6399680 logical provider selects busy member

11 files changed, 150 insertions, 209 deletions

diff --git a/usr/src/uts/common/crypto/api/kcf_cipher.c b/usr/src/uts/common/crypto/api/kcf_cipher.c
index 04eb1e70fd..80b0cf757a 100644
--- a/usr/src/uts/common/crypto/api/kcf_cipher.c
+++ b/usr/src/uts/common/crypto/api/kcf_cipher.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -122,14 +121,12 @@ crypto_cipher_init_prov(crypto_provider_t provider, crypto_session_id_t sid,
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		if (func == CRYPTO_FG_ENCRYPT) {
 			error = kcf_get_hardware_provider(mech->cm_type,
-			    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(cipher_ops),
-			    CRYPTO_CIPHER_OFFSET(encrypt_init),
-			    CHECK_RESTRICT(crq), pd, &real_provider);
+			    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+			    &real_provider, CRYPTO_FG_ENCRYPT);
 		} else {
 			error = kcf_get_hardware_provider(mech->cm_type,
-			    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(cipher_ops),
-			    CRYPTO_CIPHER_OFFSET(decrypt_init),
-			    CHECK_RESTRICT(crq), pd, &real_provider);
+			    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+			    &real_provider, CRYPTO_FG_DECRYPT);
 		}
 
 		if (error != CRYPTO_SUCCESS)
@@ -296,9 +293,8 @@ crypto_encrypt_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		error = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(cipher_ops),
-		    CRYPTO_CIPHER_OFFSET(encrypt_atomic),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_ENCRYPT_ATOMIC);
 
 		if (error != CRYPTO_SUCCESS)
 			return (error);
@@ -573,9 +569,8 @@ crypto_decrypt_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(cipher_ops),
-		    CRYPTO_CIPHER_OFFSET(decrypt_atomic),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_DECRYPT_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
diff --git a/usr/src/uts/common/crypto/api/kcf_digest.c b/usr/src/uts/common/crypto/api/kcf_digest.c
index 0058af01b4..f74a811a79 100644
--- a/usr/src/uts/common/crypto/api/kcf_digest.c
+++ b/usr/src/uts/common/crypto/api/kcf_digest.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -109,9 +108,8 @@ crypto_digest_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(digest_ops),
-		    CRYPTO_DIGEST_OFFSET(digest_atomic), CHECK_RESTRICT(crq),
-		    pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq),
+		    pd, &real_provider, CRYPTO_FG_DIGEST_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -218,9 +216,8 @@ crypto_digest_init_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		error = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(digest_ops),
-		    CRYPTO_DIGEST_OFFSET(digest_init),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_DIGEST);
 
 		if (error != CRYPTO_SUCCESS)
 			return (error);
diff --git a/usr/src/uts/common/crypto/api/kcf_dual.c b/usr/src/uts/common/crypto/api/kcf_dual.c
index 2dc8b34a66..8b0e6b79e6 100644
--- a/usr/src/uts/common/crypto/api/kcf_dual.c
+++ b/usr/src/uts/common/crypto/api/kcf_dual.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -74,9 +73,8 @@ crypto_encrypt_mac_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(encr_mech->cm_type,
-		    mac_mech->cm_type, CRYPTO_OPS_OFFSET(dual_cipher_mac_ops),
-		    CRYPTO_CIPHER_MAC_OFFSET(encrypt_mac_atomic),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    mac_mech->cm_type, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_ENCRYPT_MAC_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -441,9 +439,8 @@ crypto_encrypt_mac_init_prov(crypto_provider_t provider,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(encr_mech->cm_type,
-		    mac_mech->cm_type, CRYPTO_OPS_OFFSET(dual_cipher_mac_ops),
-		    CRYPTO_CIPHER_MAC_OFFSET(encrypt_mac_init),
-		    CHECK_RESTRICT(cr), pd, &real_provider);
+		    mac_mech->cm_type, CHECK_RESTRICT(cr), pd, &real_provider,
+		    CRYPTO_FG_ENCRYPT_MAC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -1423,19 +1420,9 @@ crypto_mac_decrypt_common_prov(crypto_provider_t provider,
 	ASSERT(KCF_PROV_REFHELD(pd));
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
-		if (do_verify) {
-			error = kcf_get_hardware_provider(decr_mech->cm_type,
-			    mac_mech->cm_type,
-			    CRYPTO_OPS_OFFSET(dual_cipher_mac_ops),
-			    CRYPTO_CIPHER_MAC_OFFSET(mac_verify_decrypt_atomic),
-			    CHECK_RESTRICT(crq), pd, &real_provider);
-		} else {
-			error = kcf_get_hardware_provider(decr_mech->cm_type,
-			    mac_mech->cm_type,
-			    CRYPTO_OPS_OFFSET(dual_cipher_mac_ops),
-			    CRYPTO_CIPHER_MAC_OFFSET(mac_decrypt_atomic),
-			    CHECK_RESTRICT(crq), pd, &real_provider);
-		}
+		error = kcf_get_hardware_provider(decr_mech->cm_type,
+		    mac_mech->cm_type, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_MAC_DECRYPT_ATOMIC);
 
 		if (error != CRYPTO_SUCCESS)
 			return (error);
@@ -1883,9 +1870,8 @@ crypto_mac_decrypt_init_prov(crypto_provider_t provider,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(decr_mech->cm_type,
-		    mac_mech->cm_type, CRYPTO_OPS_OFFSET(dual_cipher_mac_ops),
-		    CRYPTO_CIPHER_MAC_OFFSET(mac_decrypt_init),
-		    CHECK_RESTRICT(cr), pd, &real_provider);
+		    mac_mech->cm_type, CHECK_RESTRICT(cr), pd, &real_provider,
+		    CRYPTO_FG_MAC_DECRYPT);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
diff --git a/usr/src/uts/common/crypto/api/kcf_keys.c b/usr/src/uts/common/crypto/api/kcf_keys.c
index c95fd9f72d..eb83dcb2f2 100644
--- a/usr/src/uts/common/crypto/api/kcf_keys.c
+++ b/usr/src/uts/common/crypto/api/kcf_keys.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -55,9 +54,8 @@ crypto_key_generate(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(key_ops),
-		    CRYPTO_KEY_OFFSET(key_generate), CHECK_RESTRICT(crq),
-		    pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq),
+		    pd, &real_provider, CRYPTO_FG_GENERATE);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -95,9 +93,8 @@ crypto_key_generate_pair(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(key_ops),
-		    CRYPTO_KEY_OFFSET(key_generate_pair), CHECK_RESTRICT(crq),
-		    pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq),
+		    pd, &real_provider, CRYPTO_FG_GENERATE_KEY_PAIR);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -136,9 +133,8 @@ crypto_key_wrap(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(key_ops),
-		    CRYPTO_KEY_OFFSET(key_wrap), CHECK_RESTRICT(crq),
-		    pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq),
+		    pd, &real_provider, CRYPTO_FG_WRAP);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -177,9 +173,8 @@ crypto_key_unwrap(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(key_ops),
-		    CRYPTO_KEY_OFFSET(key_unwrap), CHECK_RESTRICT(crq),
-		    pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq),
+		    pd, &real_provider, CRYPTO_FG_UNWRAP);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -218,9 +213,8 @@ crypto_key_derive(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(key_ops),
-		    CRYPTO_KEY_OFFSET(key_derive), CHECK_RESTRICT(crq),
-		    pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq),
+		    pd, &real_provider, CRYPTO_FG_DERIVE);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
diff --git a/usr/src/uts/common/crypto/api/kcf_mac.c b/usr/src/uts/common/crypto/api/kcf_mac.c
index 57b2a7595f..c0d28a875c 100644
--- a/usr/src/uts/common/crypto/api/kcf_mac.c
+++ b/usr/src/uts/common/crypto/api/kcf_mac.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -109,9 +108,8 @@ crypto_mac_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(mac_ops),
-		    CRYPTO_MAC_OFFSET(mac_atomic),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_MAC_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -223,9 +221,8 @@ crypto_mac_verify_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(mac_ops),
-		    CRYPTO_MAC_OFFSET(mac_verify_atomic),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_MAC_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -370,9 +367,8 @@ crypto_mac_init_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(mac_ops),
-		    CRYPTO_MAC_OFFSET(mac_init),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_MAC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
diff --git a/usr/src/uts/common/crypto/api/kcf_miscapi.c b/usr/src/uts/common/crypto/api/kcf_miscapi.c
index 6242df6dc8..ca84a65c32 100644
--- a/usr/src/uts/common/crypto/api/kcf_miscapi.c
+++ b/usr/src/uts/common/crypto/api/kcf_miscapi.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -595,14 +594,9 @@ crypto_key_check_prov(crypto_provider_t provider, crypto_mechanism_t *mech,
 	    (key->ck_format == CRYPTO_KEY_REFERENCE))
 		return (CRYPTO_ARGUMENTS_BAD);
 
+	/* no logical providers currently support the key check */
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
-		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(key_ops),
-		    CRYPTO_KEY_OFFSET(key_check), CHECK_RESTRICT_FALSE,
-		    pd, &real_provider);
-
-		if (rv != CRYPTO_SUCCESS)
-			return (rv);
+		return (CRYPTO_NOT_SUPPORTED);
 	}
 
 	lmech = *mech;
diff --git a/usr/src/uts/common/crypto/api/kcf_sign.c b/usr/src/uts/common/crypto/api/kcf_sign.c
index c098f0ca10..867e3b597b 100644
--- a/usr/src/uts/common/crypto/api/kcf_sign.c
+++ b/usr/src/uts/common/crypto/api/kcf_sign.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -61,9 +60,8 @@ crypto_sign_init_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(sign_ops),
-		    CRYPTO_SIGN_OFFSET(sign_init),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_SIGN);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -249,9 +247,8 @@ crypto_sign_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(sign_ops),
-		    CRYPTO_SIGN_OFFSET(sign_atomic), CHECK_RESTRICT(crq),
-		    pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq),
+		    pd, &real_provider, CRYPTO_FG_SIGN_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -370,9 +367,8 @@ crypto_sign_recover_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(sign_ops),
-		    CRYPTO_SIGN_OFFSET(sign_recover_atomic),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_SIGN_RECOVER_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -410,9 +406,8 @@ crypto_sign_recover_init_prov(crypto_provider_t provider,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(sign_ops),
-		    CRYPTO_SIGN_OFFSET(sign_recover_init),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_SIGN_RECOVER);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
diff --git a/usr/src/uts/common/crypto/api/kcf_verify.c b/usr/src/uts/common/crypto/api/kcf_verify.c
index dee7197df2..24c35ab50b 100644
--- a/usr/src/uts/common/crypto/api/kcf_verify.c
+++ b/usr/src/uts/common/crypto/api/kcf_verify.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -61,9 +60,8 @@ crypto_verify_init_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(verify_ops),
-		    CRYPTO_VERIFY_OFFSET(verify_init),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_VERIFY);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -251,9 +249,8 @@ crypto_verify_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(verify_ops),
-		    CRYPTO_VERIFY_OFFSET(verify_atomic), CHECK_RESTRICT(crq),
-		    pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq),
+		    pd, &real_provider, CRYPTO_FG_VERIFY_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -372,9 +369,8 @@ crypto_verify_recover_prov(crypto_provider_t provider, crypto_session_id_t sid,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(verify_ops),
-		    CRYPTO_VERIFY_OFFSET(verify_recover_atomic),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_VERIFY_RECOVER_ATOMIC);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
@@ -412,9 +408,8 @@ crypto_verify_recover_init_prov(crypto_provider_t provider,
 
 	if (pd->pd_prov_type == CRYPTO_LOGICAL_PROVIDER) {
 		rv = kcf_get_hardware_provider(mech->cm_type,
-		    CRYPTO_MECH_INVALID, CRYPTO_OPS_OFFSET(verify_ops),
-		    CRYPTO_VERIFY_OFFSET(verify_recover_init),
-		    CHECK_RESTRICT(crq), pd, &real_provider);
+		    CRYPTO_MECH_INVALID, CHECK_RESTRICT(crq), pd,
+		    &real_provider, CRYPTO_FG_VERIFY_RECOVER);
 
 		if (rv != CRYPTO_SUCCESS)
 			return (rv);
diff --git a/usr/src/uts/common/crypto/core/kcf_callprov.c b/usr/src/uts/common/crypto/core/kcf_callprov.c
index 02a9ee96d7..2f51ae27fd 100644
--- a/usr/src/uts/common/crypto/core/kcf_callprov.c
+++ b/usr/src/uts/common/crypto/core/kcf_callprov.c
@@ -98,7 +98,8 @@ is_in_triedlist(kcf_provider_desc_t *pd, kcf_prov_tried_t *triedl)
  * provider. Return true if found.
  */
 static boolean_t
-is_valid_provider_for_mech(kcf_provider_desc_t *pd, kcf_mech_entry_t *me)
+is_valid_provider_for_mech(kcf_provider_desc_t *pd, kcf_mech_entry_t *me,
+    crypto_func_group_t fg)
 {
 	kcf_prov_mech_desc_t *prov_chain;
 
@@ -106,7 +107,8 @@ is_valid_provider_for_mech(kcf_provider_desc_t *pd, kcf_mech_entry_t *me)
 	if (prov_chain != NULL) {
 		ASSERT(me->me_num_hwprov > 0);
 		for (; prov_chain != NULL; prov_chain = prov_chain->pm_next) {
-			if (prov_chain->pm_prov_desc == pd) {
+			if (prov_chain->pm_prov_desc == pd &&
+			    IS_FG_SUPPORTED(prov_chain, fg)) {
 				return (B_TRUE);
 			}
 		}
@@ -127,16 +129,16 @@ is_valid_provider_for_mech(kcf_provider_desc_t *pd, kcf_mech_entry_t *me)
  */
 int
 kcf_get_hardware_provider(crypto_mech_type_t mech_type_1,
-    crypto_mech_type_t mech_type_2, offset_t offset_1, offset_t offset_2,
-    boolean_t call_restrict, kcf_provider_desc_t *old,
-    kcf_provider_desc_t **new)
+    crypto_mech_type_t mech_type_2, boolean_t call_restrict,
+    kcf_provider_desc_t *old, kcf_provider_desc_t **new, crypto_func_group_t fg)
 {
-	kcf_provider_desc_t *provider, *gpd = NULL, *real_pd = old;
+	kcf_provider_desc_t *provider, *real_pd = old;
+	kcf_provider_desc_t *gpd = NULL;	/* good provider */
+	kcf_provider_desc_t *bpd = NULL;	/* busy provider */
 	kcf_provider_list_t *p;
 	kcf_ops_class_t class;
 	kcf_mech_entry_t *me;
 	kcf_mech_entry_tab_t *me_tab;
-	caddr_t *ops;
 	int index, len, gqlen = INT_MAX, rv = CRYPTO_SUCCESS;
 
 	/* get the mech entry for the specified mechanism */
@@ -181,13 +183,12 @@ kcf_get_hardware_provider(crypto_mech_type_t mech_type_1,
 			ASSERT(provider->pd_prov_type !=
 			    CRYPTO_LOGICAL_PROVIDER);
 
-			if (!KCF_IS_PROV_USABLE(provider) ||
-			    (call_restrict && provider->pd_restricted)) {
+			if (call_restrict && provider->pd_restricted) {
 				p = p->pl_next;
 				continue;
 			}
 
-			if (!is_valid_provider_for_mech(provider, me)) {
+			if (!is_valid_provider_for_mech(provider, me, fg)) {
 				p = p->pl_next;
 				continue;
 			}
@@ -214,8 +215,10 @@ kcf_get_hardware_provider(crypto_mech_type_t mech_type_1,
 				}
 			}
 
-			if (KCF_PROV_NULL_ENTRY_POINT(provider, offset_1,
-			    offset_2, ops)) {
+			if (provider->pd_state != KCF_PROV_READY) {
+				/* choose BUSY if no READY providers */
+				if (provider->pd_state == KCF_PROV_BUSY)
+					bpd = provider;
 				p = p->pl_next;
 				continue;
 			}
@@ -232,6 +235,9 @@ kcf_get_hardware_provider(crypto_mech_type_t mech_type_1,
 		if (gpd != NULL) {
 			real_pd = gpd;
 			KCF_PROV_REFHOLD(real_pd);
+		} else if (bpd != NULL) {
+			real_pd = bpd;
+			KCF_PROV_REFHOLD(real_pd);
 		} else {
 			/* can't find provider */
 			real_pd = NULL;
@@ -247,17 +253,12 @@ kcf_get_hardware_provider(crypto_mech_type_t mech_type_1,
 			goto out;
 		}
 
-		if (!is_valid_provider_for_mech(old, me)) {
+		if (!is_valid_provider_for_mech(old, me, fg)) {
 			real_pd = NULL;
 			rv = CRYPTO_MECHANISM_INVALID;
 			goto out;
 		}
 
-		if (KCF_PROV_NULL_ENTRY_POINT(old, offset_1, offset_2, ops)) {
-			real_pd = NULL;
-			rv = CRYPTO_NOT_SUPPORTED;
-			goto out;
-		}
 		KCF_PROV_REFHOLD(real_pd);
 	}
 out:
@@ -280,7 +281,9 @@ kcf_get_hardware_provider_nomech(offset_t offset_1, offset_t offset_2,
     boolean_t call_restrict, kcf_provider_desc_t *old,
     kcf_provider_desc_t **new)
 {
-	kcf_provider_desc_t *provider, *gpd = NULL, *real_pd = old;
+	kcf_provider_desc_t *provider, *real_pd = old;
+	kcf_provider_desc_t *gpd = NULL;	/* good provider */
+	kcf_provider_desc_t *bpd = NULL;	/* busy provider */
 	kcf_provider_list_t *p;
 	caddr_t *ops;
 	int len, gqlen = INT_MAX, rv = CRYPTO_SUCCESS;
@@ -312,18 +315,24 @@ kcf_get_hardware_provider_nomech(offset_t offset_1, offset_t offset_2,
 			ASSERT(provider->pd_prov_type !=
 			    CRYPTO_LOGICAL_PROVIDER);
 
-			if (!KCF_IS_PROV_USABLE(provider) ||
-			    (call_restrict && provider->pd_restricted)) {
+			if (call_restrict && provider->pd_restricted) {
 				p = p->pl_next;
 				continue;
 			}
-
 			if (KCF_PROV_NULL_ENTRY_POINT(provider, offset_1,
 			    offset_2, ops)) {
 				p = p->pl_next;
 				continue;
 			}
 
+			if (provider->pd_state != KCF_PROV_READY) {
+				/* choose BUSY if no READY providers */
+				if (provider->pd_state == KCF_PROV_BUSY)
+					bpd = provider;
+				p = p->pl_next;
+				continue;
+			}
+
 			len = provider->pd_sched_info.ks_taskq->tq_nalloc;
 			if (len < gqlen) {
 				gqlen = len;
@@ -337,6 +346,9 @@ kcf_get_hardware_provider_nomech(offset_t offset_1, offset_t offset_2,
 		if (gpd != NULL) {
 			real_pd = gpd;
 			KCF_PROV_REFHOLD(real_pd);
+		} else if (bpd != NULL) {
+			real_pd = bpd;
+			KCF_PROV_REFHOLD(real_pd);
 		} else {
 			/* can't find provider */
 			real_pd = NULL;
diff --git a/usr/src/uts/common/crypto/io/crypto.c b/usr/src/uts/common/crypto/io/crypto.c
index 8d49166597..491e318ca9 100644
--- a/usr/src/uts/common/crypto/io/crypto.c
+++ b/usr/src/uts/common/crypto/io/crypto.c
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -139,7 +138,6 @@ size_t crypto_max_buffer_len = CRYPTO_MAX_BUFFER_LEN;
 	(data).cd_offset = 0;					\
 	(data).cd_length = len;
 
-static crypto_mech_type_t random_mech = CRYPTO_MECH_INVALID;
 static struct kmem_cache *crypto_session_cache;
 static crypto_minor_t **crypto_minors = NULL;
 static dev_info_t *crypto_dip = NULL;
@@ -160,14 +158,9 @@ static kcondvar_t crypto_cv;
 #define	DONT_RETURN_LIST		B_FALSE
 
 #define	CRYPTO_OPS_OFFSET(f)		offsetof(crypto_ops_t, co_##f)
-#define	CRYPTO_DIGEST_OFFSET(f)		offsetof(crypto_digest_ops_t, f)
-#define	CRYPTO_CIPHER_OFFSET(f)		offsetof(crypto_cipher_ops_t, f)
-#define	CRYPTO_SIGN_OFFSET(f)		offsetof(crypto_sign_ops_t, f)
-#define	CRYPTO_VERIFY_OFFSET(f)		offsetof(crypto_verify_ops_t, f)
 #define	CRYPTO_RANDOM_OFFSET(f)		offsetof(crypto_random_number_ops_t, f)
 #define	CRYPTO_SESSION_OFFSET(f)	offsetof(crypto_session_ops_t, f)
 #define	CRYPTO_OBJECT_OFFSET(f)		offsetof(crypto_object_ops_t, f)
-#define	CRYPTO_KEY_OFFSET(f)		offsetof(crypto_key_ops_t, f)
 #define	CRYPTO_PROVIDER_OFFSET(f)	\
 	offsetof(crypto_provider_management_ops_t, f)
 
@@ -2342,10 +2335,10 @@ cipher_init(dev_t dev, caddr_t arg, int mode, int (*init)(crypto_provider_t,
 	size_t mech_rctl_bytes = 0;
 	size_t key_rctl_bytes = 0;
 	size_t carry;
-	offset_t offset;
 	int error = 0;
 	int rv;
 	boolean_t allocated_by_crypto_module = B_FALSE;
+	crypto_func_group_t fg;
 
 	STRUCT_INIT(encrypt_init, mode);
 
@@ -2372,14 +2365,15 @@ cipher_init(dev_t dev, caddr_t arg, int mode, int (*init)(crypto_provider_t,
 	bcopy(STRUCT_FADDR(encrypt_init, ei_mech), &mech.cm_type,
 	    sizeof (crypto_mech_type_t));
 
-	if (init == crypto_encrypt_init_prov)
-	    offset = CRYPTO_CIPHER_OFFSET(encrypt_init);
-	else
-	    offset = CRYPTO_CIPHER_OFFSET(decrypt_init);
+	if (init == crypto_encrypt_init_prov) {
+		fg = CRYPTO_FG_ENCRYPT;
+	} else {
+		fg = CRYPTO_FG_DECRYPT;
+	}
 
 	if ((rv = kcf_get_hardware_provider(mech.cm_type, CRYPTO_MECH_INVALID,
-	    CRYPTO_OPS_OFFSET(cipher_ops), offset, CHECK_RESTRICT_FALSE,
-	    sp->sd_provider, &real_provider)) != CRYPTO_SUCCESS) {
+	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider, fg))
+	    != CRYPTO_SUCCESS) {
 		goto out;
 	}
 
@@ -2937,9 +2931,8 @@ digest_init(dev_t dev, caddr_t arg, int mode, int *rval)
 	}
 
 	if ((rv = kcf_get_hardware_provider(mech.cm_type, CRYPTO_MECH_INVALID,
-	    CRYPTO_OPS_OFFSET(digest_ops), CRYPTO_DIGEST_OFFSET(digest_init),
-	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider))
-	    != CRYPTO_SUCCESS) {
+	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider,
+	    CRYPTO_FG_DIGEST)) != CRYPTO_SUCCESS) {
 		goto out;
 	}
 
@@ -3597,10 +3590,10 @@ sign_verify_init(dev_t dev, caddr_t arg, int mode,
 	size_t mech_rctl_bytes = 0;
 	size_t key_rctl_bytes = 0;
 	size_t carry;
-	offset_t offset_1, offset_2;
 	int error = 0;
 	int rv;
 	boolean_t allocated_by_crypto_module = B_FALSE;
+	crypto_func_group_t fg;
 
 	STRUCT_INIT(sign_init, mode);
 
@@ -3632,26 +3625,22 @@ sign_verify_init(dev_t dev, caddr_t arg, int mode,
 	    init == crypto_verify_recover_init_prov);
 
 	if (init == crypto_sign_init_prov) {
-		offset_1 = CRYPTO_OPS_OFFSET(sign_ops);
-		offset_2 = CRYPTO_SIGN_OFFSET(sign_init);
+		fg =  CRYPTO_FG_SIGN;
 		ctxpp = &sp->sd_sign_ctx;
 	} else if (init == crypto_verify_init_prov) {
-		offset_1 = CRYPTO_OPS_OFFSET(verify_ops);
-		offset_2 = CRYPTO_VERIFY_OFFSET(verify_init);
+		fg =  CRYPTO_FG_VERIFY;
 		ctxpp = &sp->sd_verify_ctx;
 	} else if (init == crypto_sign_recover_init_prov) {
-		offset_1 = CRYPTO_OPS_OFFSET(sign_ops);
-		offset_2 = CRYPTO_SIGN_OFFSET(sign_recover_init);
+		fg =  CRYPTO_FG_SIGN_RECOVER;
 		ctxpp = &sp->sd_sign_recover_ctx;
 	} else {
-		offset_1 = CRYPTO_OPS_OFFSET(verify_ops);
-		offset_2 = CRYPTO_VERIFY_OFFSET(verify_recover_init);
+		fg =  CRYPTO_FG_VERIFY_RECOVER;
 		ctxpp = &sp->sd_verify_recover_ctx;
 	}
 
 	if ((rv = kcf_get_hardware_provider(mech.cm_type, CRYPTO_MECH_INVALID,
-	    offset_1, offset_2, CHECK_RESTRICT_FALSE, sp->sd_provider,
-	    &real_provider)) != CRYPTO_SUCCESS) {
+	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider, fg))
+	    != CRYPTO_SUCCESS) {
 		goto out;
 	}
 
@@ -4089,10 +4078,7 @@ seed_random(dev_t dev, caddr_t arg, int mode, int *rval)
 		goto release_minor;
 	}
 
-	if (random_mech == CRYPTO_MECH_INVALID)
-		random_mech = crypto_mech2id_common(SUN_RANDOM, B_FALSE);
-
-	if ((rv = kcf_get_hardware_provider(random_mech, CRYPTO_MECH_INVALID,
+	if ((rv = kcf_get_hardware_provider_nomech(
 	    CRYPTO_OPS_OFFSET(random_ops), CRYPTO_RANDOM_OFFSET(seed_random),
 	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider))
 	    != CRYPTO_SUCCESS) {
@@ -4182,10 +4168,7 @@ generate_random(dev_t dev, caddr_t arg, int mode, int *rval)
 		goto release_minor;
 	}
 
-	if (random_mech == CRYPTO_MECH_INVALID)
-		random_mech = crypto_mech2id_common(SUN_RANDOM, B_FALSE);
-
-	if ((rv = kcf_get_hardware_provider(random_mech, CRYPTO_MECH_INVALID,
+	if ((rv = kcf_get_hardware_provider_nomech(
 	    CRYPTO_OPS_OFFSET(random_ops),
 	    CRYPTO_RANDOM_OFFSET(generate_random), CHECK_RESTRICT_FALSE,
 	    sp->sd_provider, &real_provider)) != CRYPTO_SUCCESS) {
@@ -5144,9 +5127,8 @@ object_generate_key(dev_t dev, caddr_t arg, int mode, int *rval)
 	    sizeof (crypto_mech_type_t));
 
 	if ((rv = kcf_get_hardware_provider(mech.cm_type, CRYPTO_MECH_INVALID,
-	    CRYPTO_OPS_OFFSET(key_ops), CRYPTO_KEY_OFFSET(key_generate),
-	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider))
-	    != CRYPTO_SUCCESS) {
+	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider,
+	    CRYPTO_FG_GENERATE)) != CRYPTO_SUCCESS) {
 		goto release_minor;
 	}
 
@@ -5278,9 +5260,8 @@ object_generate_key_pair(dev_t dev, caddr_t arg, int mode, int *rval)
 	    sizeof (crypto_mech_type_t));
 
 	if ((rv = kcf_get_hardware_provider(mech.cm_type, CRYPTO_MECH_INVALID,
-	    CRYPTO_OPS_OFFSET(key_ops), CRYPTO_KEY_OFFSET(key_generate_pair),
-	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider))
-	    != CRYPTO_SUCCESS) {
+	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider,
+	    CRYPTO_FG_GENERATE_KEY_PAIR)) != CRYPTO_SUCCESS) {
 		goto release_minor;
 	}
 
@@ -5432,9 +5413,8 @@ object_wrap_key(dev_t dev, caddr_t arg, int mode, int *rval)
 	    sizeof (crypto_mech_type_t));
 
 	if ((rv = kcf_get_hardware_provider(mech.cm_type, CRYPTO_MECH_INVALID,
-	    CRYPTO_OPS_OFFSET(key_ops), CRYPTO_KEY_OFFSET(key_wrap),
-	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider))
-	    != CRYPTO_SUCCESS) {
+	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider,
+	    CRYPTO_FG_WRAP)) != CRYPTO_SUCCESS) {
 		goto out;
 	}
 
@@ -5599,9 +5579,8 @@ object_unwrap_key(dev_t dev, caddr_t arg, int mode, int *rval)
 	    sizeof (crypto_mech_type_t));
 
 	if ((rv = kcf_get_hardware_provider(mech.cm_type, CRYPTO_MECH_INVALID,
-	    CRYPTO_OPS_OFFSET(key_ops), CRYPTO_KEY_OFFSET(key_unwrap),
-	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider))
-	    != CRYPTO_SUCCESS) {
+	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider,
+	    CRYPTO_FG_UNWRAP)) != CRYPTO_SUCCESS) {
 		goto release_minor;
 	}
 
@@ -5770,9 +5749,8 @@ object_derive_key(dev_t dev, caddr_t arg, int mode, int *rval)
 	    sizeof (crypto_mech_type_t));
 
 	if ((rv = kcf_get_hardware_provider(mech.cm_type, CRYPTO_MECH_INVALID,
-	    CRYPTO_OPS_OFFSET(key_ops), CRYPTO_KEY_OFFSET(key_derive),
-	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider))
-	    != CRYPTO_SUCCESS) {
+	    CHECK_RESTRICT_FALSE, sp->sd_provider, &real_provider,
+	    CRYPTO_FG_DERIVE)) != CRYPTO_SUCCESS) {
 		goto release_minor;
 	}
 
diff --git a/usr/src/uts/common/sys/crypto/sched_impl.h b/usr/src/uts/common/sys/crypto/sched_impl.h
index ebd40bedd5..5536a1c236 100644
--- a/usr/src/uts/common/sys/crypto/sched_impl.h
+++ b/usr/src/uts/common/sys/crypto/sched_impl.h
@@ -2,9 +2,8 @@
  * CDDL HEADER START
  *
  * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  * or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -487,8 +486,8 @@ extern kcondvar_t ntfy_list_cv;
 boolean_t kcf_get_next_logical_provider_member(kcf_provider_desc_t *,
     kcf_provider_desc_t *, kcf_provider_desc_t **);
 extern int kcf_get_hardware_provider(crypto_mech_type_t, crypto_mech_type_t,
-    offset_t, offset_t, boolean_t, kcf_provider_desc_t *,
-    kcf_provider_desc_t **);
+    boolean_t, kcf_provider_desc_t *, kcf_provider_desc_t **,
+    crypto_func_group_t);
 extern int kcf_get_hardware_provider_nomech(offset_t, offset_t,
     boolean_t, kcf_provider_desc_t *, kcf_provider_desc_t **);
 extern void kcf_free_triedlist(kcf_prov_tried_t *);