From bf5a88ed54be4372dca6c26e0eee2cf7ac372483 Mon Sep 17 00:00:00 2001 From: Waldemar Brodkorb Date: Thu, 11 Jun 2009 12:34:46 +0200 Subject: update alix1c to 2.6.30 - regenerate patches - fix exmap compile --- package/exmap/patches/patch-kernel_exmap_c | 12 +- target/alix1c/device.mk | 4 +- target/linux/config/Config.in.netfilter | 12 - target/linux/patches/2.6.29/cygwin-compat.patch | 66 + target/linux/patches/2.6.29/freebsd-compat.patch | 11 + target/linux/patches/2.6.29/mips-gcc-44.patch | 215 + target/linux/patches/2.6.29/ocf.patch | 23653 +++++++++++++++++++++ target/linux/patches/2.6.29/swconfig.patch | 1075 + target/linux/patches/2.6.29/yaffs2.patch | 15068 +++++++++++++ target/linux/patches/cygwin-compat.patch | 12 +- target/linux/patches/freebsd-compat.patch | 6 +- target/linux/patches/mips-gcc-44.patch | 215 - target/linux/patches/ocf.patch | 1942 +- target/linux/patches/swconfig.patch | 24 +- target/linux/patches/yaffs2.patch | 1770 +- 15 files changed, 41976 insertions(+), 2109 deletions(-) create mode 100644 target/linux/patches/2.6.29/cygwin-compat.patch create mode 100644 target/linux/patches/2.6.29/freebsd-compat.patch create mode 100644 target/linux/patches/2.6.29/mips-gcc-44.patch create mode 100644 target/linux/patches/2.6.29/ocf.patch create mode 100644 target/linux/patches/2.6.29/swconfig.patch create mode 100644 target/linux/patches/2.6.29/yaffs2.patch delete mode 100644 target/linux/patches/mips-gcc-44.patch diff --git a/package/exmap/patches/patch-kernel_exmap_c b/package/exmap/patches/patch-kernel_exmap_c index 8278e6510..0a641298c 100644 --- a/package/exmap/patches/patch-kernel_exmap_c +++ b/package/exmap/patches/patch-kernel_exmap_c @@ -1,6 +1,6 @@ $Id: update-patches 24 2008-08-31 14:56:13Z wbx $ --- exmap-console-0.4.1.orig/kernel/exmap.c 2006-10-24 20:45:11.000000000 +0200 -+++ exmap-console-0.4.1/kernel/exmap.c 2008-12-14 13:34:01.000000000 +0100 ++++ exmap-console-0.4.1/kernel/exmap.c 2009-06-11 12:31:45.000000000 +0200 @@ -392,7 +392,11 @@ int setup_from_pid(pid_t pid) struct task_struct *tsk; int errcode = -EINVAL; @@ -22,7 +22,15 @@ $Id: update-patches 24 2008-08-31 14:56:13Z wbx $ printk (KERN_ALERT "/proc/%s: could not initialize\n", PROCFS_NAME); return -ENOMEM; -@@ -532,5 +536,5 @@ int init_module () +@@ -515,7 +519,6 @@ int init_module () + + exmap_proc_file->read_proc = procfile_read; + exmap_proc_file->write_proc = procfile_write; +- exmap_proc_file->owner = THIS_MODULE; + + /* exmap_proc_file->mode = S_IFREG | S_IRUGO; */ + /* TODO - this is quite probably a security problem */ +@@ -532,5 +535,5 @@ int init_module () void cleanup_module () { printk (KERN_INFO "/proc/%s: remove\n", PROCFS_NAME); diff --git a/target/alix1c/device.mk b/target/alix1c/device.mk index 9993470ea..8b6b892d7 100644 --- a/target/alix1c/device.mk +++ b/target/alix1c/device.mk @@ -1,7 +1,7 @@ ARCH:= x86 CPU_ARCH:= i586 -KERNEL_VERSION:= 2.6.29.1 +KERNEL_VERSION:= 2.6.30 KERNEL_RELEASE:= 1 -KERNEL_MD5SUM:= 4ada43caecb08fe2af71b416b6f586d8 +KERNEL_MD5SUM:= 7a80058a6382e5108cdb5554d1609615 TARGET_OPTIMIZATION:= -Os -pipe TARGET_CFLAGS_ARCH:= -march=geode diff --git a/target/linux/config/Config.in.netfilter b/target/linux/config/Config.in.netfilter index 6553471a0..48db426ef 100644 --- a/target/linux/config/Config.in.netfilter +++ b/target/linux/config/Config.in.netfilter @@ -440,17 +440,5 @@ config ADK_KPACKAGE_KMOD_IP_NF_TARGET_ECN existing ECN blackholes on the internet, but don't want to disable ECN support in general. -config ADK_KPACKAGE_KMOD_IP_NF_TARGET_TTL - tristate 'TTL target support' - depends ADK_KPACKAGE_KMOD_IP_NF_MANGLE - help - This option adds a `TTL' target, which enables the user to modify - the TTL value of the IP header. - - While it is safe to decrement/lower the TTL, this target also enables - functionality to increment and set the TTL value of the IP header to - arbitrary values. This is EXTREMELY DANGEROUS since you can easily - create immortal packets that loop forever on the network. - endmenu endmenu diff --git a/target/linux/patches/2.6.29/cygwin-compat.patch b/target/linux/patches/2.6.29/cygwin-compat.patch new file mode 100644 index 000000000..453748618 --- /dev/null +++ b/target/linux/patches/2.6.29/cygwin-compat.patch @@ -0,0 +1,66 @@ +diff -Nur linux-2.6.29.1.orig/scripts/mod/file2alias.c linux-2.6.29.1/scripts/mod/file2alias.c +--- linux-2.6.29.1.orig/scripts/mod/file2alias.c 2009-04-02 22:55:27.000000000 +0200 ++++ linux-2.6.29.1/scripts/mod/file2alias.c 2009-05-06 19:05:47.367234820 +0200 +@@ -29,7 +29,11 @@ + + #include + ++#ifdef __CYGWIN__ ++typedef __uint32_t __u32; ++#else + typedef uint32_t __u32; ++#endif + typedef uint16_t __u16; + typedef unsigned char __u8; + +diff -Nur linux-2.6.29.1.orig/scripts/mod/modpost.h linux-2.6.29.1/scripts/mod/modpost.h +--- linux-2.6.29.1.orig/scripts/mod/modpost.h 2009-04-02 22:55:27.000000000 +0200 ++++ linux-2.6.29.1/scripts/mod/modpost.h 2009-05-06 19:06:14.068903184 +0200 +@@ -9,6 +9,11 @@ + #include + #include + ++#ifdef __CYGWIN__ ++typedef uint16_t Elf32_Section; ++typedef uint16_t Elf64_Section; ++#endif ++ + #include "elfconfig.h" + + #if KERNEL_ELFCLASS == ELFCLASS32 +@@ -19,13 +24,17 @@ + #define Elf_Addr Elf32_Addr + #define Elf_Sword Elf64_Sword + #define Elf_Section Elf32_Half ++#ifndef __CYGWIN__ + #define ELF_ST_BIND ELF32_ST_BIND + #define ELF_ST_TYPE ELF32_ST_TYPE ++#endif + + #define Elf_Rel Elf32_Rel + #define Elf_Rela Elf32_Rela ++#ifndef __CYGWIN__ + #define ELF_R_SYM ELF32_R_SYM + #define ELF_R_TYPE ELF32_R_TYPE ++#endif + #else + + #define Elf_Ehdr Elf64_Ehdr +@@ -43,6 +52,17 @@ + #define ELF_R_TYPE ELF64_R_TYPE + #endif + ++#define R_386_32 1 /* Direct 32 bit */ ++#define R_386_PC32 2 /* PC relative 32 bit */ ++ ++#define R_ARM_PC24 1 /* PC relative 26 bit branch */ ++#define R_ARM_ABS32 2 /* Direct 32 bit */ ++ ++#define R_MIPS_32 2 /* Direct 32 bit */ ++#define R_MIPS_26 4 /* Direct 26 bit shifted */ ++#define R_MIPS_HI16 5 /* High 16 bit */ ++#define R_MIPS_LO16 6 /* Low 16 bit */ ++ + /* The 64-bit MIPS ELF ABI uses an unusual reloc format. */ + typedef struct + { diff --git a/target/linux/patches/2.6.29/freebsd-compat.patch b/target/linux/patches/2.6.29/freebsd-compat.patch new file mode 100644 index 000000000..fb09008f6 --- /dev/null +++ b/target/linux/patches/2.6.29/freebsd-compat.patch @@ -0,0 +1,11 @@ +diff -Nur linux-2.6.29.1.orig/arch/x86/boot/tools/build.c linux-2.6.29.1/arch/x86/boot/tools/build.c +--- linux-2.6.29.1.orig/arch/x86/boot/tools/build.c 2009-04-02 22:55:27.000000000 +0200 ++++ linux-2.6.29.1/arch/x86/boot/tools/build.c 2009-05-08 23:29:09.000000000 +0200 +@@ -29,7 +29,6 @@ + #include + #include + #include +-#include + #include + #include + #include diff --git a/target/linux/patches/2.6.29/mips-gcc-44.patch b/target/linux/patches/2.6.29/mips-gcc-44.patch new file mode 100644 index 000000000..ccee68b9b --- /dev/null +++ b/target/linux/patches/2.6.29/mips-gcc-44.patch @@ -0,0 +1,215 @@ +diff -Nur linux-2.6.29.4.orig/arch/mips/include/asm/compiler.h linux-2.6.29.4/arch/mips/include/asm/compiler.h +--- linux-2.6.29.4.orig/arch/mips/include/asm/compiler.h 2009-05-19 01:52:34.000000000 +0200 ++++ linux-2.6.29.4/arch/mips/include/asm/compiler.h 2009-05-24 19:32:14.000000000 +0200 +@@ -16,4 +16,11 @@ + #define GCC_REG_ACCUM "accum" + #endif + ++#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 4) ++#define GCC_NO_H_CONSTRAINT ++#ifdef CONFIG_64BIT ++typedef unsigned int uint128_t __attribute__((mode(TI))); ++#endif ++#endif ++ + #endif /* _ASM_COMPILER_H */ +diff -Nur linux-2.6.29.4.orig/arch/mips/include/asm/delay.h linux-2.6.29.4/arch/mips/include/asm/delay.h +--- linux-2.6.29.4.orig/arch/mips/include/asm/delay.h 2009-05-19 01:52:34.000000000 +0200 ++++ linux-2.6.29.4/arch/mips/include/asm/delay.h 2009-05-24 19:32:14.000000000 +0200 +@@ -62,8 +62,9 @@ + + static inline void __udelay(unsigned long usecs, unsigned long lpj) + { ++#ifndef GCC_NO_H_CONSTRAINT + unsigned long hi, lo; +- ++#endif + /* + * The rates of 128 is rounded wrongly by the catchall case + * for 64-bit. Excessive precission? Probably ... +@@ -77,6 +78,17 @@ + 0x80000000ULL) >> 32); + #endif + ++#ifdef GCC_NO_H_CONSTRAINT ++#ifdef CONFIG_64BIT ++ usecs = ((uint128_t)usecs * lpj) >> 64; ++#else ++#define SZHALF (sizeof(long)*4) ++#define LOWERHALF ((0x1ul<> SZHALF) * (lpj >> SZHALF) + ( ((usecs & LOWERHALF) * (lpj >> SZHALF) + (usecs >> SZHALF) * (lpj & LOWERHALF)) >> SZHALF ); ++#undef SZHALF ++#undef LOWERHALF ++#endif ++#else + if (sizeof(long) == 4) + __asm__("multu\t%2, %3" + : "=h" (usecs), "=l" (lo) +@@ -92,7 +104,7 @@ + : "=r" (usecs), "=h" (hi), "=l" (lo) + : "r" (usecs), "r" (lpj) + : GCC_REG_ACCUM); +- ++#endif + __delay(usecs); + } + +diff -Nur linux-2.6.29.4.orig/arch/mips/include/asm/div64.h linux-2.6.29.4/arch/mips/include/asm/div64.h +--- linux-2.6.29.4.orig/arch/mips/include/asm/div64.h 2009-05-19 01:52:34.000000000 +0200 ++++ linux-2.6.29.4/arch/mips/include/asm/div64.h 2009-05-22 13:38:14.000000000 +0200 +@@ -6,105 +6,63 @@ + * License. See the file "COPYING" in the main directory of this archive + * for more details. + */ +-#ifndef _ASM_DIV64_H +-#define _ASM_DIV64_H ++#ifndef __ASM_DIV64_H ++#define __ASM_DIV64_H + +-#include ++#include + +-#if (_MIPS_SZLONG == 32) ++#if BITS_PER_LONG == 64 + +-#include ++#include + + /* + * No traps on overflows for any of these... + */ + +-#define do_div64_32(res, high, low, base) ({ \ +- unsigned long __quot32, __mod32; \ +- unsigned long __cf, __tmp, __tmp2, __i; \ +- \ +- __asm__(".set push\n\t" \ +- ".set noat\n\t" \ +- ".set noreorder\n\t" \ +- "move %2, $0\n\t" \ +- "move %3, $0\n\t" \ +- "b 1f\n\t" \ +- " li %4, 0x21\n" \ +- "0:\n\t" \ +- "sll $1, %0, 0x1\n\t" \ +- "srl %3, %0, 0x1f\n\t" \ +- "or %0, $1, %5\n\t" \ +- "sll %1, %1, 0x1\n\t" \ +- "sll %2, %2, 0x1\n" \ +- "1:\n\t" \ +- "bnez %3, 2f\n\t" \ +- " sltu %5, %0, %z6\n\t" \ +- "bnez %5, 3f\n" \ +- "2:\n\t" \ +- " addiu %4, %4, -1\n\t" \ +- "subu %0, %0, %z6\n\t" \ +- "addiu %2, %2, 1\n" \ +- "3:\n\t" \ +- "bnez %4, 0b\n\t" \ +- " srl %5, %1, 0x1f\n\t" \ +- ".set pop" \ +- : "=&r" (__mod32), "=&r" (__tmp), \ +- "=&r" (__quot32), "=&r" (__cf), \ +- "=&r" (__i), "=&r" (__tmp2) \ +- : "Jr" (base), "0" (high), "1" (low)); \ +- \ +- (res) = __quot32; \ +- __mod32; }) +- +-#define do_div(n, base) ({ \ +- unsigned long long __quot; \ +- unsigned long __mod; \ +- unsigned long long __div; \ +- unsigned long __upper, __low, __high, __base; \ +- \ +- __div = (n); \ +- __base = (base); \ +- \ +- __high = __div >> 32; \ +- __low = __div; \ +- __upper = __high; \ +- \ +- if (__high) \ +- __asm__("divu $0, %z2, %z3" \ +- : "=h" (__upper), "=l" (__high) \ +- : "Jr" (__high), "Jr" (__base) \ +- : GCC_REG_ACCUM); \ +- \ +- __mod = do_div64_32(__low, __upper, __low, __base); \ +- \ +- __quot = __high; \ +- __quot = __quot << 32 | __low; \ +- (n) = __quot; \ +- __mod; }) +- +-#endif /* (_MIPS_SZLONG == 32) */ +- +-#if (_MIPS_SZLONG == 64) +- +-/* +- * Hey, we're already 64-bit, no +- * need to play games.. +- */ +-#define do_div(n, base) ({ \ +- unsigned long __quot; \ +- unsigned int __mod; \ +- unsigned long __div; \ +- unsigned int __base; \ +- \ +- __div = (n); \ +- __base = (base); \ +- \ +- __mod = __div % __base; \ +- __quot = __div / __base; \ +- \ +- (n) = __quot; \ +- __mod; }) ++#define __div64_32(n, base) \ ++({ \ ++ unsigned long __cf, __tmp, __tmp2, __i; \ ++ unsigned long __quot32, __mod32; \ ++ unsigned long __high, __low; \ ++ unsigned long long __n; \ ++ \ ++ __high = *__n >> 32; \ ++ __low = __n; \ ++ __asm__( \ ++ " .set push \n" \ ++ " .set noat \n" \ ++ " .set noreorder \n" \ ++ " move %2, $0 \n" \ ++ " move %3, $0 \n" \ ++ " b 1f \n" \ ++ " li %4, 0x21 \n" \ ++ "0: \n" \ ++ " sll $1, %0, 0x1 \n" \ ++ " srl %3, %0, 0x1f \n" \ ++ " or %0, $1, %5 \n" \ ++ " sll %1, %1, 0x1 \n" \ ++ " sll %2, %2, 0x1 \n" \ ++ "1: \n" \ ++ " bnez %3, 2f \n" \ ++ " sltu %5, %0, %z6 \n" \ ++ " bnez %5, 3f \n" \ ++ "2: \n" \ ++ " addiu %4, %4, -1 \n" \ ++ " subu %0, %0, %z6 \n" \ ++ " addiu %2, %2, 1 \n" \ ++ "3: \n" \ ++ " bnez %4, 0b\n\t" \ ++ " srl %5, %1, 0x1f\n\t" \ ++ " .set pop" \ ++ : "=&r" (__mod32), "=&r" (__tmp), \ ++ "=&r" (__quot32), "=&r" (__cf), \ ++ "=&r" (__i), "=&r" (__tmp2) \ ++ : "Jr" (base), "0" (__high), "1" (__low)); \ ++ \ ++ (__n) = __quot32; \ ++ __mod32; \ ++}) + +-#endif /* (_MIPS_SZLONG == 64) */ ++#endif /* BITS_PER_LONG == 64 */ + +-#endif /* _ASM_DIV64_H */ ++#endif /* __ASM_DIV64_H */ diff --git a/target/linux/patches/2.6.29/ocf.patch b/target/linux/patches/2.6.29/ocf.patch new file mode 100644 index 000000000..69cffc1da --- /dev/null +++ b/target/linux/patches/2.6.29/ocf.patch @@ -0,0 +1,23653 @@ +diff -Nur linux-2.6.29.1.orig/crypto/Kconfig linux-2.6.29.1/crypto/Kconfig +--- linux-2.6.29.1.orig/crypto/Kconfig 2009-04-02 22:55:27.000000000 +0200 ++++ linux-2.6.29.1/crypto/Kconfig 2009-04-20 20:01:21.396548617 +0200 +@@ -737,3 +737,5 @@ + source "drivers/crypto/Kconfig" + + endif # if CRYPTO ++ ++source "crypto/ocf/Kconfig" +diff -Nur linux-2.6.29.1.orig/crypto/Makefile linux-2.6.29.1/crypto/Makefile +--- linux-2.6.29.1.orig/crypto/Makefile 2009-04-02 22:55:27.000000000 +0200 ++++ linux-2.6.29.1/crypto/Makefile 2009-04-20 20:01:21.396548617 +0200 +@@ -79,6 +79,8 @@ + obj-$(CONFIG_CRYPTO_ANSI_CPRNG) += ansi_cprng.o + obj-$(CONFIG_CRYPTO_TEST) += tcrypt.o + ++obj-$(CONFIG_OCF_OCF) += ocf/ ++ + # + # generic algorithms and the async_tx api + # +diff -Nur linux-2.6.29.1.orig/crypto/ocf/Config.in linux-2.6.29.1/crypto/ocf/Config.in +--- linux-2.6.29.1.orig/crypto/ocf/Config.in 1970-01-01 01:00:00.000000000 +0100 ++++ linux-2.6.29.1/crypto/ocf/Config.in 2009-04-20 20:01:21.400550244 +0200 +@@ -0,0 +1,34 @@ ++############################################################################# ++ ++mainmenu_option next_comment ++comment 'OCF Configuration' ++tristate 'OCF (Open Cryptograhic Framework)' CONFIG_OCF_OCF ++dep_mbool ' enable fips RNG checks (fips check on RNG data before use)' \ ++ CONFIG_OCF_FIPS $CONFIG_OCF_OCF ++dep_mbool ' enable harvesting entropy for /dev/random' \ ++ CONFIG_OCF_RANDOMHARVEST $CONFIG_OCF_OCF ++dep_tristate ' cryptodev (user space support)' \ ++ CONFIG_OCF_CRYPTODEV $CONFIG_OCF_OCF ++dep_tristate ' cryptosoft (software crypto engine)' \ ++ CONFIG_OCF_CRYPTOSOFT $CONFIG_OCF_OCF ++dep_tristate ' safenet (HW crypto engine)' \ ++ CONFIG_OCF_SAFE $CONFIG_OCF_OCF ++dep_tristate ' IXP4xx (HW crypto engine)' \ ++ CONFIG_OCF_IXP4XX $CONFIG_OCF_OCF ++dep_mbool ' Enable IXP4xx HW to perform SHA1 and MD5 hashing (very slow)' \ ++ CONFIG_OCF_IXP4XX_SHA1_MD5 $CONFIG_OCF_IXP4XX ++dep_tristate ' hifn (HW crypto engine)' \ ++ CONFIG_OCF_HIFN $CONFIG_OCF_OCF ++dep_tristate ' talitos (HW crypto engine)' \ ++ CONFIG_OCF_TALITOS $CONFIG_OCF_OCF ++dep_tristate ' pasemi (HW crypto engine)' \ ++ CONFIG_OCF_PASEMI $CONFIG_OCF_OCF ++dep_tristate ' ep80579 (HW crypto engine)' \ ++ CONFIG_OCF_EP80579 $CONFIG_OCF_OCF ++dep_tristate ' ocfnull (does no crypto)' \ ++ CONFIG_OCF_OCFNULL $CONFIG_OCF_OCF ++dep_tristate ' ocf-bench (HW crypto in-kernel benchmark)' \ ++ CONFIG_OCF_BENCH $CONFIG_OCF_OCF ++endmenu ++ ++############################################################################# +diff -Nur linux-2.6.29.1.orig/crypto/ocf/Kconfig linux-2.6.29.1/crypto/ocf/Kconfig +--- linux-2.6.29.1.orig/crypto/ocf/Kconfig 1970-01-01 01:00:00.000000000 +0100 ++++ linux-2.6.29.1/crypto/ocf/Kconfig 2009-04-20 20:01:21.548558198 +0200 +@@ -0,0 +1,101 @@ ++menu "OCF Configuration" ++ ++config OCF_OCF ++ tristate "OCF (Open Cryptograhic Framework)" ++ help ++ A linux port of the OpenBSD/FreeBSD crypto framework. ++ ++config OCF_RANDOMHARVEST ++ bool "crypto random --- harvest entropy for /dev/random" ++ depends on OCF_OCF ++ help ++ Includes code to harvest random numbers from devices that support it. ++ ++config OCF_FIPS ++ bool "enable fips RNG checks" ++ depends on OCF_OCF && OCF_RANDOMHARVEST ++ help ++ Run all RNG provided data through a fips check before ++ adding it /dev/random's entropy pool. ++ ++config OCF_CRYPTODEV ++ tristate "cryptodev (user space support)" ++ depends on OCF_OCF ++ help ++ The user space API to access crypto hardware. ++ ++config OCF_CRYPTOSOFT ++ tristate "cryptosoft (software crypto engine)" ++ depends on OCF_OCF ++ help ++ A software driver for the OCF framework that uses ++ the kernel CryptoAPI. ++ ++config OCF_SAFE ++ tristate "safenet (HW crypto engine)" ++ depends on OCF_OCF ++ help ++ A driver for a number of the safenet Excel crypto accelerators. ++ Currently tested and working on the 1141 and 1741. ++ ++config OCF_IXP4XX ++ tristate "IXP4xx (HW crypto engine)" ++ depends on OCF_OCF ++ help ++ XScale IXP4xx crypto accelerator driver. Requires the ++ Intel Access library. ++ ++config OCF_IXP4XX_SHA1_MD5 ++ bool "IXP4xx SHA1 and MD5 Hashing" ++ depends on OCF_IXP4XX ++ help ++ Allows the IXP4xx crypto accelerator to perform SHA1 and MD5 hashing. ++ Note: this is MUCH slower than using cryptosoft (software crypto engine). ++ ++config OCF_HIFN ++ tristate "hifn (HW crypto engine)" ++ depends on OCF_OCF ++ help ++ OCF driver for various HIFN based crypto accelerators. ++ (7951, 7955, 7956, 7751, 7811) ++ ++config OCF_HIFNHIPP ++ tristate "Hifn HIPP (HW packet crypto engine)" ++ depends on OCF_OCF ++ help ++ OCF driver for various HIFN (HIPP) based crypto accelerators ++ (7855) ++ ++config OCF_TALITOS ++ tristate "talitos (HW crypto engine)" ++ depends on OCF_OCF ++ help ++ OCF driver for Freescale's security engine (SEC/talitos). ++ ++config OCF_PASEMI ++ tristate "pasemi (HW crypto engine)" ++ depends on OCF_OCF && PPC_PASEMI ++ help ++ OCF driver for the PA Semi PWRficient DMA Engine ++ ++config OCF_EP80579 ++ tristate "ep80579 (HW crypto engine)" ++ depends on OCF_OCF ++ help ++ OCF driver for the Intel EP80579 Integrated Processor Product Line. ++ ++config OCF_OCFNULL ++ tristate "ocfnull (fake crypto engine)" ++ depends on OCF_OCF ++ help ++ OCF driver for measuring ipsec overheads (does no crypto) ++ ++config OCF_BENCH ++ tristate "ocf-bench (HW crypto in-kernel benchmark)" ++ depends on OCF_OCF ++ help ++ A very simple encryption test for the in-kernel interface ++ of OCF. Also includes code to benchmark the IXP Access library ++ for comparison. ++ ++endmenu +diff -Nur linux-2.6.29.1.orig/crypto/ocf/Makefile linux-2.6.29.1/crypto/ocf/Makefile +--- linux-2.6.29.1.orig/crypto/ocf/Makefile 1970-01-01 01:00:00.000000000 +0100 ++++ linux-2.6.29.1/crypto/ocf/Makefile 2009-04-20 20:01:21.548558198 +0200 +@@ -0,0 +1,121 @@ ++# for SGlinux builds ++-include $(ROOTDIR)/modules/.config ++ ++OCF_OBJS = crypto.o criov.o ++ ++ifdef CONFIG_OCF_RANDOMHARVEST ++ OCF_OBJS += random.o ++endif ++ ++ifdef CONFIG_OCF_FIPS ++ OCF_OBJS += rndtest.o ++endif ++ ++# Add in autoconf.h to get #defines for CONFIG_xxx ++AUTOCONF_H=$(ROOTDIR)/modules/autoconf.h ++ifeq ($(AUTOCONF_H), $(wildcard $(AUTOCONF_H))) ++ EXTRA_CFLAGS += -include $(AUTOCONF_H) ++ export EXTRA_CFLAGS ++endif ++ ++ifndef obj ++ obj ?= . ++ _obj = subdir ++ mod-subdirs := safe hifn ixp4xx talitos ocfnull ++ export-objs += crypto.o criov.o random.o ++ list-multi += ocf.o ++ _slash := ++else ++ _obj = obj ++ _slash := / ++endif ++ ++EXTRA_CFLAGS += -I$(obj)/. ++ ++obj-$(CONFIG_OCF_OCF) += ocf.o ++obj-$(CONFIG_OCF_CRYPTODEV) += cryptodev.o ++obj-$(CONFIG_OCF_CRYPTOSOFT) += cryptosoft.o ++obj-$(CONFIG_OCF_BENCH) += ocf-bench.o ++ ++$(_obj)-$(CONFIG_OCF_SAFE) += safe$(_slash) ++$(_obj)-$(CONFIG_OCF_HIFN) += hifn$(_slash) ++$(_obj)-$(CONFIG_OCF_IXP4XX) += ixp4xx$(_slash) ++$(_obj)-$(CONFIG_OCF_TALITOS) += talitos$(_slash) ++$(_obj)-$(CONFIG_OCF_PASEMI) += pasemi$(_slash) ++$(_obj)-$(CONFIG_OCF_EP80579) += ep80579$(_slash) ++$(_obj)-$(CONFIG_OCF_OCFNULL) += ocfnull$(_slash) ++ ++ocf-objs := $(OCF_OBJS) ++ ++$(list-multi) dummy1: $(ocf-objs) ++ $(LD) -r -o $@ $(ocf-objs) ++ ++.PHONY: ++clean: ++ rm -f *.o *.ko .*.o.flags .*.ko.cmd .*.o.cmd .*.mod.o.cmd *.mod.c ++ rm -f */*.o */*.ko */.*.o.cmd */.*.ko.cmd */.*.mod.o.cmd */*.mod.c */.*.o.flags ++ ++ifdef TOPDIR ++-include $(TOPDIR)/Rules.make ++endif ++ ++# ++# release gen targets ++# ++ ++.PHONY: patch ++patch: ++ REL=`date +%Y%m%d`; \ ++ patch=ocf-linux-$$REL.patch; \ ++ patch24=ocf-linux-24-$$REL.patch; \ ++ patch26=ocf-linux-26-$$REL.patch; \ ++ ( \ ++ find . -name Makefile; \ ++ find . -name Config.in; \ ++ find . -name Kconfig; \ ++ find . -name README; \ ++ find . -name '*.[ch]' | grep -v '.mod.c'; \ ++ ) | while read t; do \ ++ diff -Nau /dev/null $$t | sed 's?^+++ \./?+++ linux/crypto/ocf/?'; \ ++ done > $$patch; \ ++ cat patches/linux-2.4.35-ocf.patch $$patch > $$patch24; \ ++ cat patches/linux-2.6.26-ocf.patch $$patch > $$patch26 ++ ++.PHONY: tarball ++tarball: ++ REL=`date +%Y%m%d`; RELDIR=/tmp/ocf-linux-$$REL; \ ++ CURDIR=`pwd`; \ ++ rm -rf /tmp/ocf-linux-$$REL*; \ ++ mkdir -p $$RELDIR/tools; \ ++ cp README* $$RELDIR; \ ++ cp patches/openss*.patch $$RELDIR; \ ++ cp patches/crypto-tools.patch $$RELDIR; \ ++ cp tools/[!C]* $$RELDIR/tools; \ ++ cd ..; \ ++ tar cvf $$RELDIR/ocf-linux.tar \ ++ --exclude=CVS \ ++ --exclude=.* \ ++ --exclude=*.o \ ++ --exclude=*.ko \ ++ --exclude=*.mod.* \ ++ --exclude=README* \ ++ --exclude=ocf-*.patch \ ++ --exclude=ocf/patches/openss*.patch \ ++ --exclude=ocf/patches/crypto-tools.patch \ ++ --exclude=ocf/tools \ ++ ocf; \ ++ gzip -9 $$RELDIR/ocf-linux.tar; \ ++ cd /tmp; \ ++ tar cvf ocf-linux-$$REL.tar ocf-linux-$$REL; \ ++ gzip -9 ocf-linux-$$REL.tar; \ ++ cd $$CURDIR/../../user; \ ++ rm -rf /tmp/crypto-tools-$$REL*; \ ++ tar cvf /tmp/crypto-tools-$$REL.tar \ ++ --exclude=CVS \ ++ --exclude=.* \ ++ --exclude=*.o \ ++ --exclude=cryptotest \ ++ --exclude=cryptokeytest \ ++ crypto-tools; \ ++ gzip -9 /tmp/crypto-tools-$$REL.tar ++ +diff -Nur linux-2.6.29.1.orig/crypto/ocf/README linux-2.6.29.1/crypto/ocf/README +--- linux-2.6.29.1.orig/crypto/ocf/README 1970-01-01 01:00:00.000000000 +0100 ++++ linux-2.6.29.1/crypto/ocf/README 2009-04-20 20:01:21.584560546 +0200 +@@ -0,0 +1,167 @@ ++README - ocf-linux-20071215 ++--------------------------- ++ ++This README provides instructions for getting ocf-linux compiled and ++operating in a generic linux environment. For other information you ++might like to visit the home page for this project: ++ ++ http://ocf-linux.sourceforge.net/ ++ ++Adding OCF to linux ++------------------- ++ ++ Not much in this file for now, just some notes. I usually build ++ the ocf support as modules but it can be built into the kernel as ++ well. To use it: ++ ++ * mknod /dev/crypto c 10 70 ++ ++ * to add OCF to your kernel source, you have two options. Apply ++ the kernel specific patch: ++ ++ cd linux-2.4*; gunzip < ocf-linux-24-XXXXXXXX.patch.gz | patch -p1 ++ cd linux-2.6*; gunzip < ocf-linux-26-XXXXXXXX.patch.gz | patch -p1 ++ ++ if you do one of the above, then you can proceed to the next step, ++ or you can do the above process by hand with using the patches against ++ linux-2.4.35 and 2.6.23 to include the ocf code under crypto/ocf. ++ Here's how to add it: ++ ++ for 2.4.35 (and later) ++ ++ cd linux-2.4.35/crypto ++ tar xvzf ocf-linux.tar.gz ++ cd .. ++ patch -p1 < crypto/ocf/patches/linux-2.4.35-ocf.patch ++ ++ for 2.6.23 (and later), find the kernel patch specific (or nearest) ++ to your kernel versions and then: ++ ++ cd linux-2.6.NN/crypto ++ tar xvzf ocf-linux.tar.gz ++ cd .. ++ patch -p1 < crypto/ocf/patches/linux-2.6.NN-ocf.patch ++ ++ It should be easy to take this patch and apply it to other more ++ recent versions of the kernels. The same patches should also work ++ relatively easily on kernels as old as 2.6.11 and 2.4.18. ++ ++ * under 2.4 if you are on a non-x86 platform, you may need to: ++ ++ cp linux-2.X.x/include/asm-i386/kmap_types.h linux-2.X.x/include/asm-YYY ++ ++ so that you can build the kernel crypto support needed for the cryptosoft ++ driver. ++ ++ * For simplicity you should enable all the crypto support in your kernel ++ except for the test driver. Likewise for the OCF options. Do not ++ enable OCF crypto drivers for HW that you do not have (for example ++ ixp4xx will not compile on non-Xscale systems). ++ ++ * make sure that cryptodev.h (from ocf-linux.tar.gz) is installed as ++ crypto/cryptodev.h in an include directory that is used for building ++ applications for your platform. For example on a host system that ++ might be: ++ ++ /usr/include/crypto/cryptodev.h ++ ++ * patch your openssl-0.9.8i code with the openssl-0.9.8i.patch. ++ (NOTE: there is no longer a need to patch ssh). The patch is against: ++ openssl-0_9_8e ++ ++ If you need a patch for an older version of openssl, you should look ++ to older OCF releases. This patch is unlikely to work on older ++ openssl versions. ++ ++ openssl-0.9.8i.patch ++ - enables --with-cryptodev for non BSD systems ++ - adds -cpu option to openssl speed for calculating CPU load ++ under linux ++ - fixes null pointer in openssl speed multi thread output. ++ - fixes test keys to work with linux crypto's more stringent ++ key checking. ++ - adds MD5/SHA acceleration (Ronen Shitrit), only enabled ++ with the --with-cryptodev-digests option ++ - fixes bug in engine code caching. ++ ++ * build crypto-tools-XXXXXXXX.tar.gz if you want to try some of the BSD ++ tools for testing OCF (ie., cryptotest). ++ ++How to load the OCF drivers ++--------------------------- ++ ++ First insert the base modules: ++ ++ insmod ocf ++ insmod cryptodev ++ ++ You can then install the software OCF driver with: ++ ++ insmod cryptosoft ++ ++ and one or more of the OCF HW drivers with: ++ ++ insmod safe ++ insmod hifn7751 ++ insmod ixp4xx ++ ... ++ ++ all the drivers take a debug option to enable verbose debug so that ++ you can see what is going on. For debug you load them as: ++ ++ insmod ocf crypto_debug=1 ++ insmod cryptodev cryptodev_debug=1 ++ insmod cryptosoft swcr_debug=1 ++ ++ You may load more than one OCF crypto driver but then there is no guarantee ++ as to which will be used. ++ ++ You can also enable debug at run time on 2.6 systems with the following: ++ ++ echo 1 > /sys/module/ocf/parameters/crypto_debug ++ echo 1 > /sys/module/cryptodev/parameters/cryptodev_debug ++ echo 1 > /sys/module/cryptosoft/parameters/swcr_debug ++ echo 1 > /sys/module/hifn7751/parameters/hifn_debug ++ echo 1 > /sys/module/safe/parameters/safe_debug ++ echo 1 > /sys/module/ixp4xx/parameters/ixp_debug ++ ... ++ ++Testing the OCF support ++----------------------- ++ ++ run "cryptotest", it should do a short test for a couple of ++ des packets. If it does everything is working. ++ ++ If this works, then ssh will use the driver when invoked as: ++ ++ ssh -c 3des username@host ++ ++ to see for sure that it is operating, enable debug as defined above. ++ ++ To get a better idea of performance run: ++ ++ cryptotest 100 4096 ++ ++ There are more options to cryptotest, see the help. ++ ++ It is also possible to use openssl to test the speed of the crypto ++ drivers. ++ ++ openssl speed -evp des -engine cryptodev -elapsed ++ openssl speed -evp des3 -engine cryptodev -elapsed ++ openssl speed -evp aes128 -engine cryptodev -elapsed ++ ++ and multiple threads (10) with: ++ ++ openssl speed -evp des -engine cryptodev -elapsed -multi 10 ++ openssl speed -evp des3 -engine cryptodev -elapsed -multi 10 ++ openssl speed -evp aes128 -engine cryptodev -elapsed -multi 10 ++ ++ for public key testing you can try: ++ ++ cryptokeytest ++ openssl speed -engine cryptodev rsa -elapsed ++ openssl speed -engine cryptodev dsa -elapsed ++ ++David McCullough ++david_mccullough@securecomputing.com +diff -Nur linux-2.6.29.1.orig/crypto/ocf/criov.c linux-2.6.29.1/crypto/ocf/criov.c +--- linux-2.6.29.1.orig/crypto/ocf/criov.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-2.6.29.1/crypto/ocf/criov.c 2009-04-20 20:01:21.400550244 +0200 +@@ -0,0 +1,215 @@ ++/* $OpenBSD: criov.c,v 1.9 2002/01/29 15:48:29 jason Exp $ */ ++ ++/* ++ * Linux port done by David McCullough ++ * Copyright (C) 2006-2007 David McCullough ++ * Copyright (C) 2004-2005 Intel Corporation. ++ * The license and original author are listed below. ++ * ++ * Copyright (c) 1999 Theo de Raadt ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * 3. The name of the author may not be used to endorse or promote products ++ * derived from this software without specific prior written permission. ++ * ++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR ++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES ++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. ++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, ++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, ++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY ++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT ++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF ++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ++ * ++__FBSDID("$FreeBSD: src/sys/opencrypto/criov.c,v 1.5 2006/06/04 22:15:13 pjd Exp $"); ++ */ ++ ++#ifndef AUTOCONF_INCLUDED ++#include ++#endif ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++ ++/* ++ * This macro is only for avoiding code duplication, as we need to skip ++ * given number of bytes in the same way in three functions below. ++ */ ++#define CUIO_SKIP() do { \ ++ KASSERT(off >= 0, ("%s: off %d < 0", __func__, off)); \ ++ KASSERT(len >= 0, ("%s: len %d < 0", __func__, len)); \ ++ while (off > 0) { \ ++ KASSERT(iol >= 0, ("%s: empty in skip", __func__)); \ ++ if (off < iov->iov_len) \ ++ break; \ ++ off -= iov->iov_len; \ ++ iol--; \ ++ iov++; \ ++ } \ ++} while (0) ++ ++void ++cuio_copydata(struct uio* uio, int off, int len, caddr_t cp) ++{ ++ struct iovec *iov = uio->uio_iov; ++ int iol = uio->uio_iovcnt; ++ unsigned count; ++ ++ CUIO_SKIP(); ++ while (len > 0) { ++ KASSERT(iol >= 0, ("%s: empty", __func__)); ++ count = min((int)(iov->iov_len - off), len); ++ memcpy(cp, ((caddr_t)iov->iov_base) + off, count); ++ len -= count; ++ cp += count; ++ off = 0; ++ iol--; ++ iov++; ++ } ++} ++ ++void ++cuio_copyback(struct uio* uio, int off, int len, caddr_t cp) ++{ ++ struct iovec *iov = uio->uio_iov; ++ int iol = uio->uio_iovcnt; ++ unsigned count; ++ ++ CUIO_SKIP(); ++ while (len > 0) { ++ KASSERT(iol >= 0, ("%s: empty", __func__)); ++ count = min((int)(iov->iov_len - off), len); ++ memcpy(((caddr_t)iov->iov_base) + off, cp, count); ++ len -= count; ++ cp += count; ++ off = 0; ++ iol--; ++ iov++; ++ } ++} ++ ++/* ++ * Return a pointer to iov/offset of location in iovec list. ++ */ ++struct iovec * ++cuio_getptr(struct uio *uio, int loc, int *off) ++{ ++ struct iovec *iov = uio->uio_iov; ++ int iol = uio->uio_iovcnt; ++ ++ while (loc >= 0) { ++ /* Normal end of search */ ++ if (loc < iov->iov_len) { ++ *off = loc; ++ return (iov); ++ } ++ ++ loc -= iov->iov_len; ++ if (iol == 0) { ++ if (loc == 0) { ++ /* Point at the end of valid data */ ++ *off = iov->iov_len; ++ return (iov); ++ } else ++ return (NULL); ++ } else { ++ iov++, iol--; ++ } ++ } ++ ++ return (NULL); ++} ++ ++EXPORT_SYMBOL(cuio_copyback); ++EXPORT_SYMBOL(cuio_copydata); ++EXPORT_SYMBOL(cuio_getptr); ++ ++ ++static void ++skb_copy_bits_back(struct sk_buff *skb, int offset, caddr_t cp, int len) ++{ ++ int i; ++ if (offset < skb_headlen(skb)) { ++ memcpy(skb->data + offset, cp, min_t(int, skb_headlen(skb), len)); ++ len -= skb_headlen(skb); ++ cp += skb_headlen(skb); ++ } ++ offset -= skb_headlen(skb); ++ for (i = 0; len > 0 && i < skb_shinfo(skb)->nr_frags; i++) { ++ if (offset < skb_shinfo(skb)->frags[i].size) { ++ memcpy(page_address(skb_shinfo(skb)->frags[i].page) + ++ skb_shinfo(skb)->frags[i].page_offset, ++ cp, min_t(int, skb_shinfo(skb)->frags[i].size, len)); ++ len -= skb_shinfo(skb)->frags[i].size; ++ cp += skb_shinfo(skb)->frags[i].size; ++ } ++ offset -= skb_shinfo(skb)->frags[i].size; ++ } ++} ++ ++void ++crypto_copyback(int flags, caddr_t buf, int off, int size, caddr_t in) ++{ ++ ++ if ((flags & CRYPTO_F_SKBUF) != 0) ++ skb_copy_bits_back((struct sk_buff *)buf, off, in, size); ++ else if ((flags & CRYPTO_F_IOV) != 0) ++ cuio_copyback((struct uio *)buf, off, size, in); ++ else ++ bcopy(in, buf + off, size); ++} ++ ++void ++crypto_copydata(int flags, caddr_t buf, int off, int size, caddr_t out) ++{ ++ ++ if ((flags & CRYPTO_F_SKBUF) != 0) ++ skb_copy_bits((struct sk_buff *)buf, off, out, size); ++ else if ((flags & CRYPTO_F_IOV) != 0) ++ cuio_copydata((struct uio *)buf, off, size, out); ++ else ++ bcopy(buf + off, out, size); ++} ++ ++int ++crypto_apply(int flags, caddr_t buf, int off, int len, ++ int (*f)(void *, void *, u_int), void *arg) ++{ ++#if 0 ++ int error; ++ ++ if ((flags & CRYPTO_F_SKBUF) != 0) ++ error = XXXXXX((struct mbuf *)buf, off, len, f, arg); ++ else if ((flags & CRYPTO_F_IOV) != 0) ++ error = cuio_apply((struct uio *)buf, off, len, f, arg); ++ else ++ error = (*f)(arg, buf + off, len); ++ return (error); ++#else ++ KASSERT(0, ("crypto_apply not implemented!\n")); ++#endif ++ return 0; ++} ++ ++EXPORT_SYMBOL(crypto_copyback); ++EXPORT_SYMBOL(crypto_copydata); ++EXPORT_SYMBOL(crypto_apply); ++ +diff -Nur linux-2.6.29.1.orig/crypto/ocf/crypto.c linux-2.6.29.1/crypto/ocf/crypto.c +--- linux-2.6.29.1.orig/crypto/ocf/crypto.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-2.6.29.1/crypto/ocf/crypto.c 2009-04-20 20:01:21.408550425 +0200 +@@ -0,0 +1,1741 @@ ++/*- ++ * Linux port done by David McCullough ++ * Copyright (C) 2006-2007 David McCullough ++ * Copyright (C) 2004-2005 Intel Corporation. ++ * The license and original author are listed below. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * Copyright (c) 2002-2006 Sam Leffler. All rights reserved. ++ * ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in the ++ * documentation and/or other materials provided with the distribution. ++ * ++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR ++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES ++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. ++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, ++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT ++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, ++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY ++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT ++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF ++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ++ */ ++ ++#if 0 ++#include ++__FBSDID("$FreeBSD: src/sys/opencrypto/crypto.c,v 1.27 2007/03/21 03:42:51 sam Exp $"); ++#endif ++ ++/* ++ * Cryptographic Subsystem. ++ * ++ * This code is derived from the Openbsd Cryptographic Framework (OCF) ++ * that has the copyright shown below. Very little of the original ++ * code remains. ++ */ ++/*- ++ * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu) ++ * ++ * This code was written by Angelos D. Keromytis in Athens, Greece, in ++ * February 2000. Network Security Technologies Inc. (NSTI) kindly ++ * supported the development of this code. ++ * ++ * Copyright (c) 2000, 2001 Angelos D. Keromytis ++ * ++ * Permission to use, copy, and modify this software with or without fee ++ * is hereby granted, provided that this entire notice is included in ++ * all source code copies of any software which is or includes a copy or ++ * modification of this software. ++ * ++ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR ++ * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY ++ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE ++ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR ++ * PURPOSE. ++ * ++__FBSDID("$FreeBSD: src/sys/opencrypto/crypto.c,v 1.16 2005/01/07 02:29:16 imp Exp $"); ++ */ ++ ++ ++#ifndef AUTOCONF_INCLUDED ++#include ++#endif ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++/* ++ * keep track of whether or not we have been initialised, a big ++ * issue if we are linked into the kernel and a driver gets started before ++ * us ++ */ ++static int crypto_initted = 0; ++ ++/* ++ * Crypto drivers register themselves by allocating a slot in the ++ * crypto_drivers table with crypto_get_driverid() and then registering ++ * each algorithm they support with crypto_register() and crypto_kregister(). ++ */ ++ ++/* ++ * lock on driver table ++ * we track its state as spin_is_locked does not do anything on non-SMP boxes ++ */ ++static spinlock_t crypto_drivers_lock; ++static int crypto_drivers_locked; /* for non-SMP boxes */ ++ ++#define CRYPTO_DRIVER_LOCK() \ ++ ({ \ ++ spin_lock_irqsave(&crypto_drivers_lock, d_flags); \ ++ crypto_drivers_locked = 1; \ ++ dprintk("%s,%d: DRIVER_LOCK()\n", __FILE__, __LINE__); \ ++ }) ++#define CRYPTO_DRIVER_UNLOCK() \ ++ ({ \ ++ dprintk("%s,%d: DRIVER_UNLOCK()\n", __FILE__, __LINE__); \ ++ crypto_drivers_locked = 0; \ ++ spin_unlock_irqrestore(&crypto_drivers_lock, d_flags); \ ++ }) ++#define CRYPTO_DRIVER_ASSERT() \ ++ ({ \ ++ if (!crypto_drivers_locked) { \ ++ dprintk("%s,%d: DRIVER_ASSERT!\n", __FILE__, __LINE__); \ ++ } \ ++ }) ++ ++/* ++ * Crypto device/driver capabilities structure. ++ * ++ * Synchronization: ++ * (d) - protected by CRYPTO_DRIVER_LOCK() ++ * (q) - protected by CRYPTO_Q_LOCK() ++ * Not tagged fields are read-only. ++ */ ++struct cryptocap { ++ device_t cc_dev; /* (d) device/driver */ ++ u_int32_t cc_sessions; /* (d) # of sessions */ ++ u_int32_t cc_koperations; /* (d) # os asym operations */ ++ /* ++ * Largest possible operator length (in bits) for each type of ++ * encryption algorithm. XXX not used ++ */ ++ u_int16_t cc_max_op_len[CRYPTO_ALGORITHM_MAX + 1]; ++ u_int8_t cc_alg[CRYPTO_ALGORITHM_MAX + 1]; ++ u_int8_t cc_kalg[CRK_ALGORITHM_MAX + 1]; ++ ++ int cc_flags; /* (d) flags */ ++#define CRYPTOCAP_F_CLEANUP 0x80000000 /* needs resource cleanup */ ++ int cc_qblocked; /* (q) symmetric q blocked */ ++ int cc_kqblocked; /* (q) asymmetric q blocked */ ++}; ++static struct cryptocap *crypto_drivers = NULL; ++static int crypto_drivers_num = 0; ++ ++/* ++ * There are two queues for crypto requests; one for symmetric (e.g. ++ * cipher) operations and one for asymmetric (e.g. MOD)operations. ++ * A single mutex is used to lock access to both queues. We could ++ * have one per-queue but having one simplifies handling of block/unblock ++ * operations. ++ */ ++static int crp_sleep = 0; ++static LIST_HEAD(crp_q); /* request queues */ ++static LIST_HEAD(crp_kq); ++ ++static spinlock_t crypto_q_lock; ++ ++int crypto_all_qblocked = 0; /* protect with Q_LOCK */ ++module_param(crypto_all_qblocked, int, 0444); ++MODULE_PARM_DESC(crypto_all_qblocked, "Are all crypto queues blocked"); ++ ++int crypto_all_kqblocked = 0; /* protect with Q_LOCK */ ++module_param(crypto_all_kqblocked, int, 0444); ++MODULE_PARM_DESC(crypto_all_kqblocked, "Are all asym crypto queues blocked"); ++ ++#define CRYPTO_Q_LOCK() \ ++ ({ \ ++ spin_lock_irqsave(&crypto_q_lock, q_flags); \ ++ dprintk("%s,%d: Q_LOCK()\n", __FILE__, __LINE__); \ ++ }) ++#define CRYPTO_Q_UNLOCK() \ ++ ({ \ ++ dprintk("%s,%d: Q_UNLOCK()\n", __FILE__, __LINE__); \ ++ spin_unlock_irqrestore(&crypto_q_lock, q_flags); \ ++ }) ++ ++/* ++ * There are two queues for processing completed crypto requests; one ++ * for the symmetric and one for the asymmetric ops. We only need one ++ * but have two to avoid type futzing (cryptop vs. cryptkop). A single ++ * mutex is used to lock access to both queues. Note that this lock ++ * must be separate from the lock on request queues to insure driver ++ * callbacks don't generate lock order reversals. ++ */ ++static LIST_HEAD(crp_ret_q); /* callback queues */ ++static LIST_HEAD(crp_ret_kq); ++ ++static spinlock_t crypto_ret_q_lock; ++#define CRYPTO_RETQ_LOCK() \ ++ ({ \ ++ spin_lock_irqsave(&crypto_ret_q_lock, r_flags); \ ++ dprintk("%s,%d: RETQ_LOCK\n", __FILE__, __LINE__); \ ++ }) ++#define CRYPTO_RETQ_UNLOCK() \ ++ ({ \ ++ dprintk("%s,%d: RETQ_UNLOCK\n", __FILE__, __LINE__); \ ++ spin_unlock_irqrestore(&crypto_ret_q_lock, r_flags); \ ++ }) ++#define CRYPTO_RETQ_EMPTY() (list_empty(&crp_ret_q) && list_empty(&crp_ret_kq)) ++ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20) ++static kmem_cache_t *cryptop_zone; ++static kmem_cache_t *cryptodesc_zone; ++#else ++static struct kmem_cache *cryptop_zone; ++static struct kmem_cache *cryptodesc_zone; ++#endif ++ ++#define debug crypto_debug ++int crypto_debug = 0; ++module_param(crypto_debug, int, 0644); ++MODULE_PARM_DESC(crypto_debug, "Enable debug"); ++EXPORT_SYMBOL(crypto_debug); ++ ++/* ++ * Maximum number of outstanding crypto requests before we start ++ * failing requests. We need this to prevent DOS when too many ++ * requests are arriving for us to keep up. Otherwise we will ++ * run the system out of memory. Since crypto is slow, we are ++ * usually the bottleneck that needs to say, enough is enough. ++ * ++ * We cannot print errors when this condition occurs, we are already too ++ * slow, printing anything will just kill us ++ */ ++ ++static int crypto_q_cnt = 0; ++module_param(crypto_q_cnt, int, 0444); ++MODULE_PARM_DESC(crypto_q_cnt, ++ "Current number of outstanding crypto requests"); ++ ++static int crypto_q_max = 1000; ++module_param(crypto_q_max, int, 0644); ++MODULE_PARM_DESC(crypto_q_max, ++ "Maximum number of outstanding crypto requests"); ++ ++#define bootverbose crypto_verbose ++static int crypto_verbose = 0; ++module_param(crypto_verbose, int, 0644); ++MODULE_PARM_DESC(crypto_verbose, ++ "Enable verbose crypto startup"); ++ ++int crypto_usercrypto = 1; /* userland may do crypto reqs */ ++module_param(crypto_usercrypto, int, 0644); ++MODULE_PARM_DESC(crypto_usercrypto, ++ "Enable/disable user-mode access to crypto support"); ++ ++int crypto_userasymcrypto = 1; /* userland may do asym crypto reqs */ ++module_param(crypto_userasymcrypto, int, 0644); ++MODULE_PARM_DESC(crypto_userasymcrypto, ++ "Enable/disable user-mode access to asymmetric crypto support"); ++ ++int crypto_devallowsoft = 0; /* only use hardware crypto */ ++module_param(crypto_devallowsoft, int, 0644); ++MODULE_PARM_DESC(crypto_devallowsoft, ++ "Enable/disable use of software crypto support"); ++ ++static pid_t cryptoproc = (pid_t) -1; ++static struct completion cryptoproc_exited; ++static DECLARE_WAIT_QUEUE_HEAD(cryptoproc_wait); ++static pid_t cryptoretproc = (pid_t) -1; ++static struct completion cryptoretproc_exited; ++static DECLARE_WAIT_QUEUE_HEAD(cryptoretproc_wait); ++ ++static int crypto_proc(void *arg); ++static int crypto_ret_proc(void *arg); ++static int crypto_invoke(struct cryptocap *cap, struct cryptop *crp, int hint); ++static int crypto_kinvoke(struct cryptkop *krp, int flags); ++static void crypto_exit(void); ++static int crypto_init(void); ++ ++static struct cryptostats cryptostats; ++ ++static struct cryptocap * ++crypto_checkdriver(u_int32_t hid) ++{ ++ if (crypto_drivers == NULL) ++ return NULL; ++ return (hid >= crypto_drivers_num ? NULL : &crypto_drivers[hid]); ++} ++ ++/* ++ * Compare a driver's list of supported algorithms against another ++ * list; return non-zero if all algorithms are supported. ++ */ ++static int ++driver_suitable(const struct cryptocap *cap, const struct cryptoini *cri) ++{ ++ const struct cryptoini *cr; ++ ++ /* See if all the algorithms are supported. */ ++ for (cr = cri; cr; cr = cr->cri_next) ++ if (cap->cc_alg[cr->cri_alg] == 0) ++ return 0; ++ return 1; ++} ++ ++/* ++ * Select a driver for a new session that supports the specified ++ * algorithms and, optionally, is constrained according to the flags. ++ * The algorithm we use here is pretty stupid; just use the ++ * first driver that supports all the algorithms we need. If there ++ * are multiple drivers we choose the driver with the fewest active ++ * sessions. We prefer hardware-backed drivers to software ones. ++ * ++ * XXX We need more smarts here (in real life too, but that's ++ * XXX another story altogether). ++ */ ++static struct cryptocap * ++crypto_select_driver(const struct cryptoini *cri, int flags) ++{ ++ struct cryptocap *cap, *best; ++ int match, hid; ++ ++ CRYPTO_DRIVER_ASSERT(); ++ ++ /* ++ * Look first for hardware crypto devices if permitted. ++ */ ++ if (flags & CRYPTOCAP_F_HARDWARE) ++ match = CRYPTOCAP_F_HARDWARE; ++ else ++ match = CRYPTOCAP_F_SOFTWARE; ++ best = NULL; ++again: ++ for (hid = 0; hid < crypto_drivers_num; hid++) { ++ cap = &crypto_drivers[hid]; ++ /* ++ * If it's not initialized, is in the process of ++ * going away, or is not appropriate (hardware ++ * or software based on match), then skip. ++ */ ++ if (cap->cc_dev == NULL || ++ (cap->cc_flags & CRYPTOCAP_F_CLEANUP) || ++ (cap->cc_flags & match) == 0) ++ continue; ++ ++ /* verify all the algorithms are supported. */ ++ if (driver_suitable(cap, cri)) { ++ if (best == NULL || ++ cap->cc_sessions < best->cc_sessions) ++ best = cap; ++ } ++ } ++ if (best != NULL) ++ return best; ++ if (match == CRYPTOCAP_F_HARDWARE && (flags & CRYPTOCAP_F_SOFTWARE)) { ++ /* sort of an Algol 68-style for loop */ ++ match = CRYPTOCAP_F_SOFTWARE; ++ goto again; ++ } ++ return best; ++} ++ ++/* ++ * Create a new session. The crid argument specifies a crypto ++ * driver to use or constraints on a driver to select (hardware ++ * only, software only, either). Whatever driver is selected ++ * must be capable of the requested crypto algorithms. ++ */ ++int ++crypto_newsession(u_int64_t *sid, struct cryptoini *cri, int crid) ++{ ++ struct cryptocap *cap; ++ u_int32_t hid, lid; ++ int err; ++ unsigned long d_flags; ++ ++ CRYPTO_DRIVER_LOCK(); ++ if ((crid & (CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE)) == 0) { ++ /* ++ * Use specified driver; verify it is capable. ++ */ ++ cap = crypto_checkdriver(crid); ++ if (cap != NULL && !driver_suitable(cap, cri)) ++ cap = NULL; ++ } else { ++ /* ++ * No requested driver; select based on crid flags. ++ */ ++ cap = crypto_select_driver(cri, crid); ++ /* ++ * if NULL then can't do everything in one session. ++ * XXX Fix this. We need to inject a "virtual" session ++ * XXX layer right about here. ++ */ ++ } ++ if (cap != NULL) { ++ /* Call the driver initialization routine. */ ++ hid = cap - crypto_drivers; ++ lid = hid; /* Pass the driver ID. */ ++ cap->cc_sessions++; ++ CRYPTO_DRIVER_UNLOCK(); ++ err = CRYPTODEV_NEWSESSION(cap->cc_dev, &lid, cri); ++ CRYPTO_DRIVER_LOCK(); ++ if (err == 0) { ++ (*sid) = (cap->cc_flags & 0xff000000) ++ | (hid & 0x00ffffff); ++ (*sid) <<= 32; ++ (*sid) |= (lid & 0xffffffff); ++ } else ++ cap->cc_sessions--; ++ } else ++ err = EINVAL; ++ CRYPTO_DRIVER_UNLOCK(); ++ return err; ++} ++ ++static void ++crypto_remove(struct cryptocap *cap) ++{ ++ CRYPTO_DRIVER_ASSERT(); ++ if (cap->cc_sessions == 0 && cap->cc_koperations == 0) ++ bzero(cap, sizeof(*cap)); ++} ++ ++/* ++ * Delete an existing session (or a reserved session on an unregistered ++ * driver). ++ */ ++int ++crypto_freesession(u_int64_t sid) ++{ ++ struct cryptocap *cap; ++ u_int32_t hid; ++ int err = 0; ++ unsigned long d_flags; ++ ++ dprintk("%s()\n", __FUNCTION__); ++ CRYPTO_DRIVER_LOCK(); ++ ++ if (crypto_drivers == NULL) { ++ err = EINVAL; ++ goto done; ++ } ++ ++ /* Determine two IDs. */ ++ hid = CRYPTO_SESID2HID(sid); ++ ++ if (hid >= crypto_drivers_num) { ++ dprintk("%s - INVALID DRIVER NUM %d\n", __FUNCTION__, hid); ++ err = ENOENT; ++ goto done; ++ } ++ cap = &crypto_drivers[hid]; ++ ++ if (cap->cc_dev) { ++ CRYPTO_DRIVER_UNLOCK(); ++ /* Call the driver cleanup routine, if available, unlocked. */ ++ err = CRYPTODEV_FREESESSION(cap->cc_dev, sid); ++ CRYPTO_DRIVER_LOCK(); ++ } ++ ++ if (cap->cc_sessions) ++ cap->cc_sessions--; ++ ++ if (cap->cc_flags & CRYPTOCAP_F_CLEANUP) ++ crypto_remove(cap); ++ ++done: ++ CRYPTO_DRIVER_UNLOCK(); ++ return err; ++} ++ ++/* ++ * Return an unused driver id. Used by drivers prior to registering ++ * support for the algorithms they handle. ++ */ ++int32_t ++crypto_get_driverid(device_t dev, int flags) ++{ ++ struct cryptocap *newdrv; ++ int i; ++ unsigned long d_flags; ++ ++ if ((flags & (CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE)) == 0) { ++ printf("%s: no flags specified when registering driver\n", ++ device_get_nameunit(dev)); ++ return -1; ++ } ++ ++ CRYPTO_DRIVER_LOCK(); ++ ++ for (i = 0; i < crypto_drivers_num; i++) { ++ if (crypto_drivers[i].cc_dev == NULL && ++ (crypto_drivers[i].cc_flags & CRYPTOCAP_F_CLEANUP) == 0) { ++ break; ++ } ++ } ++ ++ /* Out of entries, allocate some more. */ ++ if (i == crypto_drivers_num) { ++ /* Be careful about wrap-around. */ ++ if (2 * crypto_drivers_num <= crypto_drivers_num) { ++ CRYPTO_DRIVER_UNLOCK(); ++ printk("crypto: driver count wraparound!\n"); ++ return -1; ++ } ++ ++ newdrv = kmalloc(2 * crypto_drivers_num * sizeof(struct cryptocap), ++ GFP_KERNEL); ++ if (newdrv == NULL) { ++ CRYPTO_DRIVER_UNLOCK(); ++ printk("crypto: no space to expand driver table!\n"); ++ return -1; ++ } ++ ++ memcpy(newdrv, crypto_drivers, ++ crypto_drivers_num * sizeof(struct cryptocap)); ++ memset(&newdrv[crypto_drivers_num], 0, ++ crypto_drivers_num * sizeof(struct cryptocap)); ++ ++ crypto_drivers_num *= 2; ++ ++ kfree(crypto_drivers); ++ crypto_drivers = newdrv; ++ } ++ ++ /* NB: state is zero'd on free */ ++ crypto_drivers[i].cc_sessions = 1; /* Mark */ ++ crypto_drivers[i].cc_dev = dev; ++ crypto_drivers[i].cc_flags = flags; ++ if (bootverbose) ++ printf("crypto: assign %s driver id %u, flags %u\n", ++ device_get_nameunit(dev), i, flags); ++ ++ CRYPTO_DRIVER_UNLOCK(); ++ ++ return i; ++} ++ ++/* ++ * Lookup a driver by name. We match against the full device ++ * name and unit, and against just the name. The latter gives ++ * us a simple widlcarding by device name. On success return the ++ * driver/hardware identifier; otherwise return -1. ++ */ ++int ++crypto_find_driver(const char *match) ++{ ++ int i, len = strlen(match); ++ unsigned long d_flags; ++ ++ CRYPTO_DRIVER_LOCK(); ++ for (i = 0; i < crypto_drivers_num; i++) { ++ device_t dev = crypto_drivers[i].cc_dev; ++ if (dev == NULL || ++ (crypto_drivers[i].cc_flags & CRYPTOCAP_F_CLEANUP)) ++ continue; ++ if (strncmp(match, device_get_nameunit(dev), len) == 0 || ++ strncmp(match, device_get_name(dev), len) == 0) ++ break; ++ } ++ CRYPTO_DRIVER_UNLOCK(); ++ return i < crypto_drivers_num ? i : -1; ++} ++ ++/* ++ * Return the device_t for the specified driver or NULL ++ * if the driver identifier is invalid. ++ */ ++device_t ++crypto_find_device_byhid(int hid) ++{ ++ struct cryptocap *cap = crypto_checkdriver(hid); ++ return cap != NULL ? cap->cc_dev : NULL; ++} ++ ++/* ++ * Return the device/driver capabilities. ++ */ ++int ++crypto_getcaps(int hid) ++{ ++ struct cryptocap *cap = crypto_checkdriver(hid); ++ return cap != NULL ? cap->cc_flags : 0; ++} ++ ++/* ++ * Register support for a key-related algorithm. This routine ++ * is called once for each algorithm supported a driver. ++ */ ++int ++crypto_kregister(u_int32_t driverid, int kalg, u_int32_t flags) ++{ ++ struct cryptocap *cap; ++ int err; ++ unsigned long d_flags; ++ ++ dprintk("%s()\n", __FUNCTION__); ++ CRYPTO_DRIVER_LOCK(); ++ ++ cap = crypto_checkdriver(driverid); ++ if (cap != NULL && ++ (CRK_ALGORITM_MIN <= kalg && kalg <= CRK_ALGORITHM_MAX)) { ++ /* ++ * XXX Do some performance testing to determine placing. ++ * XXX We probably need an auxiliary data structure that ++ * XXX describes relative performances. ++ */ ++ ++ cap->cc_kalg[kalg] = flags | CRYPTO_ALG_FLAG_SUPPORTED; ++ if (bootverbose) ++ printf("crypto: %s registers key alg %u flags %u\n" ++ , device_get_nameunit(cap->cc_dev) ++ , kalg ++ , flags ++ ); ++ err = 0; ++ } else ++ err = EINVAL; ++ ++ CRYPTO_DRIVER_UNLOCK(); ++ return err; ++} ++ ++/* ++ * Register support for a non-key-related algorithm. This routine ++ * is called once for each such algorithm supported by a driver. ++ */ ++int ++crypto_register(u_int32_t driverid, int alg, u_int16_t maxoplen, ++ u_int32_t flags) ++{ ++ struct cryptocap *cap; ++ int err; ++ unsigned long d_flags; ++ ++ dprintk("%s(id=0x%x, alg=%d, maxoplen=%d, flags=0x%x)\n", __FUNCTION__, ++ driverid, alg, maxoplen, flags); ++ ++ CRYPTO_DRIVER_LOCK(); ++ ++ cap = crypto_checkdriver(driverid); ++ /* NB: algorithms are in the range [1..max] */ ++ if (cap != NULL && ++ (CRYPTO_ALGORITHM_MIN <= alg && alg <= CRYPTO_ALGORITHM_MAX)) { ++ /* ++ * XXX Do some performance testing to determine placing. ++ * XXX We probably need an auxiliary data structure that ++ * XXX describes relative performances. ++ */ ++ ++ cap->cc_alg[alg] = flags | CRYPTO_ALG_FLAG_SUPPORTED; ++ cap->cc_max_op_len[alg] = maxoplen; ++ if (bootverbose) ++ printf("crypto: %s registers alg %u flags %u maxoplen %u\n" ++ , device_get_nameunit(cap->cc_dev) ++ , alg ++ , flags ++ , maxoplen ++ ); ++ cap->cc_sessions = 0; /* Unmark */ ++ err = 0; ++ } else ++ err = EINVAL; ++ ++ CRYPTO_DRIVER_UNLOCK(); ++ return err; ++} ++ ++static void ++driver_finis(struct cryptocap *cap) ++{ ++ u_int32_t ses, kops; ++ ++ CRYPTO_DRIVER_ASSERT(); ++ ++ ses = cap->cc_sessions; ++ kops = cap->cc_koperations; ++ bzero(cap, sizeof(*cap)); ++ if (ses != 0 || kops != 0) { ++ /* ++ * If there are pending sessions, ++ * just mark as invalid. ++ */ ++ cap->cc_flags |= CRYPTOCAP_F_CLEANUP; ++ cap->cc_sessions = ses; ++ cap->cc_koperations = kops; ++ } ++} ++ ++/* ++ * Unregister a crypto driver. If there are pending sessions using it, ++ * leave enough information around so that subsequent calls using those ++ * sessions will correctly detect the driver has been unregistered and ++ * reroute requests. ++ */ ++int ++crypto_unregister(u_int32_t driverid, int alg) ++{ ++ struct cryptocap *cap; ++ int i, err; ++ unsigned long d_flags; ++ ++ dprintk("%s()\n", __FUNCTION__); ++ CRYPTO_DRIVER_LOCK(); ++ ++ cap = crypto_checkdriver(driverid); ++ if (cap != NULL && ++ (CRYPTO_ALGORITHM_MIN <= alg && alg <= CRYPTO_ALGORITHM_MAX) && ++ cap->cc_alg[alg] != 0) { ++ cap->cc_alg[alg] = 0; ++ cap->cc_max_op_len[alg] = 0; ++ ++ /* Was this the last algorithm ? */ ++ for (i = 1; i <= CRYPTO_ALGORITHM_MAX; i++) ++ if (cap->cc_alg[i] != 0) ++ break; ++ ++ if (i == CRYPTO_ALGORITHM_MAX + 1) ++ driver_finis(cap); ++ err = 0; ++ } else ++ err = EINVAL; ++ CRYPTO_DRIVER_UNLOCK(); ++ return err; ++} ++ ++/* ++ * Unregister all algorithms associated with a crypto driver. ++ * If there are pending sessions using it, leave enough information ++ * around so that subsequent calls using those sessions will ++ * correctly detect the driver has been unregistered and reroute ++ * requests. ++ */ ++int ++crypto_unregister_all(u_int32_t driverid) ++{ ++ struct cryptocap *cap; ++ int err; ++ unsigned long d_flags; ++ ++ dprintk("%s()\n", __FUNCTION__); ++ CRYPTO_DRIVER_LOCK(); ++ cap = crypto_checkdriver(driverid); ++ if (cap != NULL) { ++ driver_finis(cap); ++ err = 0; ++ } else ++ err = EINVAL; ++ CRYPTO_DRIVER_UNLOCK(); ++ ++ return err; ++} ++ ++/* ++ * Clear blockage on a driver. The what parameter indicates whether ++ * the driver is now ready for cryptop's and/or cryptokop's. ++ */ ++int ++crypto_unblock(u_int32_t driverid, int what) ++{ ++ struct cryptocap *cap; ++ int err; ++ unsigned long q_flags; ++ ++ CRYPTO_Q_LOCK(); ++ cap = crypto_checkdriver(driverid); ++ if (cap != NULL) { ++ if (what & CRYPTO_SYMQ) { ++ cap->cc_qblocked = 0; ++ crypto_all_qblocked = 0; ++ } ++ if (what & CRYPTO_ASYMQ) { ++ cap->cc_kqblocked = 0; ++ crypto_all_kqblocked = 0; ++ } ++ if (crp_sleep) ++ wake_up_interruptible(&cryptoproc_wait); ++ err = 0; ++ } else ++ err = EINVAL; ++ CRYPTO_Q_UNLOCK(); //DAVIDM should this be a driver lock ++ ++ return err; ++} ++ ++/* ++ * Add a crypto request to a queue, to be processed by the kernel thread. ++ */ ++int ++crypto_dispatch(struct cryptop *crp) ++{ ++ struct cryptocap *cap; ++ int result = -1; ++ unsigned long q_flags; ++ ++ dprintk("%s()\n", __FUNCTION__); ++ ++ cryptostats.cs_ops++; ++ ++ CRYPTO_Q_LOCK(); ++ if (crypto_q_cnt >= crypto_q_max) { ++ CRYPTO_Q_UNLOCK(); ++ cryptostats.cs_drops++; ++ return ENOMEM; ++ } ++ crypto_q_cnt++; ++ ++ /* ++ * Caller marked the request to be processed immediately; dispatch ++ * it directly to the driver unless the driver is currently blocked. ++ */ ++ if ((crp->crp_flags & CRYPTO_F_BATCH) == 0) { ++ int hid = CRYPTO_SESID2HID(crp->crp_sid); ++ cap = crypto_checkdriver(hid); ++ /* Driver cannot disappear when there is an active session. */ ++ KASSERT(cap != NULL, ("%s: Driver disappeared.", __func__)); ++ if (!cap->cc_qblocked) { ++ crypto_all_qblocked = 0; ++ crypto_drivers[hid].cc_qblocked = 1; ++ CRYPTO_Q_UNLOCK(); ++ result = crypto_invoke(cap, crp, 0); ++ CRYPTO_Q_LOCK(); ++ if (result != ERESTART) ++ crypto_drivers[hid].cc_qblocked = 0; ++ } ++ } ++ if (result == ERESTART) { ++ /* ++ * The driver ran out of resources, mark the ++ * driver ``blocked'' for cryptop's and put ++ * the request back in the queue. It would ++ * best to put the request back where we got ++ * it but that's hard so for now we put it ++ * at the front. This should be ok; putting ++ * it at the end does not work. ++ */ ++ list_add(&crp->crp_next, &crp_q); ++ cryptostats.cs_blocks++; ++ } else if (result == -1) { ++ TAILQ_INSERT_TAIL(&crp_q, crp, crp_next); ++ } ++ if (crp_sleep) ++ wake_up_interruptible(&cryptoproc_wait); ++ CRYPTO_Q_UNLOCK(); ++ return 0; ++} ++ ++/* ++ * Add an asymetric crypto request to a queue, ++ * to be processed by the kernel thread. ++ */ ++int ++crypto_kdispatch(struct cryptkop *krp) ++{ ++ int error; ++ unsigned long q_flags; ++ ++ cryptostats.cs_kops++; ++ ++ error = crypto_kinvoke(krp, krp->krp_crid); ++ if (error == ERESTART) { ++ CRYPTO_Q_LOCK(); ++ TAILQ_INSERT_TAIL(&crp_kq, krp, krp_next); ++ if (crp_sleep) ++ wake_up_interruptible(&cryptoproc_wait); ++ CRYPTO_Q_UNLOCK(); ++ error = 0; ++ } ++ return error; ++} ++ ++/* ++ * Verify a driver is suitable for the specified operation. ++ */ ++static __inline int ++kdriver_suitable(const struct cryptocap *cap, const struct cryptkop *krp) ++{ ++ return (cap->cc_kalg[krp->krp_op] & CRYPTO_ALG_FLAG_SUPPORTED) != 0; ++} ++ ++/* ++ * Select a driver for an asym operation. The driver must ++ * support the necessary algorithm. The caller can constrain ++ * which device is selected with the flags parameter. The ++ * algorithm we use here is pretty stupid; just use the first ++ * driver that supports the algorithms we need. If there are ++ * multiple suitable drivers we choose the driver with the ++ * fewest active operations. We prefer hardware-backed ++ * drivers to software ones when either may be used. ++ */ ++static struct cryptocap * ++crypto_select_kdriver(const struct cryptkop *krp, int flags) ++{ ++ struct cryptocap *cap, *best, *blocked; ++ int match, hid; ++ ++ CRYPTO_DRIVER_ASSERT(); ++ ++ /* ++ * Look first for hardware crypto devices if permitted. ++ */ ++ if (flags & CRYPTOCAP_F_HARDWARE) ++ match = CRYPTOCAP_F_HARDWARE; ++ else ++ match = CRYPTOCAP_F_SOFTWARE; ++ best = NULL; ++ blocked = NULL; ++again: ++ for (hid = 0; hid < crypto_drivers_num; hid++) { ++ cap = &crypto_drivers[hid]; ++ /* ++ * If it's not initialized, is in the process of ++ * going away, or is not appropriate (hardware ++ * or software based on match), then skip. ++ */ ++ if (cap->cc_dev == NULL || ++ (cap->cc_flags & CRYPTOCAP_F_CLEANUP) || ++ (cap->cc_flags & match) == 0) ++ continue; ++ ++ /* verify all the algorithms are supported. */ ++ if (kdriver_suitable(cap, krp)) { ++ if (best == NULL || ++ cap->cc_koperations < best->cc_koperations) ++ best = cap; ++ } ++ } ++ if (best != NULL) ++ return best; ++ if (match == CRYPTOCAP_F_HARDWARE && (flags & CRYPTOCAP_F_SOFTWARE)) { ++ /* sort of an Algol 68-style for loop */ ++ match = CRYPTOCAP_F_SOFTWARE; ++ goto again; ++ } ++ return best; ++} ++ ++/* ++ * Dispatch an assymetric crypto request. ++ */ ++static int ++crypto_kinvoke(struct cryptkop *krp, int crid) ++{ ++ struct cryptocap *cap = NULL; ++ int error; ++ unsigned long d_flags; ++ ++ KASSERT(krp != NULL, ("%s: krp == NULL", __func__)); ++ KASSERT(krp->krp_callback != NULL, ++ ("%s: krp->crp_callback == NULL", __func__)); ++ ++ CRYPTO_DRIVER_LOCK(); ++ if ((crid & (CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE)) == 0) { ++ cap = crypto_checkdriver(crid); ++ if (cap != NULL) { ++ /* ++ * Driver present, it must support the necessary ++ * algorithm and, if s/w drivers are excluded, ++ * it must be registered as hardware-backed. ++ */ ++ if (!kdriver_suitable(cap, krp) || ++ (!crypto_devallowsoft && ++ (cap->cc_flags & CRYPTOCAP_F_HARDWARE) == 0)) ++ cap = NULL; ++ } ++ } else { ++ /* ++ * No requested driver; select based on crid flags. ++ */ ++ if (!crypto_devallowsoft) /* NB: disallow s/w drivers */ ++ crid &= ~CRYPTOCAP_F_SOFTWARE; ++ cap = crypto_select_kdriver(krp, crid); ++ } ++ if (cap != NULL && !cap->cc_kqblocked) { ++ krp->krp_hid = cap - crypto_drivers; ++ cap->cc_koperations++; ++ CRYPTO_DRIVER_UNLOCK(); ++ error = CRYPTODEV_KPROCESS(cap->cc_dev, krp, 0); ++ CRYPTO_DRIVER_LOCK(); ++ if (error == ERESTART) { ++ cap->cc_koperations--; ++ CRYPTO_DRIVER_UNLOCK(); ++ return (error); ++ } ++ /* return the actual device used */ ++ krp->krp_crid = krp->krp_hid; ++ } else { ++