr_auth *swa;
-        struct swcr_encdec *swe;
+        const struct swcr_auth *swa;
+        const struct swcr_encdec *swe;
         const struct enc_xform *exf;
+        void *ctx;
         size_t len;
         int blksz, error, r, resid;
 
         swa = &ses->swcr_auth;
         swe = &ses->swcr_encdec;
         exf = swe->sw_exf;
         blksz = exf->native_blocksize;
         KASSERT(blksz <= sizeof(blkbuf), ("%s: blocksize mismatch", __func__));
 
         if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
                 return (EINVAL);
 
         csp = crypto_get_params(crp->crp_session);
 
+        ctx = __builtin_alloca(exf->ctxsize);
         if (crp->crp_cipher_key != NULL)
-                exf->setkey(swe->sw_ctx, crp->crp_cipher_key,
+                exf->setkey(ctx, crp->crp_cipher_key,
                     csp->csp_cipher_klen);
-        exf->reinit(swe->sw_ctx, crp->crp_iv, csp->csp_ivlen);
+        else
+                memcpy(ctx, swe->sw_ctx, exf->ctxsize);
+        exf->reinit(ctx, crp->crp_iv, csp->csp_ivlen);
 
         /* Supply MAC with AAD */
         if (crp->crp_aad != NULL)
-                exf->update(swe->sw_ctx, crp->crp_aad,
-                    crp->crp_aad_length);
+                exf->update(ctx, crp->crp_aad, crp->crp_aad_length);
         else
-                crypto_apply(crp, crp->crp_aad_start,
-                    crp->crp_aad_length, exf->update, swe->sw_ctx);
+                crypto_apply(crp, crp->crp_aad_start, crp->crp_aad_length,
+                    exf->update, ctx);
         if (crp->crp_aad_length % 16 != 0) {
                 /* padding1 */
                 memset(blk, 0, 16);
-                exf->update(swe->sw_ctx, blk,
-                    16 - crp->crp_aad_length % 16);
+                exf->update(ctx, blk, 16 - crp->crp_aad_length % 16);
         }
 
         /* Do encryption with MAC */
         crypto_cursor_init(&cc_in, &crp->crp_buf);
         crypto_cursor_advance(&cc_in, crp->crp_payload_start);
         if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
                 crypto_cursor_init(&cc_out, &crp->crp_obuf);
                 crypto_cursor_advance(&cc_out, crp->crp_payload_output_start);
         } else
                 cc_out = cc_in;
         for (resid = crp->crp_payload_length; resid >= blksz; resid -= blksz) {
                 inblk = crypto_cursor_segment(&cc_in, &len);
                 if (len < blksz) {
                         crypto_cursor_copydata(&cc_in, blksz, blk);
                         inblk = blk;
                 } else
                         crypto_cursor_advance(&cc_in, blksz);
                 if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
                         outblk = crypto_cursor_segment(&cc_out, &len);
                         if (len < blksz)
                                 outblk = blk;
-                        exf->encrypt(swe->sw_ctx, inblk, outblk);
-                        exf->update(swe->sw_ctx, outblk, blksz);
+                        exf->encrypt(ctx, inblk, outblk);
+                        exf->update(ctx, outblk, blksz);
                         if (outblk == blk)
                                 crypto_cursor_copyback(&cc_out, blksz, blk);
                         else
                                 crypto_cursor_advance(&cc_out, blksz);
                 } else {
-                        exf->update(swe->sw_ctx, inblk, blksz);
+                        exf->update(ctx, inblk, blksz);
                 }
         }
         if (resid > 0) {
                 crypto_cursor_copydata(&cc_in, resid, blk);
                 if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
-                        exf->encrypt_last(swe->sw_ctx, blk, blk, resid);
+                        exf->encrypt_last(ctx, blk, blk, resid);
                         crypto_cursor_copyback(&cc_out, resid, blk);
                 }
-                exf->update(swe->sw_ctx, blk, resid);
+                exf->update(ctx, blk, resid);
                 if (resid % 16 != 0) {
                         /* padding2 */
                         memset(blk, 0, 16);
-                        exf->update(swe->sw_ctx, blk, 16 - resid % 16);
+                        exf->update(ctx, blk, 16 - resid % 16);
                 }
         }
 
         /* lengths */
         blkp = (uint64_t *)blk;
         blkp[0] = htole64(crp->crp_aad_length);
         blkp[1] = htole64(crp->crp_payload_length);
-        exf->update(swe->sw_ctx, blk, sizeof(uint64_t) * 2);
+        exf->update(ctx, blk, sizeof(uint64_t) * 2);
 
         /* Finalize MAC */
-        exf->final(tag, swe->sw_ctx);
+        exf->final(tag, ctx);
 
         /* Validate tag */
         error = 0;
         if (!CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
                 u_char tag2[POLY1305_HASH_LEN];
 
                 crypto_copydata(crp, crp->crp_digest_start, swa->sw_mlen, tag2);
 
for (resid = crp->crp_payload_length; resid > blksz;
                         if (len < blksz) {
                                 crypto_cursor_copydata(&cc_in, blksz, blk);
                                 inblk = blk;
                         } else
                                 crypto_cursor_advance(&cc_in, blksz);
                         outblk = crypto_cursor_segment(&cc_out, &len);
                         if (len < blksz)
                                 outblk = blk;
-                        exf->decrypt(swe->sw_ctx, inblk, outblk);
+                        exf->decrypt(ctx, inblk, outblk);
                         if (outblk == blk)
                                 crypto_cursor_copyback(&cc_out, blksz, blk);
                         else
                                 crypto_cursor_advance(&cc_out, blksz);
                 }
                 if (resid > 0) {
                         crypto_cursor_copydata(&cc_in, resid, blk);
-                        exf->decrypt_last(swe->sw_ctx, blk, blk, resid);
+                        exf->decrypt_last(ctx, blk, blk, resid);
                         crypto_cursor_copyback(&cc_out, resid, blk);
                 }
         } else {
                 /* Inject the authentication data */
                 crypto_copyback(crp, crp->crp_digest_start, swa->sw_mlen, tag);
         }
 
 out:
+        explicit_bzero(ctx, exf->ctxsize);
         explicit_bzero(blkbuf, sizeof(blkbuf));
         explicit_bzero(tag, sizeof(tag));
         return (error);
 }
 
 /*
  * Apply a cipher and a digest to perform EtA.
  */
swcr_setup_cipher(struct swcr_session *ses,
     const struct crypto_session_params *csp)
 {
         struct swcr_encdec *swe;
         const struct enc_xform *txf;
         int error;
 
         swe = &ses->swcr_encdec;
         txf = crypto_cipher(csp);
+        if (csp->csp_cipher_key != NULL) {
                 if (txf->ctxsize != 0) {
                         swe->sw_ctx = malloc(txf->ctxsize, M_CRYPTO_DATA,
                             M_NOWAIT);
                         if (swe->sw_ctx == NULL)
                                 return (ENOMEM);
                 }
-        if (csp->csp_cipher_key != NULL) {
                 error = txf->setkey(swe->sw_ctx,
                     csp->csp_cipher_key, csp->csp_cipher_klen);
                 if (error)
                         return (error);
         }
         swe->sw_exf = txf;
         return (0);
 }