ossl: Keep mutable AES-GCM state on the stack

[markj]

Summary

ossl(4)'s AES-GCM implementation keeps mutable state in the session
structure, together with the key schedule. This was done for
convenience, as both are initialized together. However, some OCF
consumers, particularly ZFS, assume that requests may be dispatched to
the same session in parallel. Without serialization, this results in
incorrect output.

Fix the problem by explicitly copying per-session state onto the stack
at the beginning of each operation.

[markj]

I'm working on a new mode for cryptocheck which has it try issuing requests from multiple threads in a single session.

[jhb]

Yes, this is similar to changes I made to cryptosoft and other drivers earlier in 14.0-current I think to permit concurrent calls (e.g. dc475c9bee02f1a480362450b3680f0e3bfee529).

sys/crypto/openssl/ossl_aes.c

170

Can you make this struct ossl_gcm_context ctx and use a cast when calling set_encrypt_key and set_decrypt_key? I think it would be a bit less confusig perhaps.

256–257

Does this need an explicit_bzero of state/ctx?

[markj]

Address feedback.