package/openssl/patches/200-ocf-20080917.patch

   1 --- a/Configure
   2 +++ b/Configure
   3 @@ -34,6 +34,8 @@ my $usage="Usage: Configure [no-<cipher>
   4  #              (Default: KRB5_DIR/include)
   5  # --with-krb5-flavor  Declare what flavor of Kerberos 5 is used.  Currently
   6  #              supported values are "MIT" and "Heimdal".  A value is required.
   7 +# --with-cryptodev Force support for cryptodev (ie., ocf-linux)
   8 +# --with-cryptodev-digests Force support for cryptodev digests (generally slow)
   9  #
  10  # --test-sanity Make a number of sanity checks on the data in this file.
  11  #               This is a debugging tool for OpenSSL developers.
  12 @@ -540,6 +542,9 @@ my %table=(
  13  ##### Compaq Non-Stop Kernel (Tandem)
  14  "tandem-c89","c89:-Ww -D__TANDEM -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1 -D_TANDEM_SOURCE -DB_ENDIAN::(unknown):::THIRTY_TWO_BIT:::",
  15
  16 +# uClinux
  17 +"uClinux-dist","$ENV{'CC'}:\$(CFLAGS)::-D_REENTRANT::\$(LDFLAGS) \$(LDLIBS):BN_LLONG::::::::::::\$(LIBSSL_dlfcn):linux-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):$ENV{'RANLIB'}",
  18 +
  19  );
  20
  21  my @MK1MF_Builds=qw(VC-WIN64I VC-WIN64A
  22 @@ -589,6 +594,8 @@ my $montasm=1;   # but "no-montasm" is d
  23  my $no_asm=0;
  24  my $no_dso=0;
  25  my $no_gmp=0;
  26 +my $have_cryptodev=0;
  27 +my $use_cryptodev_digests=0;
  28  my @skip=();
  29  my $Makefile="Makefile";
  30  my $des_locl="crypto/des/des_locl.h";
  31 @@ -716,6 +723,14 @@ PROCESS_ARGS:
  32                         {
  33                         exit(&test_sanity());
  34                         }
  35 +               elsif (/^--with-cryptodev$/)
  36 +                       {
  37 +                               $have_cryptodev = 1;
  38 +                       }
  39 +               elsif (/^--with-cryptodev-digests$/)
  40 +                       {
  41 +                               $use_cryptodev_digests = 1;
  42 +                       }
  43                 elsif (/^reconfigure/ || /^reconf/)
  44                         {
  45                         if (open(IN,"<$Makefile"))
  46 @@ -924,6 +939,7 @@ foreach (sort (keys %disabled))
  47                         print " OPENSSL_NO_$ALGO";
  48
  49                         if (/^err$/)    { $flags .= "-DOPENSSL_NO_ERR "; }
  50 +                       elsif (/^hw$/)  { $flags .= "-DOPENSSL_NO_HW "; }
  51                         elsif (/^asm$/) { $no_asm = 1; }
  52                         }
  53                 else
  54 @@ -1064,6 +1080,16 @@ if (!$no_krb5)
  55                    $withargs{"krb5-dir"} ne "";
  56         }
  57
  58 +# enable the linux cryptodev (ocf-linux) support
  59 +if ($have_cryptodev)
  60 +       {
  61 +       if ($use_cryptodev_digests)
  62 +               {
  63 +               $cflags = "-DUSE_CRYPTODEV_DIGESTS $cflags";
  64 +               }
  65 +       $cflags = "-DHAVE_CRYPTODEV $cflags";
  66 +       }
  67 +
  68  # The DSO code currently always implements all functions so that no
  69  # applications will have to worry about that from a compilation point
  70  # of view. However, the "method"s may return zero unless that platform
  71 --- a/INSTALL
  72 +++ b/INSTALL
  73 @@ -103,6 +103,12 @@
  74                  define preprocessor symbols, specify additional libraries,
  75                  library directories or other compiler options.
  76
  77 +  --with-cryptodev Enabled the BSD cryptodev engine even if we are not using
  78 +               BSD.  Useful if you are running ocf-linux or something
  79 +               similar.  Once enabled you can also enable the use of
  80 +               cryptodev digests,  with is usually slower unless you have
  81 +               large amounts data.  Use --with-cryptodev-digests to force
  82 +               it.
  83
  84   Installation in Detail
  85   ----------------------
  86 --- a/Makefile.org
  87 +++ b/Makefile.org
  88 @@ -367,7 +367,7 @@ files:
  89
  90  links:
  91         @$(PERL) $(TOP)/util/mkdir-p.pl include/openssl
  92 -       @$(PERL) $(TOP)/util/mklink.pl include/openssl $(EXHEADER)
  93 +       @$(PERL) $(TOP)/util/mklink.pl include/openssl $(HEADER) $(EXHEADER)
  94         @set -e; target=links; $(RECURSIVE_BUILD_CMD)
  95
  96  gentests:
  97 --- a/Makefile.shared
  98 +++ b/Makefile.shared
  99 @@ -6,13 +6,13 @@
 100  # properly
 101
 102  # CC contains the current compiler.  This one MUST be defined
 103 -CC=cc
 104 -CFLAGS=$(CFLAG)
 105 +CC?=cc
 106 +CFLAGS?=$(CFLAG)
 107  # LDFLAGS contains flags to be used when temporary object files (when building
 108  # shared libraries) are created, or when an application is linked.
 109  # SHARED_LDFLAGS contains flags to be used when the shared library is created.
 110 -LDFLAGS=
 111 -SHARED_LDFLAGS=
 112 +LDFLAGS?=
 113 +SHARED_LDFLAGS?=
 114
 115  # LIBNAME contains just the name of the library, without prefix ("lib"
 116  # on Unix, "cyg" for certain forms under Cygwin...) or suffix (.a, .so,
 117 --- a/config
 118 +++ b/config
 119 @@ -48,10 +48,10 @@ done
 120
 121  # First get uname entries that we use below
 122
 123 -MACHINE=`(uname -m) 2>/dev/null` || MACHINE="unknown"
 124 -RELEASE=`(uname -r) 2>/dev/null` || RELEASE="unknown"
 125 -SYSTEM=`(uname -s) 2>/dev/null`  || SYSTEM="unknown"
 126 -VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
 127 +[ "$MACHINE" ] || MACHINE=`(uname -m) 2>/dev/null` || MACHINE="unknown"
 128 +[ "$RELEASE" ] || RELEASE=`(uname -r) 2>/dev/null` || RELEASE="unknown"
 129 +[ "$SYSTEM" ]  || SYSTEM=`(uname -s) 2>/dev/null`  || SYSTEM="unknown"
 130 +[ "$VERSION" ] || VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
 131
 132
 133  # Now test for ISC and SCO, since it is has a braindamaged uname.
 134 @@ -270,7 +270,7 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${
 135                 echo "ppc-apple-darwin${VERSION}"
 136                 ;;
 137             *)
 138 -               echo "i386-apple-darwin${VERSION}"
 139 +               echo "${MACHINE}-apple-darwin${VERSION}"
 140                 ;;
 141         esac
 142         exit 0
 143 @@ -401,9 +401,9 @@ exit 0
 144
 145  # figure out if gcc is available and if so we use it otherwise
 146  # we fallback to whatever cc does on the system
 147 -GCCVER=`(gcc -dumpversion) 2>/dev/null`
 148 +CC="${CC:-gcc}"
 149 +GCCVER=`(${CC} -dumpversion) 2>/dev/null`
 150  if [ "$GCCVER" != "" ]; then
 151 -  CC=gcc
 152    # then strip off whatever prefix egcs prepends the number with...
 153    # Hopefully, this will work for any future prefixes as well.
 154    GCCVER=`echo $GCCVER | LC_ALL=C sed 's/^[a-zA-Z]*\-//'`
 155 @@ -413,7 +413,7 @@ if [ "$GCCVER" != "" ]; then
 156    # peak single digit before and after first dot, e.g. 2.95.1 gives 29
 157    GCCVER=`echo $GCCVER | sed 's/\([0-9]\)\.\([0-9]\).*/\1\2/'`
 158  else
 159 -  CC=cc
 160 +  CC="${CC:-cc}"
 161  fi
 162  GCCVER=${GCCVER:-0}
 163  if [ "$SYSTEM" = "HP-UX" ];then
 164 @@ -482,6 +482,9 @@ echo Operating system: $GUESSOS
 165  # script above so we end up with values in vars but that would take
 166  # more time that I want to waste at the moment
 167  case "$GUESSOS" in
 168 +  uClinux*)
 169 +    OUT=uClinux-dist
 170 +       ;;
 171    mips2-sgi-irix)
 172         CPU=`(hinv -t cpu) 2>/dev/null | head -1 | sed 's/^CPU:[^R]*R\([0-9]*\).*/\1/'`
 173         CPU=${CPU:-0}
 174 --- /dev/null
 175 +++ b/makefile-uclinuxdist
 176 @@ -0,0 +1,138 @@
 177 +#
 178 +# this makefile gets recursed through by various bits of the build
 179 +# so we need to only setup some things when invoked from outside
 180 +# this directory.
 181 +#
 182 +# davidm@snapgear.com
 183 +#
 184 +
 185 +IN_LIBSSL := true
 186 +export IN_LIBSSL
 187 +
 188 +CONFIG_OPTS  := --prefix=// --install_prefix=$(shell pwd)/build/install
 189 +
 190 +ifdef CONFIG_USER_FLATFSD_FLATFSD
 191 +CONFIG_OPTS += --openssldir=/etc/config
 192 +else
 193 +CONFIG_OPTS += --openssldir=/etc
 194 +endif
 195 +ifdef DISABLE_SHARED_SSL
 196 +CONFIG_OPTS += no-shared
 197 +else
 198 +CONFIG_OPTS += shared
 199 +endif
 200 +
 201 +CONFIG_OPTS += no-rc2
 202 +CONFIG_OPTS += no-krb5
 203 +CONFIG_OPTS += no-rc5
 204 +CONFIG_OPTS += no-md2
 205 +CONFIG_OPTS += no-idea
 206 +#CONFIG_OPTS += no-pem
 207 +#CONFIG_OPTS += no-md5
 208 +#CONFIG_OPTS += no-sha
 209 +#CONFIG_OPTS += no-hmac
 210 +#CONFIG_OPTS += no-des
 211 +#CONFIG_OPTS += no-aes
 212 +#CONFIG_OPTS += no-bn
 213 +CONFIG_OPTS += no-ec
 214 +#CONFIG_OPTS += no-rsa
 215 +#CONFIG_OPTS += no-dsa
 216 +CONFIG_OPTS += no-ecdsa
 217 +#CONFIG_OPTS += no-dh
 218 +CONFIG_OPTS += no-ecdh
 219 +CONFIG_OPTS += no-dso
 220 +#CONFIG_OPTS += no-engine
 221 +#CONFIG_OPTS += no-buffer
 222 +#CONFIG_OPTS += no-bio
 223 +#CONFIG_OPTS += no-stack
 224 +#CONFIG_OPTS += no-lhash
 225 +#CONFIG_OPTS += no-rand
 226 +CONFIG_OPTS += no-err
 227 +#CONFIG_OPTS += no-evp
 228 +#CONFIG_OPTS += no-asn1
 229 +#CONFIG_OPTS += no-x509
 230 +#CONFIG_OPTS += no-x509v3
 231 +#CONFIG_OPTS += no-txt_db
 232 +#CONFIG_OPTS += no-pkcs7
 233 +#CONFIG_OPTS += no-pkcs12
 234 +#CONFIG_OPTS += no-comp
 235 +#CONFIG_OPTS += no-ocsp
 236 +#CONFIG_OPTS += no-ui
 237 +#CONFIG_OPTS += no-store
 238 +CONFIG_OPTS += no-pqueue
 239 +
 240 +# REVISIT: It would be better to have OPENSSL config options
 241 +# which turn on this support as needed
 242 +ifeq ($(CONFIG_USER_NESSUS_NASL)$(CONFIG_USER_SSH_SSH),)
 243 +CONFIG_OPTS += no-ripemd
 244 +CONFIG_OPTS += no-cast
 245 +CONFIG_OPTS += no-rc4
 246 +endif
 247 +
 248 +ifeq ($(CONFIG_USER_NESSUS_NASL)$(CONFIG_USER_SSH_SSH)$(CONFIG_PROP_SSCEP_SSCEP),)
 249 +CONFIG_OPTS += no-bf
 250 +endif
 251 +
 252 +ifeq ($(CONFIG_USER_OPENVPN_OPENVPN)$(CONFIG_USER_WGET),)
 253 +CONFIG_OPTS += no-md4
 254 +endif
 255 +
 256 +ifdef CONFIG_OCF_OCF
 257 +CONFIG_OPTS += --with-cryptodev
 258 +#CONFIG_OPTS += --with-cryptodev-digests
 259 +endif
 260 +
 261 +#
 262 +# if you want engines (they are dl loaded),  a few things
 263 +# need to be setup,  you will also need to mod everything
 264 +# to link against -ldl if it uses libcrypto.  By default we
 265 +# disable it (cryptodev suport is still included).
 266 +#
 267 +ifdef YOU_WANT_DYNAMIC_HW_ENGINES_ENABLED
 268 +LIBSSL_dlfcn = dlfcn
 269 +else
 270 +CONFIG_OPTS += no-hw
 271 +LIBSSL_dlfcn =
 272 +endif
 273 +
 274 +#
 275 +# our libs aren't in the default location yet
 276 +#
 277 +LDFLAGS += -L$(ROOTDIR)/lib/libssl/build
 278 +export LDFLAGS
 279 +
 280 +all: build/configured
 281 +       $(MAKE) -C build
 282 +       $(MAKE) -C build install_sw
 283 +
 284 +build/configured: makefile config Configure
 285 +       rm -rf build
 286 +       find . -type d > .dirs
 287 +       find . ! -type d | grep -v ./makefile > .files
 288 +       while read t; do mkdir -p build/$$t; done < .dirs
 289 +       while read t; do ln -s `pwd`/$$t build/$$t; done < .files
 290 +       rm -f .dirs .files
 291 +       chmod +x build/config
 292 +       cd build; MACHINE=uClinux-dist ./config $(CONFIG_OPTS)
 293 +       $(MAKE) -C build depend
 294 +       $(MAKE) -C build links
 295 +       touch build/configured
 296 +
 297 +clean:
 298 +       -rm -rf build
 299 +
 300 +romfs:
 301 +       cd build/install/lib; \
 302 +       for i in *.so*; do \
 303 +               if [ -L $$i ]; then \
 304 +                       $(ROMFSINST) -s `find $$i -printf %l` /lib/$$i; \
 305 +               elif [ -f $$i ]; then \
 306 +                       $(ROMFSINST) /lib/$$i; \
 307 +               fi; \
 308 +       done
 309 +
 310 +romfs_user:
 311 +       $(ROMFSINST) -e CONFIG_USER_OPENSSL_APPS build/install/bin/openssl /bin/openssl
 312 +       # $(ROMFSINST) -e CONFIG_USER_OPENSSL_APPS build/install/bin/c_rehash /bin/c_rehash
 313 +
 314 +
 315 --- a/apps/apps.h
 316 +++ b/apps/apps.h
 317 @@ -112,7 +112,7 @@
 318  #ifndef HEADER_APPS_H
 319  #define HEADER_APPS_H
 320
 321 -#include "e_os.h"
 322 +#include <openssl/e_os.h>
 323
 324  #include <openssl/bio.h>
 325  #include <openssl/x509.h>
 326 --- a/apps/progs.h
 327 +++ b/apps/progs.h
 328 @@ -129,7 +129,9 @@ FUNCTION functions[] = {
 329  #ifndef OPENSSL_NO_ENGINE
 330         {FUNC_TYPE_GENERAL,"engine",engine_main},
 331  #endif
 332 +#ifndef OPENSSL_NO_OCSP
 333         {FUNC_TYPE_GENERAL,"ocsp",ocsp_main},
 334 +#endif
 335         {FUNC_TYPE_GENERAL,"prime",prime_main},
 336  #ifndef OPENSSL_NO_MD2
 337         {FUNC_TYPE_MD,"md2",dgst_main},
 338 --- a/apps/speed.c
 339 +++ b/apps/speed.c
 340 @@ -292,7 +292,7 @@ static const char *names[ALGOR_NUM]={
 341    "evp","sha256","sha512",
 342    "aes-128 ige","aes-192 ige","aes-256 ige"};
 343  static double results[ALGOR_NUM][SIZE_NUM];
 344 -static int lengths[SIZE_NUM]={16,64,256,1024,8*1024};
 345 +static int lengths[SIZE_NUM]={16,64,256,1024,2*1024,4*1024};
 346  static double rsa_results[RSA_NUM][2];
 347  static double dsa_results[DSA_NUM][2];
 348  #ifndef OPENSSL_NO_ECDSA
 349 @@ -328,6 +328,79 @@ static SIGRETTYPE sig_done(int sig)
 350  #define START  0
 351  #define STOP   1
 352
 353 +#ifdef __linux__
 354 +/*
 355 + * record CPU usage as well
 356 + */
 357 +
 358 +static int do_cpu = 0;
 359 +
 360 +struct cpu_stat {
 361 +       unsigned int    user;
 362 +       unsigned int    nice;
 363 +       unsigned int    system;
 364 +       unsigned int    idle;
 365 +       unsigned int    total;
 366 +};
 367 +
 368 +static unsigned int cpu_usage[ALGOR_NUM][SIZE_NUM];
 369 +static unsigned int rsa_cpu_usage[RSA_NUM][2];
 370 +static unsigned int dsa_cpu_usage[DSA_NUM][2];
 371 +static struct cpu_stat cpu_start, cpu_finish;
 372 +
 373 +static void
 374 +get_cpu(int s)
 375 +{
 376 +       FILE *fp = NULL;
 377 +       unsigned char   buf[80];
 378 +       struct cpu_stat *st = s == START ? &cpu_start : &cpu_finish;
 379 +
 380 +       memset(st, 0, sizeof(*st));
 381 +
 382 +       if (fp == NULL)
 383 +               fp = fopen("/proc/stat", "r");
 384 +       if (!fp)
 385 +               return;
 386 +       if (fseek(fp, 0, SEEK_SET) == -1) {
 387 +               fclose(fp);
 388 +               return;
 389 +       }
 390 +       fscanf(fp, "%s %d %d %d %d", &buf[0], &st->user, &st->nice,
 391 +               &st->system, &st->idle);
 392 +       st->total = st->user + st->nice + st->system + st->idle;
 393 +       fclose(fp);
 394 +}
 395 +
 396 +static unsigned int
 397 +calc_cpu()
 398 +{
 399 +       unsigned int total, res;
 400 +
 401 +       total  = cpu_finish.total - cpu_start.total;
 402 +       if (total <= 0)
 403 +               return 0;
 404 +#if 1 // busy
 405 +       res   = ((cpu_finish.system + cpu_finish.user + cpu_finish.nice) -
 406 +                        (cpu_start.system + cpu_start.user + cpu_start.nice)) *
 407 +                        100 / total;
 408 +#endif
 409 +#if 0 // system
 410 +       res   = (cpu_finish.system - cpu_start.system) * 100 / total;
 411 +#endif
 412 +#if 0 // user
 413 +       res   = (cpu_finish.user   - cpu_start.user)   * 100 / total;
 414 +#endif
 415 +#if 0 // nice
 416 +       res   = (cpu_finish.nice   - cpu_start.nice)   * 100 / total;
 417 +#endif
 418 +#if 0 // idle
 419 +       res   = (cpu_finish.idle   - cpu_start.idle)   * 100 / total;
 420 +#endif
 421 +       return(res);
 422 +}
 423 +
 424 +#endif
 425 +
 426  #if defined(OPENSSL_SYS_NETWARE)
 427
 428     /* for NetWare the best we can do is use clock() which returns the
 429 @@ -358,6 +431,11 @@ static double Time_F(int s)
 430         {
 431         double ret;
 432
 433 +#ifdef __linux__
 434 +       if (do_cpu)
 435 +               get_cpu(s);
 436 +#endif
 437 +
 438  #ifdef USE_TOD
 439         if(usertime)
 440                 {
 441 @@ -832,6 +910,14 @@ int MAIN(int argc, char **argv)
 442                         j--;    /* Otherwise, -elapsed gets confused with
 443                                    an algorithm. */
 444                         }
 445 +#ifdef __linux__
 446 +               else if ((argc > 0) && (strcmp(*argv,"-cpu") == 0))
 447 +                       {
 448 +                       do_cpu = 1;
 449 +                       j--;    /* Otherwise, -cpu gets confused with
 450 +                                  an algorithm. */
 451 +                       }
 452 +#endif
 453                 else if ((argc > 0) && (strcmp(*argv,"-evp") == 0))
 454                         {
 455                         argc--;
 456 @@ -1260,6 +1346,9 @@ int MAIN(int argc, char **argv)
 457  #ifdef HAVE_FORK
 458                         BIO_printf(bio_err,"-multi n        run n benchmarks in parallel.\n");
 459  #endif
 460 +#ifdef __linux__
 461 +                       BIO_printf(bio_err,"-cpu            calculate cpu utilisation.\n");
 462 +#endif
 463                         goto end;
 464                         }
 465                 argc--;
 466 @@ -1267,11 +1356,6 @@ int MAIN(int argc, char **argv)
 467                 j++;
 468                 }
 469
 470 -#ifdef HAVE_FORK
 471 -       if(multi && do_multi(multi))
 472 -               goto show_res;
 473 -#endif
 474 -
 475         if (j == 0)
 476                 {
 477                 for (i=0; i<ALGOR_NUM; i++)
 478 @@ -1604,6 +1688,11 @@ int MAIN(int argc, char **argv)
 479         signal(SIGALRM,sig_done);
 480  #endif /* SIGALRM */
 481
 482 +#ifdef HAVE_FORK /* DM */
 483 +       if(multi && do_multi(multi))
 484 +               goto show_res;
 485 +#endif
 486 +
 487  #ifndef OPENSSL_NO_MD2
 488         if (doit[D_MD2])
 489                 {
 490 @@ -2033,8 +2122,6 @@ int MAIN(int argc, char **argv)
 491                                 /* -O3 -fschedule-insns messes up an
 492                                  * optimization here!  names[D_EVP]
 493                                  * somehow becomes NULL */
 494 -                               print_message(names[D_EVP],save_count,
 495 -                                       lengths[j]);
 496
 497                                 EVP_CIPHER_CTX_init(&ctx);
 498                                 if(decrypt)
 499 @@ -2043,6 +2130,9 @@ int MAIN(int argc, char **argv)
 500                                         EVP_EncryptInit_ex(&ctx,evp_cipher,NULL,key16,iv);
 501                                 EVP_CIPHER_CTX_set_padding(&ctx, 0);
 502
 503 +                               print_message(names[D_EVP],save_count,
 504 +                                       lengths[j]);
 505 +
 506                                 Time_F(START);
 507                                 if(decrypt)
 508                                         for (count=0,run=1; COND(save_count*4*lengths[0]/lengths[j]); count++)
 509 @@ -2107,6 +2197,8 @@ int MAIN(int argc, char **argv)
 510                                         }
 511                                 }
 512                         d=Time_F(STOP);
 513 +                       if (do_cpu)
 514 +                               rsa_cpu_usage[j][0] = calc_cpu();
 515                         BIO_printf(bio_err,mr ? "+R1:%ld:%d:%.2f\n"
 516                                    : "%ld %d bit private RSA's in %.2fs\n",
 517                                    count,rsa_bits[j],d);
 518 @@ -2142,6 +2234,8 @@ int MAIN(int argc, char **argv)
 519                                         }
 520                                 }
 521                         d=Time_F(STOP);
 522 +                       if (do_cpu)
 523 +                               rsa_cpu_usage[j][1] = calc_cpu();
 524                         BIO_printf(bio_err,mr ? "+R2:%ld:%d:%.2f\n"
 525                                    : "%ld %d bit public RSA's in %.2fs\n",
 526                                    count,rsa_bits[j],d);
 527 @@ -2201,6 +2295,8 @@ int MAIN(int argc, char **argv)
 528                                         }
 529                                 }
 530                         d=Time_F(STOP);
 531 +                       if (do_cpu)
 532 +                               dsa_cpu_usage[j][0] = calc_cpu();
 533                         BIO_printf(bio_err,mr ? "+R3:%ld:%d:%.2f\n"
 534                                    : "%ld %d bit DSA signs in %.2fs\n",
 535                                    count,dsa_bits[j],d);
 536 @@ -2236,6 +2332,8 @@ int MAIN(int argc, char **argv)
 537                                         }
 538                                 }
 539                         d=Time_F(STOP);
 540 +                       if (do_cpu)
 541 +                               dsa_cpu_usage[j][1] = calc_cpu();
 542                         BIO_printf(bio_err,mr ? "+R4:%ld:%d:%.2f\n"
 543                                    : "%ld %d bit DSA verify in %.2fs\n",
 544                                    count,dsa_bits[j],d);
 545 @@ -2530,14 +2628,23 @@ show_res:
 546                         fprintf(stdout,"The 'numbers' are in 1000s of bytes per second processed.\n");
 547                         fprintf(stdout,"type        ");
 548                         }
 549 -               for (j=0;  j<SIZE_NUM; j++)
 550 +               for (j=0;  j<SIZE_NUM; j++) {
 551                         fprintf(stdout,mr ? ":%d" : "%7d bytes",lengths[j]);
 552 +                       if (do_cpu && !mr)
 553 +                               fprintf(stdout, " /cpu");
 554 +               }
 555                 fprintf(stdout,"\n");
 556                 }
 557
 558         for (k=0; k<ALGOR_NUM; k++)
 559                 {
 560                 if (!doit[k]) continue;
 561 +               if (k == D_EVP) {
 562 +                       if (evp_cipher)
 563 +                               names[D_EVP]=OBJ_nid2ln(evp_cipher->nid);
 564 +                       else
 565 +                               names[D_EVP]=OBJ_nid2ln(evp_md->type);
 566 +               }
 567                 if(mr)
 568                         fprintf(stdout,"+F:%d:%s",k,names[k]);
 569                 else
 570 @@ -2548,6 +2655,8 @@ show_res:
 571                                 fprintf(stdout," %11.2fk",results[k][j]/1e3);
 572                         else
 573                                 fprintf(stdout,mr ? ":%.2f" : " %11.2f ",results[k][j]);
 574 +                       if (do_cpu)
 575 +                               fprintf(stdout, mr ? "/%d" : "/%%%-3d", cpu_usage[k][j]);
 576                         }
 577                 fprintf(stdout,"\n");
 578                 }
 579 @@ -2562,13 +2671,18 @@ show_res:
 580                         j=0;
 581                         }
 582                 if(mr)
 583 -                       fprintf(stdout,"+F2:%u:%u:%f:%f\n",
 584 -                               k,rsa_bits[k],rsa_results[k][0],
 585 -                               rsa_results[k][1]);
 586 -               else
 587 -                       fprintf(stdout,"rsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
 588 -                               rsa_bits[k],rsa_results[k][0],rsa_results[k][1],
 589 -                               1.0/rsa_results[k][0],1.0/rsa_results[k][1]);
 590 +                       fprintf(stdout,"+F2:%u:%u:%f", k,rsa_bits[k],rsa_results[k][0]);
 591 +               else
 592 +                       fprintf(stdout,"rsa %4u bits %8.6fs",rsa_bits[k],rsa_results[k][0]);
 593 +               if (do_cpu)
 594 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", rsa_cpu_usage[k][0]);
 595 +               fprintf(stdout, mr ? ":%f" : " %8.6fs", rsa_results[k][1]);
 596 +               if (do_cpu)
 597 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", rsa_cpu_usage[k][1]);
 598 +               if(!mr)
 599 +                       fprintf(stdout, " %8.1f %8.1f",
 600 +                                       1.0/rsa_results[k][0],1.0/rsa_results[k][1]);
 601 +               fprintf(stdout, "\n");
 602                 }
 603  #endif
 604  #ifndef OPENSSL_NO_DSA
 605 @@ -2582,12 +2696,18 @@ show_res:
 606                         j=0;
 607                         }
 608                 if(mr)
 609 -                       fprintf(stdout,"+F3:%u:%u:%f:%f\n",
 610 -                               k,dsa_bits[k],dsa_results[k][0],dsa_results[k][1]);
 611 +                       fprintf(stdout,"+F3:%u:%u:%f", k,dsa_bits[k],dsa_results[k][0]);
 612                 else
 613 -                       fprintf(stdout,"dsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
 614 -                               dsa_bits[k],dsa_results[k][0],dsa_results[k][1],
 615 -                               1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
 616 +                       fprintf(stdout,"dsa %4u bits %8.6fs",dsa_bits[k],dsa_results[k][0]);
 617 +               if (do_cpu)
 618 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", dsa_cpu_usage[k][0]);
 619 +               fprintf(stdout, mr ? ":%f" : " %8.6fs", dsa_results[k][1]);
 620 +               if (do_cpu)
 621 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", dsa_cpu_usage[k][1]);
 622 +               if(!mr)
 623 +                       fprintf(stdout, " %8.1f %8.1f",
 624 +                                       1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
 625 +               fprintf(stdout, "\n");
 626                 }
 627  #endif
 628  #ifndef OPENSSL_NO_ECDSA
 629 @@ -2712,8 +2832,10 @@ static void pkey_print_message(const cha
 630
 631  static void print_result(int alg,int run_no,int count,double time_used)
 632         {
 633 -       BIO_printf(bio_err,mr ? "+R:%d:%s:%f\n"
 634 -                  : "%d %s's in %.2fs\n",count,names[alg],time_used);
 635 +       if (do_cpu)
 636 +           cpu_usage[alg][run_no] = calc_cpu();
 637 +       BIO_printf(bio_err,mr ? "+R:%ld:%s:%f\n"
 638 +                  : "%ld %s's in %.2fs\n",count,names[alg],time_used);
 639         results[alg][run_no]=((double)count)/time_used*lengths[run_no];
 640         }
 641
 642 @@ -2806,29 +2928,11 @@ static int do_multi(int multi)
 643                                 p=buf+3;
 644                                 alg=atoi(sstrsep(&p,sep));
 645                                 sstrsep(&p,sep);
 646 -                               for(j=0 ; j < SIZE_NUM ; ++j)
 647 +                               for(j=0 ; j < SIZE_NUM ; ++j) {
 648 +                                       if (do_cpu && strchr(p, '/'))
 649 +                                               cpu_usage[alg][j] = atoi(strchr(p, '/') + 1);
 650                                         results[alg][j]+=atof(sstrsep(&p,sep));
 651                                 }
 652 -                       else if(!strncmp(buf,"+F2:",4))
 653 -                               {
 654 -                               int k;
 655 -                               double d;
 656 -
 657 -                               p=buf+4;
 658 -                               k=atoi(sstrsep(&p,sep));
 659 -                               sstrsep(&p,sep);
 660 -
 661 -                               d=atof(sstrsep(&p,sep));
 662 -                               if(n)
 663 -                                       rsa_results[k][0]=1/(1/rsa_results[k][0]+1/d);
 664 -                               else
 665 -                                       rsa_results[k][0]=d;
 666 -
 667 -                               d=atof(sstrsep(&p,sep));
 668 -                               if(n)
 669 -                                       rsa_results[k][1]=1/(1/rsa_results[k][1]+1/d);
 670 -                               else
 671 -                                       rsa_results[k][1]=d;
 672                                 }
 673                         else if(!strncmp(buf,"+F2:",4))
 674                                 {
 675 @@ -2839,12 +2943,18 @@ static int do_multi(int multi)
 676                                 k=atoi(sstrsep(&p,sep));
 677                                 sstrsep(&p,sep);
 678
 679 +                               /* before we move the token along */
 680 +                               if (do_cpu && strchr(p, '/'))
 681 +                                       rsa_cpu_usage[k][0] = atoi(strchr(p, '/') + 1);
 682                                 d=atof(sstrsep(&p,sep));
 683                                 if(n)
 684                                         rsa_results[k][0]=1/(1/rsa_results[k][0]+1/d);
 685                                 else
 686                                         rsa_results[k][0]=d;
 687
 688 +                               /* before we move the token along */
 689 +                               if (do_cpu && strchr(p, '/'))
 690 +                                       rsa_cpu_usage[k][1] = atoi(strchr(p, '/') + 1);
 691                                 d=atof(sstrsep(&p,sep));
 692                                 if(n)
 693                                         rsa_results[k][1]=1/(1/rsa_results[k][1]+1/d);
 694 @@ -2860,12 +2970,18 @@ static int do_multi(int multi)
 695                                 k=atoi(sstrsep(&p,sep));
 696                                 sstrsep(&p,sep);
 697
 698 +                               /* before we move the token along */
 699 +                               if (do_cpu && strchr(p, '/'))
 700 +                                       dsa_cpu_usage[k][0] = atoi(strchr(p, '/') + 1);
 701                                 d=atof(sstrsep(&p,sep));
 702                                 if(n)
 703                                         dsa_results[k][0]=1/(1/dsa_results[k][0]+1/d);
 704                                 else
 705                                         dsa_results[k][0]=d;
 706
 707 +                               /* before we move the token along */
 708 +                               if (do_cpu && strchr(p, '/'))
 709 +                                       dsa_cpu_usage[k][1] = atoi(strchr(p, '/') + 1);
 710                                 d=atof(sstrsep(&p,sep));
 711                                 if(n)
 712                                         dsa_results[k][1]=1/(1/dsa_results[k][1]+1/d);
 713 --- a/crypto/cryptlib.h
 714 +++ b/crypto/cryptlib.h
 715 @@ -62,7 +62,7 @@
 716  #include <stdlib.h>
 717  #include <string.h>
 718
 719 -#include "e_os.h"
 720 +#include <openssl/e_os.h>
 721
 722  #ifdef OPENSSL_USE_APPLINK
 723  #define BIO_FLAGS_UPLINK 0x8000
 724 --- a/crypto/engine/eng_all.c
 725 +++ b/crypto/engine/eng_all.c
 726 @@ -104,7 +104,7 @@ void ENGINE_load_builtin_engines(void)
 727  #endif
 728  #endif
 729  #ifndef OPENSSL_NO_HW
 730 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
 731 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
 732         ENGINE_load_cryptodev();
 733  #endif
 734  #if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG)
 735 @@ -113,7 +113,7 @@ void ENGINE_load_builtin_engines(void)
 736  #endif
 737         }
 738
 739 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
 740 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
 741  void ENGINE_setup_bsd_cryptodev(void) {
 742         static int bsd_cryptodev_default_loaded = 0;
 743         if (!bsd_cryptodev_default_loaded) {
 744 --- a/crypto/engine/eng_cryptodev.c
 745 +++ b/crypto/engine/eng_cryptodev.c
 746 @@ -68,6 +68,16 @@ ENGINE_load_cryptodev(void)
 747  struct dev_crypto_state {
 748         struct session_op d_sess;
 749         int d_fd;
 750 +
 751 +#ifdef USE_CRYPTODEV_DIGESTS
 752 +       char dummy_mac_key[20];
 753 +
 754 +       unsigned char digest_res[20];
 755 +       char *mac_data;
 756 +       int mac_len;
 757 +
 758 +       int copy;
 759 +#endif
 760  };
 761
 762  static u_int32_t cryptodev_asymfeat = 0;
 763 @@ -75,9 +85,11 @@ static u_int32_t cryptodev_asymfeat = 0;
 764  static int get_asym_dev_crypto(void);
 765  static int open_dev_crypto(void);
 766  static int get_dev_crypto(void);
 767 +#if 0
 768  static int cryptodev_max_iv(int cipher);
 769  static int cryptodev_key_length_valid(int cipher, int len);
 770  static int cipher_nid_to_cryptodev(int nid);
 771 +#endif
 772  static int get_cryptodev_ciphers(const int **cnids);
 773  static int get_cryptodev_digests(const int **cnids);
 774  static int cryptodev_usable_ciphers(const int **nids);
 775 @@ -100,7 +112,7 @@ static int cryptodev_asym(struct crypt_k
 776  static int cryptodev_bn_mod_exp(BIGNUM *r, const BIGNUM *a,
 777      const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 778  static int cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I,
 779 -    RSA *rsa);
 780 +    RSA *rsa, BN_CTX *ctx);
 781  static int cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
 782  static int cryptodev_dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a,
 783      const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 784 @@ -130,9 +142,12 @@ static struct {
 785         int     ivmax;
 786         int     keylen;
 787  } ciphers[] = {
 788 +       { CRYPTO_ARC4,                  NID_rc4,                0,      16, },
 789         { CRYPTO_DES_CBC,               NID_des_cbc,            8,       8, },
 790         { CRYPTO_3DES_CBC,              NID_des_ede3_cbc,       8,      24, },
 791         { CRYPTO_AES_CBC,               NID_aes_128_cbc,        16,     16, },
 792 +       { CRYPTO_AES_CBC,               NID_aes_192_cbc,        16,     24, },
 793 +       { CRYPTO_AES_CBC,               NID_aes_256_cbc,        16,     32, },
 794         { CRYPTO_BLF_CBC,               NID_bf_cbc,             8,      16, },
 795         { CRYPTO_CAST_CBC,              NID_cast5_cbc,          8,      16, },
 796         { CRYPTO_SKIPJACK_CBC,          NID_undef,              0,       0, },
 797 @@ -142,14 +157,15 @@ static struct {
 798  static struct {
 799         int     id;
 800         int     nid;
 801 +       int     keylen;
 802  } digests[] = {
 803 -       { CRYPTO_SHA1_HMAC,             NID_hmacWithSHA1,       },
 804 -       { CRYPTO_RIPEMD160_HMAC,        NID_ripemd160,          },
 805 -       { CRYPTO_MD5_KPDK,              NID_undef,              },
 806 -       { CRYPTO_SHA1_KPDK,             NID_undef,              },
 807 -       { CRYPTO_MD5,                   NID_md5,                },
 808 -       { CRYPTO_SHA1,                  NID_undef,              },
 809 -       { 0,                            NID_undef,              },
 810 +       { CRYPTO_SHA1_HMAC,             NID_hmacWithSHA1,       20},
 811 +       { CRYPTO_RIPEMD160_HMAC,        NID_ripemd160,          16/*?*/},
 812 +       { CRYPTO_MD5_KPDK,              NID_undef,              0},
 813 +       { CRYPTO_SHA1_KPDK,             NID_undef,              0},
 814 +       { CRYPTO_MD5,                   NID_md5,                16},
 815 +       { CRYPTO_SHA1,                  NID_sha1,               20},
 816 +       { 0,                            NID_undef,              0},
 817  };
 818
 819  /*
 820 @@ -176,10 +192,17 @@ open_dev_crypto(void)
 821  static int
 822  get_dev_crypto(void)
 823  {
 824 -       int fd, retfd;
 825 +       static int fd = -1;
 826 +       int retfd;
 827
 828 -       if ((fd = open_dev_crypto()) == -1)
 829 -               return (-1);
 830 +       if (fd == -1) {
 831 +               if ((fd = open_dev_crypto()) == -1)
 832 +                       return (-1);
 833 +               if (fcntl(fd, F_SETFD, 1) == -1) {
 834 +                       close(fd);
 835 +                       return (-1);
 836 +               }
 837 +       }
 838         if (ioctl(fd, CRIOGET, &retfd) == -1)
 839                 return (-1);
 840
 841 @@ -202,6 +225,7 @@ get_asym_dev_crypto(void)
 842         return fd;
 843  }
 844
 845 +#if 0
 846  /*
 847   * XXXX this needs to be set for each alg - and determined from
 848   * a running card.
 849 @@ -245,6 +269,7 @@ cipher_nid_to_cryptodev(int nid)
 850                         return (ciphers[i].id);
 851         return (0);
 852  }
 853 +#endif
 854
 855  /*
 856   * Find out what ciphers /dev/crypto will let us have a session for.
 857 @@ -264,7 +289,7 @@ get_cryptodev_ciphers(const int **cnids)
 858                 return (0);
 859         }
 860         memset(&sess, 0, sizeof(sess));
 861 -       sess.key = (caddr_t)"123456781234567812345678";
 862 +       sess.key = (caddr_t)"123456789abcdefghijklmno";
 863
 864         for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
 865                 if (ciphers[i].nid == NID_undef)
 866 @@ -303,10 +328,12 @@ get_cryptodev_digests(const int **cnids)
 867                 return (0);
 868         }
 869         memset(&sess, 0, sizeof(sess));
 870 +       sess.mackey = (caddr_t)"123456789abcdefghijklmno";
 871         for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
 872                 if (digests[i].nid == NID_undef)
 873                         continue;
 874                 sess.mac = digests[i].id;
 875 +               sess.mackeylen = digests[i].keylen;
 876                 sess.cipher = 0;
 877                 if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
 878                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
 879 @@ -351,6 +378,9 @@ cryptodev_usable_ciphers(const int **nid
 880  static int
 881  cryptodev_usable_digests(const int **nids)
 882  {
 883 +#ifdef USE_CRYPTODEV_DIGESTS
 884 +       return (get_cryptodev_digests(nids));
 885 +#else
 886         /*
 887          * XXXX just disable all digests for now, because it sucks.
 888          * we need a better way to decide this - i.e. I may not
 889 @@ -365,6 +395,7 @@ cryptodev_usable_digests(const int **nid
 890          */
 891         *nids = NULL;
 892         return (0);
 893 +#endif
 894  }
 895
 896  static int
 897 @@ -427,16 +458,20 @@ cryptodev_init_key(EVP_CIPHER_CTX *ctx,
 898  {
 899         struct dev_crypto_state *state = ctx->cipher_data;
 900         struct session_op *sess = &state->d_sess;
 901 -       int cipher;
 902 +       int cipher, i;
 903
 904 -       if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef)
 905 -               return (0);
 906 -
 907 -       if (ctx->cipher->iv_len > cryptodev_max_iv(cipher))
 908 -               return (0);
 909 +       for (i = 0; ciphers[i].id; i++)
 910 +               if (ctx->cipher->nid == ciphers[i].nid &&
 911 +                   ctx->cipher->iv_len <= ciphers[i].ivmax &&
 912 +                   ctx->key_len == ciphers[i].keylen) {
 913 +                       cipher = ciphers[i].id;
 914 +                       break;
 915 +               }
 916
 917 -       if (!cryptodev_key_length_valid(cipher, ctx->key_len))
 918 +       if (!ciphers[i].id) {
 919 +               state->d_fd = -1;
 920                 return (0);
 921 +       }
 922
 923         memset(sess, 0, sizeof(struct session_op));
 924
 925 @@ -496,6 +531,20 @@ cryptodev_cleanup(EVP_CIPHER_CTX *ctx)
 926   * gets called when libcrypto requests a cipher NID.
 927   */
 928
 929 +/* RC4 */
 930 +const EVP_CIPHER cryptodev_rc4 = {
 931 +       NID_rc4,
 932 +       1, 16, 0,
 933 +       EVP_CIPH_VARIABLE_LENGTH,
 934 +       cryptodev_init_key,
 935 +       cryptodev_cipher,
 936 +       cryptodev_cleanup,
 937 +       sizeof(struct dev_crypto_state),
 938 +       NULL,
 939 +       NULL,
 940 +       NULL
 941 +};
 942 +
 943  /* DES CBC EVP */
 944  const EVP_CIPHER cryptodev_des_cbc = {
 945         NID_des_cbc,
 946 @@ -563,6 +612,32 @@ const EVP_CIPHER cryptodev_aes_cbc = {
 947         NULL
 948  };
 949
 950 +const EVP_CIPHER cryptodev_aes_192_cbc = {
 951 +       NID_aes_192_cbc,
 952 +       16, 24, 16,
 953 +       EVP_CIPH_CBC_MODE,
 954 +       cryptodev_init_key,
 955 +       cryptodev_cipher,
 956 +       cryptodev_cleanup,
 957 +       sizeof(struct dev_crypto_state),
 958 +       EVP_CIPHER_set_asn1_iv,
 959 +       EVP_CIPHER_get_asn1_iv,
 960 +       NULL
 961 +};
 962 +
 963 +const EVP_CIPHER cryptodev_aes_256_cbc = {
 964 +       NID_aes_256_cbc,
 965 +       16, 32, 16,
 966 +       EVP_CIPH_CBC_MODE,
 967 +       cryptodev_init_key,
 968 +       cryptodev_cipher,
 969 +       cryptodev_cleanup,
 970 +       sizeof(struct dev_crypto_state),
 971 +       EVP_CIPHER_set_asn1_iv,
 972 +       EVP_CIPHER_get_asn1_iv,
 973 +       NULL
 974 +};
 975 +
 976  /*
 977   * Registered by the ENGINE when used to find out how to deal with
 978   * a particular NID in the ENGINE. this says what we'll do at the
 979 @@ -576,6 +651,9 @@ cryptodev_engine_ciphers(ENGINE *e, cons
 980                 return (cryptodev_usable_ciphers(nids));
 981
 982         switch (nid) {
 983 +       case NID_rc4:
 984 +               *cipher = &cryptodev_rc4;
 985 +               break;
 986         case NID_des_ede3_cbc:
 987                 *cipher = &cryptodev_3des_cbc;
 988                 break;
 989 @@ -591,6 +669,12 @@ cryptodev_engine_ciphers(ENGINE *e, cons
 990         case NID_aes_128_cbc:
 991                 *cipher = &cryptodev_aes_cbc;
 992                 break;
 993 +       case NID_aes_192_cbc:
 994 +               *cipher = &cryptodev_aes_192_cbc;
 995 +               break;
 996 +       case NID_aes_256_cbc:
 997 +               *cipher = &cryptodev_aes_256_cbc;
 998 +               break;
 999         default:
1000                 *cipher = NULL;
1001                 break;
1002 @@ -598,6 +682,234 @@ cryptodev_engine_ciphers(ENGINE *e, cons
1003         return (*cipher != NULL);
1004  }
1005
1006 +
1007 +#ifdef USE_CRYPTODEV_DIGESTS
1008 +
1009 +/* convert digest type to cryptodev */
1010 +static int
1011 +digest_nid_to_cryptodev(int nid)
1012 +{
1013 +       int i;
1014 +
1015 +       for (i = 0; digests[i].id; i++)
1016 +               if (digests[i].nid == nid)
1017 +                       return (digests[i].id);
1018 +       return (0);
1019 +}
1020 +
1021 +
1022 +static int
1023 +digest_key_length(int nid)
1024 +{
1025 +       int i;
1026 +
1027 +       for (i = 0; digests[i].id; i++)
1028 +               if (digests[i].nid == nid)
1029 +                       return digests[i].keylen;
1030 +       return (0);
1031 +}
1032 +
1033 +
1034 +static int cryptodev_digest_init(EVP_MD_CTX *ctx)
1035 +{
1036 +       struct dev_crypto_state *state = ctx->md_data;
1037 +       struct session_op *sess = &state->d_sess;
1038 +       int digest;
1039 +
1040 +       if ((digest = digest_nid_to_cryptodev(ctx->digest->type)) == NID_undef){
1041 +               printf("cryptodev_digest_init: Can't get digest \n");
1042 +               return (0);
1043 +       }
1044 +
1045 +       memset(state, 0, sizeof(struct dev_crypto_state));
1046 +
1047 +       if ((state->d_fd = get_dev_crypto()) < 0) {
1048 +               printf("cryptodev_digest_init: Can't get Dev \n");
1049 +               return (0);
1050 +       }
1051 +
1052 +       sess->mackey = state->dummy_mac_key;
1053 +       sess->mackeylen = digest_key_length(ctx->digest->type);
1054 +       sess->mac = digest;
1055 +
1056 +       if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
1057 +               close(state->d_fd);
1058 +               state->d_fd = -1;
1059 +               printf("cryptodev_digest_init: Open session failed\n");
1060 +               return (0);
1061 +       }
1062 +
1063 +       return (1);
1064 +}
1065 +
1066 +static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
1067 +               size_t count)
1068 +{
1069 +       struct crypt_op cryp;
1070 +       struct dev_crypto_state *state = ctx->md_data;
1071 +       struct session_op *sess = &state->d_sess;
1072 +
1073 +       if (!data || state->d_fd < 0) {
1074 +               printf("cryptodev_digest_update: illegal inputs \n");
1075 +               return (0);
1076 +       }
1077 +
1078 +       if (!count) {
1079 +               return (0);
1080 +       }
1081 +
1082 +       if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
1083 +               /* if application doesn't support one buffer */
1084 +               state->mac_data = OPENSSL_realloc(state->mac_data, state->mac_len + count);
1085 +
1086 +               if (!state->mac_data) {
1087 +                       printf("cryptodev_digest_update: realloc failed\n");
1088 +                       return (0);
1089 +               }
1090 +
1091 +               memcpy(state->mac_data + state->mac_len, data, count);
1092 +               state->mac_len += count;
1093 +
1094 +               return (1);
1095 +       }
1096 +
1097 +       memset(&cryp, 0, sizeof(cryp));
1098 +
1099 +       cryp.ses = sess->ses;
1100 +       cryp.flags = 0;
1101 +       cryp.len = count;
1102 +       cryp.src = (caddr_t) data;
1103 +       cryp.dst = NULL;
1104 +       cryp.mac = state->digest_res;
1105 +       if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
1106 +               printf("cryptodev_digest_update: digest failed\n");
1107 +               return (0);
1108 +       }
1109 +       return (1);
1110 +}
1111 +
1112 +
1113 +static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
1114 +{
1115 +       struct crypt_op cryp;
1116 +       struct dev_crypto_state *state = ctx->md_data;
1117 +       struct session_op *sess = &state->d_sess;
1118 +
1119 +       int ret = 1;
1120 +
1121 +       if (!md || state->d_fd < 0) {
1122 +               printf("cryptodev_digest_final: illegal input\n");
1123 +               return(0);
1124 +       }
1125 +
1126 +       if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
1127 +               /* if application doesn't support one buffer */
1128 +               memset(&cryp, 0, sizeof(cryp));
1129 +
1130 +               cryp.ses = sess->ses;
1131 +               cryp.flags = 0;
1132 +               cryp.len = state->mac_len;
1133 +               cryp.src = state->mac_data;
1134 +               cryp.dst = NULL;
1135 +               cryp.mac = md;
1136 +
1137 +               if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
1138 +                       printf("cryptodev_digest_final: digest failed\n");
1139 +                       return (0);
1140 +               }
1141 +
1142 +               return 1;
1143 +       }
1144 +
1145 +       memcpy(md, state->digest_res, ctx->digest->md_size);
1146 +
1147 +       return (ret);
1148 +}
1149 +
1150 +
1151 +static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
1152 +{
1153 +       int ret = 1;
1154 +       struct dev_crypto_state *state = ctx->md_data;
1155 +       struct session_op *sess = &state->d_sess;
1156 +
1157 +       if (state->d_fd < 0) {
1158 +               printf("cryptodev_digest_cleanup: illegal input\n");
1159 +               return (0);
1160 +       }
1161 +
1162 +       if (state->mac_data) {
1163 +               OPENSSL_free(state->mac_data);
1164 +               state->mac_data = NULL;
1165 +               state->mac_len = 0;
1166 +       }
1167 +
1168 +       if (state->copy)
1169 +               return 1;
1170 +
1171 +       if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
1172 +               printf("cryptodev_digest_cleanup: failed to close session\n");
1173 +               ret = 0;
1174 +       } else {
1175 +               ret = 1;
1176 +       }
1177 +       close(state->d_fd);
1178 +       state->d_fd = -1;
1179 +
1180 +       return (ret);
1181 +}
1182 +
1183 +static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
1184 +{
1185 +       struct dev_crypto_state *fstate = from->md_data;
1186 +       struct dev_crypto_state *dstate = to->md_data;
1187 +
1188 +       memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
1189 +
1190 +       if (fstate->mac_len != 0) {
1191 +               dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
1192 +               memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
1193 +       }
1194 +
1195 +       dstate->copy = 1;
1196 +
1197 +       return 1;
1198 +}
1199 +
1200 +
1201 +const EVP_MD cryptodev_sha1 = {
1202 +       NID_sha1,
1203 +       NID_undef,
1204 +       SHA_DIGEST_LENGTH,
1205 +       EVP_MD_FLAG_ONESHOT,
1206 +       cryptodev_digest_init,
1207 +       cryptodev_digest_update,
1208 +       cryptodev_digest_final,
1209 +       cryptodev_digest_copy,
1210 +       cryptodev_digest_cleanup,
1211 +       EVP_PKEY_NULL_method,
1212 +       SHA_CBLOCK,
1213 +       sizeof(struct dev_crypto_state),
1214 +};
1215 +
1216 +const EVP_MD cryptodev_md5 = {
1217 +       NID_md5,
1218 +       NID_undef,
1219 +       16 /* MD5_DIGEST_LENGTH */,
1220 +       EVP_MD_FLAG_ONESHOT,
1221 +       cryptodev_digest_init,
1222 +       cryptodev_digest_update,
1223 +       cryptodev_digest_final,
1224 +       cryptodev_digest_copy,
1225 +       cryptodev_digest_cleanup,
1226 +       EVP_PKEY_NULL_method,
1227 +       64 /* MD5_CBLOCK */,
1228 +       sizeof(struct dev_crypto_state),
1229 +};
1230 +
1231 +#endif /* USE_CRYPTODEV_DIGESTS */
1232 +
1233 +
1234  static int
1235  cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest,
1236      const int **nids, int nid)
1237 @@ -606,10 +918,15 @@ cryptodev_engine_digests(ENGINE *e, cons
1238                 return (cryptodev_usable_digests(nids));
1239
1240         switch (nid) {
1241 +#ifdef USE_CRYPTODEV_DIGESTS
1242         case NID_md5:
1243 -               *digest = NULL; /* need to make a clean md5 critter */
1244 +               *digest = &cryptodev_md5;
1245                 break;
1246 +       case NID_sha1:
1247 +               *digest = &cryptodev_sha1;
1248 +               break;
1249         default:
1250 +#endif /* USE_CRYPTODEV_DIGESTS */
1251                 *digest = NULL;
1252                 break;
1253         }
1254 @@ -625,7 +942,7 @@ static int
1255  bn2crparam(const BIGNUM *a, struct crparam *crp)
1256  {
1257         int i, j, k;
1258 -       ssize_t words, bytes, bits;
1259 +       ssize_t bytes, bits;
1260         u_char *b;
1261
1262         crp->crp_p = NULL;
1263 @@ -637,6 +954,7 @@ bn2crparam(const BIGNUM *a, struct crpar
1264         b = malloc(bytes);
1265         if (b == NULL)
1266                 return (1);
1267 +       memset(b, 0, bytes);
1268
1269         crp->crp_p = b;
1270         crp->crp_nbits = bits;
1271 @@ -681,7 +999,7 @@ zapparams(struct crypt_kop *kop)
1272  {
1273         int i;
1274
1275 -       for (i = 0; i <= kop->crk_iparams + kop->crk_oparams; i++) {
1276 +       for (i = 0; i < kop->crk_iparams + kop->crk_oparams; i++) {
1277                 if (kop->crk_param[i].crp_p)
1278                         free(kop->crk_param[i].crp_p);
1279                 kop->crk_param[i].crp_p = NULL;
1280 @@ -756,12 +1074,10 @@ err:
1281  }
1282
1283  static int
1284 -cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
1285 +cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
1286  {
1287         int r;
1288 -       BN_CTX *ctx;
1289 -
1290 -       ctx = BN_CTX_new();
1291 +       ctx = BN_CTX_new(); /* not sure why we reallocate this. DM */
1292         r = cryptodev_bn_mod_exp(r0, I, rsa->d, rsa->n, ctx, NULL);
1293         BN_CTX_free(ctx);
1294         return (r);
1295 --- a/crypto/engine/engine.h
1296 +++ b/crypto/engine/engine.h
1297 @@ -703,7 +703,7 @@ typedef int (*dynamic_bind_engine)(ENGIN
1298   * values. */
1299  void *ENGINE_get_static_state(void);
1300
1301 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
1302 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
1303  void ENGINE_setup_bsd_cryptodev(void);
1304  #endif
1305
1306 --- a/crypto/evp/c_all.c
1307 +++ b/crypto/evp/c_all.c
1308 @@ -83,7 +83,7 @@ void OPENSSL_add_all_algorithms_noconf(v
1309         OpenSSL_add_all_ciphers();
1310         OpenSSL_add_all_digests();
1311  #ifndef OPENSSL_NO_ENGINE
1312 -# if defined(__OpenBSD__) || defined(__FreeBSD__)
1313 +# if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
1314         ENGINE_setup_bsd_cryptodev();
1315  # endif
1316  #endif
1317 --- a/crypto/evp/c_alld.c
1318 +++ b/crypto/evp/c_alld.c
1319 @@ -81,7 +81,7 @@ void OpenSSL_add_all_digests(void)
1320         EVP_add_digest(EVP_dss());
1321  #endif
1322  #endif
1323 -#ifndef OPENSSL_NO_SHA
1324 +#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
1325         EVP_add_digest(EVP_sha1());
1326         EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
1327         EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA);
1328 --- a/engines/Makefile
1329 +++ b/engines/Makefile
1330 @@ -96,6 +96,7 @@ install:
1331                         ( echo installing $$l; \
1332                           if [ "$(PLATFORM)" != "Cygwin" ]; then \
1333                                 case "$(CFLAGS)" in \
1334 +                               *OPENSSL_NO_HW*)        continue;;      \
1335                                 *DSO_DLFCN*)    sfx="so";;      \
1336                                 *DSO_DL*)       sfx="sl";;      \
1337                                 *)              sfx="bad";;     \
1338 --- a/util/domd
1339 +++ b/util/domd
1340 @@ -23,13 +23,17 @@ if [ "$D" = "gcc" ]; then
1341      done
1342      sed -e '/^# DO NOT DELETE.*/,$d' < Makefile > Makefile.tmp
1343      echo '# DO NOT DELETE THIS LINE -- make depend depends on it.' >> Makefile.tmp
1344 -    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND -M $args >> Makefile.tmp
1345 +    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND -M $args >> Makefile.tmp && \
1346      ${PERL} $TOP/util/clean-depend.pl < Makefile.tmp > Makefile.new
1347 +      RC=$?
1348      rm -f Makefile.tmp
1349  else
1350 -    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND $@
1351 +    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND $@ && \
1352      ${PERL} $TOP/util/clean-depend.pl < Makefile > Makefile.new
1353 +      RC=$?
1354  fi
1355  mv Makefile.new Makefile
1356  # unfake the presence of Kerberos
1357  rm $TOP/krb5.h
1358 +
1359 +exit $RC