3 files changed, 124 insertions, 148 deletions

diff --git a/sys/kgssapi/krb5/kcrypto_aes.c b/sys/kgssapi/krb5/kcrypto_aes.c
index 9d0f98c06ea12..54c5b06d69192 100644
--- a/sys/kgssapi/krb5/kcrypto_aes.c
+++ b/sys/kgssapi/krb5/kcrypto_aes.c
@@ -77,7 +77,7 @@ aes_set_key(struct krb5_key_state *ks, const void *in)
 {
 	void *kp = ks->ks_key;
 	struct aes_state *as = ks->ks_priv;
-	struct cryptoini cri;
+	struct crypto_session_params csp;
 
 	if (kp != in)
 		bcopy(in, kp, ks->ks_class->ec_keylen);
@@ -90,22 +90,22 @@ aes_set_key(struct krb5_key_state *ks, const void *in)
 	/*
 	 * We only want the first 96 bits of the HMAC.
 	 */
-	bzero(&cri, sizeof(cri));
-	cri.cri_alg = CRYPTO_SHA1_HMAC;
-	cri.cri_klen = ks->ks_class->ec_keybits;
-	cri.cri_mlen = 12;
-	cri.cri_key = ks->ks_key;
-	cri.cri_next = NULL;
-	crypto_newsession(&as->as_session_sha1, &cri,
+	memset(&csp, 0, sizeof(csp));
+	csp.csp_mode = CSP_MODE_DIGEST;
+	csp.csp_auth_alg = CRYPTO_SHA1_HMAC;
+	csp.csp_auth_klen = ks->ks_class->ec_keybits / 8;
+	csp.csp_auth_mlen = 12;
+	csp.csp_auth_key = ks->ks_key;
+	crypto_newsession(&as->as_session_sha1, &csp,
 	    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
 
-	bzero(&cri, sizeof(cri));
-	cri.cri_alg = CRYPTO_AES_CBC;
-	cri.cri_klen = ks->ks_class->ec_keybits;
-	cri.cri_mlen = 0;
-	cri.cri_key = ks->ks_key;
-	cri.cri_next = NULL;
-	crypto_newsession(&as->as_session_aes, &cri,
+	memset(&csp, 0, sizeof(csp));
+	csp.csp_mode = CSP_MODE_CIPHER;
+	csp.csp_cipher_alg = CRYPTO_AES_CBC;
+	csp.csp_cipher_klen = ks->ks_class->ec_keybits / 8;
+	csp.csp_cipher_key = ks->ks_key;
+	csp.csp_ivlen = 16;
+	crypto_newsession(&as->as_session_aes, &csp,
 	    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
 }
 
@@ -138,31 +138,27 @@ aes_crypto_cb(struct cryptop *crp)
 
 static void
 aes_encrypt_1(const struct krb5_key_state *ks, int buftype, void *buf,
-    size_t skip, size_t len, void *ivec, int encdec)
+    size_t skip, size_t len, void *ivec, bool encrypt)
 {
 	struct aes_state *as = ks->ks_priv;
 	struct cryptop *crp;
-	struct cryptodesc *crd;
 	int error;
 
-	crp = crypto_getreq(1);
-	crd = crp->crp_desc;
+	crp = crypto_getreq(as->as_session_aes, M_WAITOK);
 
-	crd->crd_skip = skip;
-	crd->crd_len = len;
-	crd->crd_flags = CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT | encdec;
+	crp->crp_payload_start = skip;
+	crp->crp_payload_length = len;
+	crp->crp_op = encrypt ? CRYPTO_OP_ENCRYPT : CRYPTO_OP_DECRYPT;
+	crp->crp_flags = CRYPTO_F_CBIFSYNC | CRYPTO_F_IV_SEPARATE;
 	if (ivec) {
-		bcopy(ivec, crd->crd_iv, 16);
+		memcpy(crp->crp_iv, ivec, 16);
 	} else {
-		bzero(crd->crd_iv, 16);
+		memset(crp->crp_iv, 0, 16);
 	}
-	crd->crd_next = NULL;
-	crd->crd_alg = CRYPTO_AES_CBC;
 
-	crp->crp_session = as->as_session_aes;
-	crp->crp_flags = buftype | CRYPTO_F_CBIFSYNC;
+	crp->crp_buf_type = buftype;
 	crp->crp_buf = buf;
-	crp->crp_opaque = (void *) as;
+	crp->crp_opaque = as;
 	crp->crp_callback = aes_crypto_cb;
 
 	error = crypto_dispatch(crp);
@@ -204,16 +200,16 @@ aes_encrypt(const struct krb5_key_state *ks, struct mbuf *inout,
 		/*
 		 * Note: caller will ensure len >= blocklen.
 		 */
-		aes_encrypt_1(ks, CRYPTO_F_IMBUF, inout, skip, len, ivec,
-		    CRD_F_ENCRYPT);
+		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec,
+		    true);
 	} else if (plen == 0) {
 		/*
 		 * This is equivalent to CBC mode followed by swapping
 		 * the last two blocks. We assume that neither of the
 		 * last two blocks cross iov boundaries.
 		 */
-		aes_encrypt_1(ks, CRYPTO_F_IMBUF, inout, skip, len, ivec,
-		    CRD_F_ENCRYPT);
+		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec,
+		    true);
 		off = skip + len - 2 * blocklen;
 		m_copydata(inout, off, 2 * blocklen, (void*) &last2);
 		m_copyback(inout, off, blocklen, last2.cn);
@@ -227,8 +223,8 @@ aes_encrypt(const struct krb5_key_state *ks, struct mbuf *inout,
 		 * the encrypted versions of the last two blocks, we
 		 * reshuffle to create the final result.
 		 */
-		aes_encrypt_1(ks, CRYPTO_F_IMBUF, inout, skip, len - plen,
-		    ivec, CRD_F_ENCRYPT);
+		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len - plen,
+		    ivec, true);
 
 		/*
 		 * Copy out the last two blocks, pad the last block
@@ -241,8 +237,8 @@ aes_encrypt(const struct krb5_key_state *ks, struct mbuf *inout,
 		m_copydata(inout, off, blocklen + plen, (void*) &last2);
 		for (i = plen; i < blocklen; i++)
 			last2.cn[i] = 0;
-		aes_encrypt_1(ks, 0, last2.cn, 0, blocklen, last2.cn_1,
-		    CRD_F_ENCRYPT);
+		aes_encrypt_1(ks, CRYPTO_BUF_CONTIG, last2.cn, 0, blocklen,
+		    last2.cn_1, true);
 		m_copyback(inout, off, blocklen, last2.cn);
 		m_copyback(inout, off + blocklen, plen, last2.cn_1);
 	}
@@ -274,7 +270,8 @@ aes_decrypt(const struct krb5_key_state *ks, struct mbuf *inout,
 		/*
 		 * Note: caller will ensure len >= blocklen.
 		 */
-		aes_encrypt_1(ks, CRYPTO_F_IMBUF, inout, skip, len, ivec, 0);
+		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec,
+		    false);
 	} else if (plen == 0) {
 		/*
 		 * This is equivalent to CBC mode followed by swapping
@@ -284,7 +281,8 @@ aes_decrypt(const struct krb5_key_state *ks, struct mbuf *inout,
 		m_copydata(inout, off, 2 * blocklen, (void*) &last2);
 		m_copyback(inout, off, blocklen, last2.cn);
 		m_copyback(inout, off + blocklen, blocklen, last2.cn_1);
-		aes_encrypt_1(ks, CRYPTO_F_IMBUF, inout, skip, len, ivec, 0);
+		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec,
+		    false);
 	} else {
 		/*
 		 * This is the difficult case. We first decrypt the
@@ -298,8 +296,8 @@ aes_decrypt(const struct krb5_key_state *ks, struct mbuf *inout,
 		 * decrypted with the rest in CBC mode.
 		 */
 		off = skip + len - plen - blocklen;
-		aes_encrypt_1(ks, CRYPTO_F_IMBUF, inout, off, blocklen,
-		    NULL, 0);
+		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, off, blocklen,
+		    NULL, false);
 		m_copydata(inout, off, blocklen + plen, (void*) &last2);
 
 		for (i = 0; i < plen; i++) {
@@ -309,8 +307,8 @@ aes_decrypt(const struct krb5_key_state *ks, struct mbuf *inout,
 		}
 
 		m_copyback(inout, off, blocklen + plen, (void*) &last2);
-		aes_encrypt_1(ks, CRYPTO_F_IMBUF, inout, skip, len - plen,
-		    ivec, 0);
+		aes_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len - plen,
+		    ivec, false);
 	}
 
 }
@@ -321,26 +319,17 @@ aes_checksum(const struct krb5_key_state *ks, int usage,
 {
 	struct aes_state *as = ks->ks_priv;
 	struct cryptop *crp;
-	struct cryptodesc *crd;
 	int error;
 
-	crp = crypto_getreq(1);
-	crd = crp->crp_desc;
+	crp = crypto_getreq(as->as_session_sha1, M_WAITOK);
 
-	crd->crd_skip = skip;
-	crd->crd_len = inlen;
-	crd->crd_inject = skip + inlen;
-	crd->crd_flags = 0;
-	crd->crd_next = NULL;
-	crd->crd_alg = CRYPTO_SHA1_HMAC;
-
-	crp->crp_session = as->as_session_sha1;
-	crp->crp_ilen = inlen;
-	crp->crp_olen = 12;
-	crp->crp_etype = 0;
-	crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC;
-	crp->crp_buf = (void *) inout;
-	crp->crp_opaque = (void *) as;
+	crp->crp_payload_start = skip;
+	crp->crp_payload_length = inlen;
+	crp->crp_digest_start = skip + inlen;
+	crp->crp_flags = CRYPTO_F_CBIFSYNC;
+	crp->crp_buf_type = CRYPTO_BUF_MBUF;
+	crp->crp_mbuf = inout;
+	crp->crp_opaque = as;
 	crp->crp_callback = aes_crypto_cb;
 
 	error = crypto_dispatch(crp);
diff --git a/sys/kgssapi/krb5/kcrypto_des.c b/sys/kgssapi/krb5/kcrypto_des.c
index 65dbed5b66b34..391905dad50fd 100644
--- a/sys/kgssapi/krb5/kcrypto_des.c
+++ b/sys/kgssapi/krb5/kcrypto_des.c
@@ -78,25 +78,24 @@ des1_destroy(struct krb5_key_state *ks)
 static void
 des1_set_key(struct krb5_key_state *ks, const void *in)
 {
+	struct crypto_session_params csp;
 	void *kp = ks->ks_key;
 	struct des1_state *ds = ks->ks_priv;
-	struct cryptoini cri[1];
-
-	if (kp != in)
-		bcopy(in, kp, ks->ks_class->ec_keylen);
 
 	if (ds->ds_session)
 		crypto_freesession(ds->ds_session);
 
-	bzero(cri, sizeof(cri));
+	if (kp != in)
+		bcopy(in, kp, ks->ks_class->ec_keylen);
 
-	cri[0].cri_alg = CRYPTO_DES_CBC;
-	cri[0].cri_klen = 64;
-	cri[0].cri_mlen = 0;
-	cri[0].cri_key = ks->ks_key;
-	cri[0].cri_next = NULL;
+	memset(&csp, 0, sizeof(csp));
+	csp.csp_mode = CSP_MODE_CIPHER;
+	csp.csp_ivlen = 8;
+	csp.csp_cipher_alg = CRYPTO_DES_CBC;
+	csp.csp_cipher_klen = 8;
+	csp.csp_cipher_key = ks->ks_key;
 
-	crypto_newsession(&ds->ds_session, cri,
+	crypto_newsession(&ds->ds_session, &csp,
 	    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
 }
 
@@ -163,32 +162,27 @@ des1_crypto_cb(struct cryptop *crp)
 }
 
 static void
-des1_encrypt_1(const struct krb5_key_state *ks, int buftype, void *buf,
-    size_t skip, size_t len, void *ivec, int encdec)
+des1_encrypt_1(const struct krb5_key_state *ks, int buf_type, void *buf,
+    size_t skip, size_t len, void *ivec, bool encrypt)
 {
 	struct des1_state *ds = ks->ks_priv;
 	struct cryptop *crp;
-	struct cryptodesc *crd;
 	int error;
 
-	crp = crypto_getreq(1);
-	crd = crp->crp_desc;
+	crp = crypto_getreq(ds->ds_session, M_WAITOK);
 
-	crd->crd_skip = skip;
-	crd->crd_len = len;
-	crd->crd_flags = CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT | encdec;
+	crp->crp_payload_start = skip;
+	crp->crp_payload_length = len;
+	crp->crp_op = encrypt ? CRYPTO_OP_ENCRYPT : CRYPTO_OP_DECRYPT;
+	crp->crp_flags = CRYPTO_F_CBIFSYNC | CRYPTO_F_IV_SEPARATE;
 	if (ivec) {
-		bcopy(ivec, crd->crd_iv, 8);
+		memcpy(crp->crp_iv, ivec, 8);
 	} else {
-		bzero(crd->crd_iv, 8);
+		memset(crp->crp_iv, 0, 8);
 	}
-	crd->crd_next = NULL;
-	crd->crd_alg = CRYPTO_DES_CBC;
-
-	crp->crp_session = ds->ds_session;
-	crp->crp_flags = buftype | CRYPTO_F_CBIFSYNC;
+	crp->crp_buf_type = buf_type;
 	crp->crp_buf = buf;
-	crp->crp_opaque = (void *) ds;
+	crp->crp_opaque = ds;
 	crp->crp_callback = des1_crypto_cb;
 
 	error = crypto_dispatch(crp);
@@ -208,8 +202,7 @@ des1_encrypt(const struct krb5_key_state *ks, struct mbuf *inout,
     size_t skip, size_t len, void *ivec, size_t ivlen)
 {
 
-	des1_encrypt_1(ks, CRYPTO_F_IMBUF, inout, skip, len, ivec,
-	    CRD_F_ENCRYPT);
+	des1_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec, true);
 }
 
 static void
@@ -217,7 +210,7 @@ des1_decrypt(const struct krb5_key_state *ks, struct mbuf *inout,
     size_t skip, size_t len, void *ivec, size_t ivlen)
 {
 
-	des1_encrypt_1(ks, CRYPTO_F_IMBUF, inout, skip, len, ivec, 0);
+	des1_encrypt_1(ks, CRYPTO_BUF_MBUF, inout, skip, len, ivec, false);
 }
 
 static int
@@ -244,7 +237,7 @@ des1_checksum(const struct krb5_key_state *ks, int usage,
 	m_apply(inout, skip, inlen, MD5Update_int, &md5);
 	MD5Final(hash, &md5);
 
-	des1_encrypt_1(ks, 0, hash, 0, 16, NULL, CRD_F_ENCRYPT);
+	des1_encrypt_1(ks, CRYPTO_BUF_CONTIG, hash, 0, 16, NULL, true);
 	m_copyback(inout, skip + inlen, outlen, hash + 8);
 }
 
diff --git a/sys/kgssapi/krb5/kcrypto_des3.c b/sys/kgssapi/krb5/kcrypto_des3.c
index 1038908d66507..0055b24cdbdf3 100644
--- a/sys/kgssapi/krb5/kcrypto_des3.c
+++ b/sys/kgssapi/krb5/kcrypto_des3.c
@@ -48,7 +48,8 @@ __FBSDID("$FreeBSD$");
 
 struct des3_state {
 	struct mtx	ds_lock;
-	crypto_session_t ds_session;
+	crypto_session_t ds_cipher_session;
+	crypto_session_t ds_hmac_session;
 };
 
 static void
@@ -69,8 +70,10 @@ des3_destroy(struct krb5_key_state *ks)
 {
 	struct des3_state *ds = ks->ks_priv;
 
-	if (ds->ds_session)
-		crypto_freesession(ds->ds_session);
+	if (ds->ds_cipher_session) {
+		crypto_freesession(ds->ds_cipher_session);
+		crypto_freesession(ds->ds_hmac_session);
+	}
 	mtx_destroy(&ds->ds_lock);
 	free(ks->ks_priv, M_GSSAPI);
 }
@@ -78,31 +81,35 @@ des3_destroy(struct krb5_key_state *ks)
 static void
 des3_set_key(struct krb5_key_state *ks, const void *in)
 {
+	struct crypto_session_params csp;
 	void *kp = ks->ks_key;
 	struct des3_state *ds = ks->ks_priv;
-	struct cryptoini cri[2];
+
+	if (ds->ds_cipher_session) {
+		crypto_freesession(ds->ds_cipher_session);
+		crypto_freesession(ds->ds_hmac_session);
+	}
 
 	if (kp != in)
 		bcopy(in, kp, ks->ks_class->ec_keylen);
 
-	if (ds->ds_session)
-		crypto_freesession(ds->ds_session);
-
-	bzero(cri, sizeof(cri));
+	memset(&csp, 0, sizeof(csp));
+	csp.csp_mode = CSP_MODE_DIGEST;
+	csp.csp_auth_alg = CRYPTO_SHA1_HMAC;
+	csp.csp_auth_klen = 24;
+	csp.csp_auth_key = ks->ks_key;
 
-	cri[0].cri_alg = CRYPTO_SHA1_HMAC;
-	cri[0].cri_klen = 192;
-	cri[0].cri_mlen = 0;
-	cri[0].cri_key = ks->ks_key;
-	cri[0].cri_next = &cri[1];
+	crypto_newsession(&ds->ds_hmac_session, &csp,
+	    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
 
-	cri[1].cri_alg = CRYPTO_3DES_CBC;
-	cri[1].cri_klen = 192;
-	cri[1].cri_mlen = 0;
-	cri[1].cri_key = ks->ks_key;
-	cri[1].cri_next = NULL;
+	memset(&csp, 0, sizeof(csp));
+	csp.csp_mode = CSP_MODE_CIPHER;
+	csp.csp_cipher_alg = CRYPTO_3DES_CBC;
+	csp.csp_cipher_klen = 24;
+	csp.csp_cipher_key = ks->ks_key;
+	csp.csp_ivlen = 8;
 
-	crypto_newsession(&ds->ds_session, cri,
+	crypto_newsession(&ds->ds_cipher_session, &csp,
 	    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
 }
 
@@ -158,7 +165,7 @@ des3_crypto_cb(struct cryptop *crp)
 	int error;
 	struct des3_state *ds = (struct des3_state *) crp->crp_opaque;
 	
-	if (crypto_ses2caps(ds->ds_session) & CRYPTOCAP_F_SYNC)
+	if (crypto_ses2caps(crp->crp_session) & CRYPTOCAP_F_SYNC)
 		return (0);
 
 	error = crp->crp_etype;
@@ -174,36 +181,31 @@ des3_crypto_cb(struct cryptop *crp)
 
 static void
 des3_encrypt_1(const struct krb5_key_state *ks, struct mbuf *inout,
-    size_t skip, size_t len, void *ivec, int encdec)
+    size_t skip, size_t len, void *ivec, bool encrypt)
 {
 	struct des3_state *ds = ks->ks_priv;
 	struct cryptop *crp;
-	struct cryptodesc *crd;
 	int error;
 
-	crp = crypto_getreq(1);
-	crd = crp->crp_desc;
+	crp = crypto_getreq(ds->ds_cipher_session, M_WAITOK);
 
-	crd->crd_skip = skip;
-	crd->crd_len = len;
-	crd->crd_flags = CRD_F_IV_EXPLICIT | CRD_F_IV_PRESENT | encdec;
+	crp->crp_payload_start = skip;
+	crp->crp_payload_length = len;
+	crp->crp_op = encrypt ? CRYPTO_OP_ENCRYPT : CRYPTO_OP_DECRYPT;
+	crp->crp_flags = CRYPTO_F_CBIFSYNC | CRYPTO_F_IV_SEPARATE;
 	if (ivec) {
-		bcopy(ivec, crd->crd_iv, 8);
+		memcpy(crp->crp_iv, ivec, 8);
 	} else {
-		bzero(crd->crd_iv, 8);
+		memset(crp->crp_iv, 0, 8);
 	}
-	crd->crd_next = NULL;
-	crd->crd_alg = CRYPTO_3DES_CBC;
-
-	crp->crp_session = ds->ds_session;
-	crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC;
-	crp->crp_buf = (void *) inout;
-	crp->crp_opaque = (void *) ds;
+	crp->crp_buf_type = CRYPTO_BUF_MBUF;
+	crp->crp_mbuf = inout;
+	crp->crp_opaque = ds;
 	crp->crp_callback = des3_crypto_cb;
 
 	error = crypto_dispatch(crp);
 
-	if ((crypto_ses2caps(ds->ds_session) & CRYPTOCAP_F_SYNC) == 0) {
+	if ((crypto_ses2caps(ds->ds_cipher_session) & CRYPTOCAP_F_SYNC) == 0) {
 		mtx_lock(&ds->ds_lock);
 		if (!error && !(crp->crp_flags & CRYPTO_F_DONE))
 			error = msleep(crp, &ds->ds_lock, 0, "gssdes3", 0);
@@ -218,7 +220,7 @@ des3_encrypt(const struct krb5_key_state *ks, struct mbuf *inout,
     size_t skip, size_t len, void *ivec, size_t ivlen)
 {
 
-	des3_encrypt_1(ks, inout, skip, len, ivec, CRD_F_ENCRYPT);
+	des3_encrypt_1(ks, inout, skip, len, ivec, true);
 }
 
 static void
@@ -226,7 +228,7 @@ des3_decrypt(const struct krb5_key_state *ks, struct mbuf *inout,
     size_t skip, size_t len, void *ivec, size_t ivlen)
 {
 
-	des3_encrypt_1(ks, inout, skip, len, ivec, 0);
+	des3_encrypt_1(ks, inout, skip, len, ivec, false);
 }
 
 static void
@@ -235,31 +237,23 @@ des3_checksum(const struct krb5_key_state *ks, int usage,
 {
 	struct des3_state *ds = ks->ks_priv;
 	struct cryptop *crp;
-	struct cryptodesc *crd;
 	int error;
 
-	crp = crypto_getreq(1);
-	crd = crp->crp_desc;
-
-	crd->crd_skip = skip;
-	crd->crd_len = inlen;
-	crd->crd_inject = skip + inlen;
-	crd->crd_flags = 0;
-	crd->crd_next = NULL;
-	crd->crd_alg = CRYPTO_SHA1_HMAC;
+	crp = crypto_getreq(ds->ds_hmac_session, M_WAITOK);
 
-	crp->crp_session = ds->ds_session;
-	crp->crp_ilen = inlen;
-	crp->crp_olen = 20;
-	crp->crp_etype = 0;
-	crp->crp_flags = CRYPTO_F_IMBUF | CRYPTO_F_CBIFSYNC;
-	crp->crp_buf = (void *) inout;
-	crp->crp_opaque = (void *) ds;
+	crp->crp_payload_start = skip;
+	crp->crp_payload_length = inlen;
+	crp->crp_digest_start = skip + inlen;
+	crp->crp_op = CRYPTO_OP_COMPUTE_DIGEST;
+	crp->crp_flags = CRYPTO_F_CBIFSYNC;
+	crp->crp_buf_type = CRYPTO_BUF_MBUF;
+	crp->crp_mbuf = inout;
+	crp->crp_opaque = ds;
 	crp->crp_callback = des3_crypto_cb;
 
 	error = crypto_dispatch(crp);
 
-	if ((crypto_ses2caps(ds->ds_session) & CRYPTOCAP_F_SYNC) == 0) {
+	if ((crypto_ses2caps(ds->ds_hmac_session) & CRYPTOCAP_F_SYNC) == 0) {
 		mtx_lock(&ds->ds_lock);
 		if (!error && !(crp->crp_flags & CRYPTO_F_DONE))
 			error = msleep(crp, &ds->ds_lock, 0, "gssdes3", 0);