package/openssl/patches/200-ocf-20100325.patch

   1 --- a/Configure
   2 +++ b/Configure
   3 @@ -36,6 +36,8 @@ my $usage="Usage: Configure [no-<cipher>
   4  #              (Default: KRB5_DIR/include)
   5  # --with-krb5-flavor  Declare what flavor of Kerberos 5 is used.  Currently
   6  #              supported values are "MIT" and "Heimdal".  A value is required.
   7 +# --with-cryptodev Force support for cryptodev (ie., ocf-linux)
   8 +# --with-cryptodev-digests Force support for cryptodev digests (generally slow)
   9  #
  10  # --test-sanity Make a number of sanity checks on the data in this file.
  11  #               This is a debugging tool for OpenSSL developers.
  12 @@ -554,6 +556,10 @@ my %table=(
  13  ##### Compaq Non-Stop Kernel (Tandem)
  14  "tandem-c89","c89:-Ww -D__TANDEM -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1 -D_TANDEM_SOURCE -DB_ENDIAN::(unknown):::THIRTY_TWO_BIT:::",
  15
  16 +# uClinux
  17 +"uClinux-dist","$ENV{'CC'}:\$(CFLAGS)::-D_REENTRANT::\$(LDFLAGS) \$(LDLIBS):BN_LLONG::::::::::::\$(LIBSSL_dlfcn):linux-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):$ENV{'RANLIB'}",
  18 +"uClinux-dist64","$ENV{'CC'}:\$(CFLAGS)::-D_REENTRANT::\$(LDFLAGS) \$(LDLIBS):SIXTY_FOUR_BIT_LONG::::::::::::\$(LIBSSL_dlfcn):linux-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):$ENV{'RANLIB'}",
  19 +
  20  );
  21
  22  my @MK1MF_Builds=qw(VC-WIN64I VC-WIN64A
  23 @@ -610,6 +616,8 @@ my $montasm=1;   # but "no-montasm" is d
  24  my $no_asm=0;
  25  my $no_dso=0;
  26  my $no_gmp=0;
  27 +my $have_cryptodev=0;
  28 +my $use_cryptodev_digests=0;
  29  my @skip=();
  30  my $Makefile="Makefile";
  31  my $des_locl="crypto/des/des_locl.h";
  32 @@ -758,6 +766,14 @@ PROCESS_ARGS:
  33                         {
  34                         exit(&test_sanity());
  35                         }
  36 +               elsif (/^--with-cryptodev$/)
  37 +                       {
  38 +                               $have_cryptodev = 1;
  39 +                       }
  40 +               elsif (/^--with-cryptodev-digests$/)
  41 +                       {
  42 +                               $use_cryptodev_digests = 1;
  43 +                       }
  44                 elsif (/^--strict-warnings/)
  45                         {
  46                         $strict_warnings = 1;
  47 @@ -1055,6 +1071,7 @@ foreach (sort (keys %disabled))
  48                         print " OPENSSL_NO_$ALGO";
  49
  50                         if (/^err$/)    { $flags .= "-DOPENSSL_NO_ERR "; }
  51 +                       elsif (/^hw$/)  { $flags .= "-DOPENSSL_NO_HW "; }
  52                         elsif (/^asm$/) { $no_asm = 1; }
  53                         }
  54                 else
  55 @@ -1184,6 +1201,16 @@ if (!$no_krb5)
  56                    $withargs{"krb5-dir"} ne "";
  57         }
  58
  59 +# enable the linux cryptodev (ocf-linux) support
  60 +if ($have_cryptodev)
  61 +       {
  62 +       if ($use_cryptodev_digests)
  63 +               {
  64 +               $cflags = "-DUSE_CRYPTODEV_DIGESTS $cflags";
  65 +               }
  66 +       $cflags = "-DHAVE_CRYPTODEV $cflags";
  67 +       }
  68 +
  69  # The DSO code currently always implements all functions so that no
  70  # applications will have to worry about that from a compilation point
  71  # of view. However, the "method"s may return zero unless that platform
  72 --- a/INSTALL
  73 +++ b/INSTALL
  74 @@ -103,6 +103,12 @@
  75                  define preprocessor symbols, specify additional libraries,
  76                  library directories or other compiler options.
  77
  78 +  --with-cryptodev Enabled the BSD cryptodev engine even if we are not using
  79 +               BSD.  Useful if you are running ocf-linux or something
  80 +               similar.  Once enabled you can also enable the use of
  81 +               cryptodev digests,  with is usually slower unless you have
  82 +               large amounts data.  Use --with-cryptodev-digests to force
  83 +               it.
  84
  85   Installation in Detail
  86   ----------------------
  87 --- a/Makefile.org
  88 +++ b/Makefile.org
  89 @@ -499,7 +499,7 @@ files:
  90
  91  links:
  92         @$(PERL) $(TOP)/util/mkdir-p.pl include/openssl
  93 -       @$(PERL) $(TOP)/util/mklink.pl include/openssl $(EXHEADER)
  94 +       @$(PERL) $(TOP)/util/mklink.pl include/openssl $(HEADER) $(EXHEADER)
  95         @set -e; target=links; $(RECURSIVE_BUILD_CMD)
  96         @if [ -z "$(FIPSCANLIB)" ]; then \
  97                 set -e; target=links; dir=fips ; $(BUILD_CMD) ; \
  98 --- a/Makefile.shared
  99 +++ b/Makefile.shared
 100 @@ -6,13 +6,13 @@
 101  # properly
 102
 103  # CC contains the current compiler.  This one MUST be defined
 104 -CC=cc
 105 -CFLAGS=$(CFLAG)
 106 +CC?=cc
 107 +CFLAGS?=$(CFLAG)
 108  # LDFLAGS contains flags to be used when temporary object files (when building
 109  # shared libraries) are created, or when an application is linked.
 110  # SHARED_LDFLAGS contains flags to be used when the shared library is created.
 111 -LDFLAGS=
 112 -SHARED_LDFLAGS=
 113 +LDFLAGS?=
 114 +SHARED_LDFLAGS?=
 115
 116  # LIBNAME contains just the name of the library, without prefix ("lib"
 117  # on Unix, "cyg" for certain forms under Cygwin...) or suffix (.a, .so,
 118 --- a/config
 119 +++ b/config
 120 @@ -270,7 +270,7 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${
 121                 echo "ppc-apple-darwin${VERSION}"
 122                 ;;
 123             *)
 124 -               echo "i386-apple-darwin${VERSION}"
 125 +               echo "${MACHINE}-apple-darwin${VERSION}"
 126                 ;;
 127         esac
 128         exit 0
 129 @@ -399,7 +399,7 @@ exit 0
 130  # this is where the translation occurs into SSLeay terms
 131  # ---------------------------------------------------------------------------
 132
 133 -GCCVER=`(gcc -dumpversion) 2>/dev/null`
 134 +GCCVER=`(${CC:-gcc} -dumpversion) 2>/dev/null`
 135  if [ "$GCCVER" != "" ]; then
 136    # then strip off whatever prefix egcs prepends the number with...
 137    # Hopefully, this will work for any future prefixes as well.
 138 @@ -488,6 +488,12 @@ echo Operating system: $GUESSOS
 139  # script above so we end up with values in vars but that would take
 140  # more time that I want to waste at the moment
 141  case "$GUESSOS" in
 142 +  uClinux*64*)
 143 +    OUT=uClinux-dist64
 144 +       ;;
 145 +  uClinux*)
 146 +    OUT=uClinux-dist
 147 +       ;;
 148    mips2-sgi-irix)
 149         CPU=`(hinv -t cpu) 2>/dev/null | head -1 | sed 's/^CPU:[^R]*R\([0-9]*\).*/\1/'`
 150         CPU=${CPU:-0}
 151 --- a/apps/apps.h
 152 +++ b/apps/apps.h
 153 @@ -112,7 +112,7 @@
 154  #ifndef HEADER_APPS_H
 155  #define HEADER_APPS_H
 156
 157 -#include "e_os.h"
 158 +#include <openssl/e_os.h>
 159
 160  #include <openssl/bio.h>
 161  #include <openssl/x509.h>
 162 --- a/apps/progs.h
 163 +++ b/apps/progs.h
 164 @@ -129,7 +129,9 @@ FUNCTION functions[] = {
 165  #ifndef OPENSSL_NO_ENGINE
 166         {FUNC_TYPE_GENERAL,"engine",engine_main},
 167  #endif
 168 +#ifndef OPENSSL_NO_OCSP
 169         {FUNC_TYPE_GENERAL,"ocsp",ocsp_main},
 170 +#endif
 171         {FUNC_TYPE_GENERAL,"prime",prime_main},
 172  #ifndef OPENSSL_NO_MD2
 173         {FUNC_TYPE_MD,"md2",dgst_main},
 174 --- a/apps/speed.c
 175 +++ b/apps/speed.c
 176 @@ -296,7 +296,7 @@ static const char *names[ALGOR_NUM]={
 177    "evp","sha256","sha512",
 178    "aes-128 ige","aes-192 ige","aes-256 ige"};
 179  static double results[ALGOR_NUM][SIZE_NUM];
 180 -static int lengths[SIZE_NUM]={16,64,256,1024,8*1024};
 181 +static int lengths[SIZE_NUM]={16,64,256,1024,2*1024,4*1024};
 182  #ifndef OPENSSL_NO_RSA
 183  static double rsa_results[RSA_NUM][2];
 184  #endif
 185 @@ -336,6 +336,82 @@ static SIGRETTYPE sig_done(int sig)
 186  #define START  0
 187  #define STOP   1
 188
 189 +static int do_cpu = 0;
 190 +
 191 +#ifdef __linux__
 192 +
 193 +#define HAVE_CPU_USAGE 1
 194 +
 195 +/*
 196 + * record CPU usage as well
 197 + */
 198 +
 199 +struct cpu_stat {
 200 +       unsigned int    user;
 201 +       unsigned int    nice;
 202 +       unsigned int    system;
 203 +       unsigned int    idle;
 204 +       unsigned int    total;
 205 +};
 206 +
 207 +static unsigned int cpu_usage[ALGOR_NUM][SIZE_NUM];
 208 +static unsigned int rsa_cpu_usage[RSA_NUM][2];
 209 +static unsigned int dsa_cpu_usage[DSA_NUM][2];
 210 +static struct cpu_stat cpu_start, cpu_finish;
 211 +
 212 +static void
 213 +get_cpu(int s)
 214 +{
 215 +       FILE *fp = NULL;
 216 +       unsigned char   buf[80];
 217 +       struct cpu_stat *st = s == START ? &cpu_start : &cpu_finish;
 218 +
 219 +       memset(st, 0, sizeof(*st));
 220 +
 221 +       if (fp == NULL)
 222 +               fp = fopen("/proc/stat", "r");
 223 +       if (!fp)
 224 +               return;
 225 +       if (fseek(fp, 0, SEEK_SET) == -1) {
 226 +               fclose(fp);
 227 +               return;
 228 +       }
 229 +       fscanf(fp, "%s %d %d %d %d", &buf[0], &st->user, &st->nice,
 230 +               &st->system, &st->idle);
 231 +       st->total = st->user + st->nice + st->system + st->idle;
 232 +       fclose(fp);
 233 +}
 234 +
 235 +static unsigned int
 236 +calc_cpu()
 237 +{
 238 +       unsigned int total, res;
 239 +
 240 +       total  = cpu_finish.total - cpu_start.total;
 241 +       if (total <= 0)
 242 +               return 0;
 243 +#if 1 // busy
 244 +       res   = ((cpu_finish.system + cpu_finish.user + cpu_finish.nice) -
 245 +                        (cpu_start.system + cpu_start.user + cpu_start.nice)) *
 246 +                        100 / total;
 247 +#endif
 248 +#if 0 // system
 249 +       res   = (cpu_finish.system - cpu_start.system) * 100 / total;
 250 +#endif
 251 +#if 0 // user
 252 +       res   = (cpu_finish.user   - cpu_start.user)   * 100 / total;
 253 +#endif
 254 +#if 0 // nice
 255 +       res   = (cpu_finish.nice   - cpu_start.nice)   * 100 / total;
 256 +#endif
 257 +#if 0 // idle
 258 +       res   = (cpu_finish.idle   - cpu_start.idle)   * 100 / total;
 259 +#endif
 260 +       return(res);
 261 +}
 262 +
 263 +#endif
 264 +
 265  #if defined(OPENSSL_SYS_NETWARE)
 266
 267     /* for NetWare the best we can do is use clock() which returns the
 268 @@ -366,6 +442,9 @@ static double Time_F(int s)
 269         {
 270         double ret;
 271
 272 +       if (do_cpu)
 273 +               get_cpu(s);
 274 +
 275  #ifdef USE_TOD
 276         if(usertime)
 277                 {
 278 @@ -840,6 +919,14 @@ int MAIN(int argc, char **argv)
 279                         j--;    /* Otherwise, -elapsed gets confused with
 280                                    an algorithm. */
 281                         }
 282 +#ifdef HAVE_CPU_USAGE
 283 +               else if ((argc > 0) && (strcmp(*argv,"-cpu") == 0))
 284 +                       {
 285 +                       do_cpu = 1;
 286 +                       j--;    /* Otherwise, -cpu gets confused with
 287 +                                  an algorithm. */
 288 +                       }
 289 +#endif
 290                 else if ((argc > 0) && (strcmp(*argv,"-evp") == 0))
 291                         {
 292                         argc--;
 293 @@ -1268,6 +1355,9 @@ int MAIN(int argc, char **argv)
 294  #ifndef NO_FORK
 295                         BIO_printf(bio_err,"-multi n        run n benchmarks in parallel.\n");
 296  #endif
 297 +#ifdef HAVE_CPU_USAGE
 298 +                       BIO_printf(bio_err,"-cpu            calculate cpu utilisation.\n");
 299 +#endif
 300                         goto end;
 301                         }
 302                 argc--;
 303 @@ -1275,11 +1365,6 @@ int MAIN(int argc, char **argv)
 304                 j++;
 305                 }
 306
 307 -#ifndef NO_FORK
 308 -       if(multi && do_multi(multi))
 309 -               goto show_res;
 310 -#endif
 311 -
 312         if (j == 0)
 313                 {
 314                 for (i=0; i<ALGOR_NUM; i++)
 315 @@ -1612,6 +1697,11 @@ int MAIN(int argc, char **argv)
 316         signal(SIGALRM,sig_done);
 317  #endif /* SIGALRM */
 318
 319 +#ifndef NO_FORK /* Do this a late as possible to give better CPU readings */
 320 +       if(multi && do_multi(multi))
 321 +               goto show_res;
 322 +#endif
 323 +
 324  #ifndef OPENSSL_NO_MD2
 325         if (doit[D_MD2])
 326                 {
 327 @@ -2041,8 +2131,6 @@ int MAIN(int argc, char **argv)
 328                                 /* -O3 -fschedule-insns messes up an
 329                                  * optimization here!  names[D_EVP]
 330                                  * somehow becomes NULL */
 331 -                               print_message(names[D_EVP],save_count,
 332 -                                       lengths[j]);
 333
 334                                 EVP_CIPHER_CTX_init(&ctx);
 335                                 if(decrypt)
 336 @@ -2051,6 +2139,9 @@ int MAIN(int argc, char **argv)
 337                                         EVP_EncryptInit_ex(&ctx,evp_cipher,NULL,key16,iv);
 338                                 EVP_CIPHER_CTX_set_padding(&ctx, 0);
 339
 340 +                               print_message(names[D_EVP],save_count,
 341 +                                       lengths[j]);
 342 +
 343                                 Time_F(START);
 344                                 if(decrypt)
 345                                         for (count=0,run=1; COND(save_count*4*lengths[0]/lengths[j]); count++)
 346 @@ -2115,6 +2206,8 @@ int MAIN(int argc, char **argv)
 347                                         }
 348                                 }
 349                         d=Time_F(STOP);
 350 +                       if (do_cpu)
 351 +                               rsa_cpu_usage[j][0] = calc_cpu();
 352                         BIO_printf(bio_err,mr ? "+R1:%ld:%d:%.2f\n"
 353                                    : "%ld %d bit private RSA's in %.2fs\n",
 354                                    count,rsa_bits[j],d);
 355 @@ -2150,6 +2243,8 @@ int MAIN(int argc, char **argv)
 356                                         }
 357                                 }
 358                         d=Time_F(STOP);
 359 +                       if (do_cpu)
 360 +                               rsa_cpu_usage[j][1] = calc_cpu();
 361                         BIO_printf(bio_err,mr ? "+R2:%ld:%d:%.2f\n"
 362                                    : "%ld %d bit public RSA's in %.2fs\n",
 363                                    count,rsa_bits[j],d);
 364 @@ -2209,6 +2304,8 @@ int MAIN(int argc, char **argv)
 365                                         }
 366                                 }
 367                         d=Time_F(STOP);
 368 +                       if (do_cpu)
 369 +                               dsa_cpu_usage[j][0] = calc_cpu();
 370                         BIO_printf(bio_err,mr ? "+R3:%ld:%d:%.2f\n"
 371                                    : "%ld %d bit DSA signs in %.2fs\n",
 372                                    count,dsa_bits[j],d);
 373 @@ -2244,6 +2341,8 @@ int MAIN(int argc, char **argv)
 374                                         }
 375                                 }
 376                         d=Time_F(STOP);
 377 +                       if (do_cpu)
 378 +                               dsa_cpu_usage[j][1] = calc_cpu();
 379                         BIO_printf(bio_err,mr ? "+R4:%ld:%d:%.2f\n"
 380                                    : "%ld %d bit DSA verify in %.2fs\n",
 381                                    count,dsa_bits[j],d);
 382 @@ -2538,14 +2637,23 @@ show_res:
 383                         fprintf(stdout,"The 'numbers' are in 1000s of bytes per second processed.\n");
 384                         fprintf(stdout,"type        ");
 385                         }
 386 -               for (j=0;  j<SIZE_NUM; j++)
 387 +               for (j=0;  j<SIZE_NUM; j++) {
 388                         fprintf(stdout,mr ? ":%d" : "%7d bytes",lengths[j]);
 389 +                       if (do_cpu && !mr)
 390 +                               fprintf(stdout, " /cpu");
 391 +               }
 392                 fprintf(stdout,"\n");
 393                 }
 394
 395         for (k=0; k<ALGOR_NUM; k++)
 396                 {
 397                 if (!doit[k]) continue;
 398 +               if (k == D_EVP) {
 399 +                       if (evp_cipher)
 400 +                               names[D_EVP]=OBJ_nid2ln(evp_cipher->nid);
 401 +                       else
 402 +                               names[D_EVP]=OBJ_nid2ln(evp_md->type);
 403 +               }
 404                 if(mr)
 405                         fprintf(stdout,"+F:%d:%s",k,names[k]);
 406                 else
 407 @@ -2556,6 +2664,8 @@ show_res:
 408                                 fprintf(stdout," %11.2fk",results[k][j]/1e3);
 409                         else
 410                                 fprintf(stdout,mr ? ":%.2f" : " %11.2f ",results[k][j]);
 411 +                       if (do_cpu)
 412 +                               fprintf(stdout, mr ? "/%d" : "/%%%-3d", cpu_usage[k][j]);
 413                         }
 414                 fprintf(stdout,"\n");
 415                 }
 416 @@ -2570,13 +2680,18 @@ show_res:
 417                         j=0;
 418                         }
 419                 if(mr)
 420 -                       fprintf(stdout,"+F2:%u:%u:%f:%f\n",
 421 -                               k,rsa_bits[k],rsa_results[k][0],
 422 -                               rsa_results[k][1]);
 423 -               else
 424 -                       fprintf(stdout,"rsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
 425 -                               rsa_bits[k],rsa_results[k][0],rsa_results[k][1],
 426 -                               1.0/rsa_results[k][0],1.0/rsa_results[k][1]);
 427 +                       fprintf(stdout,"+F2:%u:%u:%f", k,rsa_bits[k],rsa_results[k][0]);
 428 +               else
 429 +                       fprintf(stdout,"rsa %4u bits %8.6fs",rsa_bits[k],rsa_results[k][0]);
 430 +               if (do_cpu)
 431 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", rsa_cpu_usage[k][0]);
 432 +               fprintf(stdout, mr ? ":%f" : " %8.6fs", rsa_results[k][1]);
 433 +               if (do_cpu)
 434 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", rsa_cpu_usage[k][1]);
 435 +               if(!mr)
 436 +                       fprintf(stdout, " %8.1f %8.1f",
 437 +                                       1.0/rsa_results[k][0],1.0/rsa_results[k][1]);
 438 +               fprintf(stdout, "\n");
 439                 }
 440  #endif
 441  #ifndef OPENSSL_NO_DSA
 442 @@ -2590,12 +2705,18 @@ show_res:
 443                         j=0;
 444                         }
 445                 if(mr)
 446 -                       fprintf(stdout,"+F3:%u:%u:%f:%f\n",
 447 -                               k,dsa_bits[k],dsa_results[k][0],dsa_results[k][1]);
 448 +                       fprintf(stdout,"+F3:%u:%u:%f", k,dsa_bits[k],dsa_results[k][0]);
 449                 else
 450 -                       fprintf(stdout,"dsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
 451 -                               dsa_bits[k],dsa_results[k][0],dsa_results[k][1],
 452 -                               1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
 453 +                       fprintf(stdout,"dsa %4u bits %8.6fs",dsa_bits[k],dsa_results[k][0]);
 454 +               if (do_cpu)
 455 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", dsa_cpu_usage[k][0]);
 456 +               fprintf(stdout, mr ? ":%f" : " %8.6fs", dsa_results[k][1]);
 457 +               if (do_cpu)
 458 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", dsa_cpu_usage[k][1]);
 459 +               if(!mr)
 460 +                       fprintf(stdout, " %8.1f %8.1f",
 461 +                                       1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
 462 +               fprintf(stdout, "\n");
 463                 }
 464  #endif
 465  #ifndef OPENSSL_NO_ECDSA
 466 @@ -2720,8 +2841,10 @@ static void pkey_print_message(const cha
 467
 468  static void print_result(int alg,int run_no,int count,double time_used)
 469         {
 470 -       BIO_printf(bio_err,mr ? "+R:%d:%s:%f\n"
 471 -                  : "%d %s's in %.2fs\n",count,names[alg],time_used);
 472 +       if (do_cpu)
 473 +           cpu_usage[alg][run_no] = calc_cpu();
 474 +       BIO_printf(bio_err,mr ? "+R:%ld:%s:%f\n"
 475 +                  : "%ld %s's in %.2fs\n",count,names[alg],time_used);
 476         results[alg][run_no]=((double)count)/time_used*lengths[run_no];
 477         }
 478
 479 @@ -2816,29 +2939,11 @@ static int do_multi(int multi)
 480                                 p=buf+3;
 481                                 alg=atoi(sstrsep(&p,sep));
 482                                 sstrsep(&p,sep);
 483 -                               for(j=0 ; j < SIZE_NUM ; ++j)
 484 +                               for(j=0 ; j < SIZE_NUM ; ++j) {
 485 +                                       if (do_cpu && strchr(p, '/'))
 486 +                                               cpu_usage[alg][j] = atoi(strchr(p, '/') + 1);
 487                                         results[alg][j]+=atof(sstrsep(&p,sep));
 488                                 }
 489 -                       else if(!strncmp(buf,"+F2:",4))
 490 -                               {
 491 -                               int k;
 492 -                               double d;
 493 -
 494 -                               p=buf+4;
 495 -                               k=atoi(sstrsep(&p,sep));
 496 -                               sstrsep(&p,sep);
 497 -
 498 -                               d=atof(sstrsep(&p,sep));
 499 -                               if(n)
 500 -                                       rsa_results[k][0]=1/(1/rsa_results[k][0]+1/d);
 501 -                               else
 502 -                                       rsa_results[k][0]=d;
 503 -
 504 -                               d=atof(sstrsep(&p,sep));
 505 -                               if(n)
 506 -                                       rsa_results[k][1]=1/(1/rsa_results[k][1]+1/d);
 507 -                               else
 508 -                                       rsa_results[k][1]=d;
 509                                 }
 510                         else if(!strncmp(buf,"+F2:",4))
 511                                 {
 512 @@ -2849,12 +2954,18 @@ static int do_multi(int multi)
 513                                 k=atoi(sstrsep(&p,sep));
 514                                 sstrsep(&p,sep);
 515
 516 +                               /* before we move the token along */
 517 +                               if (do_cpu && strchr(p, '/'))
 518 +                                       rsa_cpu_usage[k][0] = atoi(strchr(p, '/') + 1);
 519                                 d=atof(sstrsep(&p,sep));
 520                                 if(n)
 521                                         rsa_results[k][0]=1/(1/rsa_results[k][0]+1/d);
 522                                 else
 523                                         rsa_results[k][0]=d;
 524
 525 +                               /* before we move the token along */
 526 +                               if (do_cpu && strchr(p, '/'))
 527 +                                       rsa_cpu_usage[k][1] = atoi(strchr(p, '/') + 1);
 528                                 d=atof(sstrsep(&p,sep));
 529                                 if(n)
 530                                         rsa_results[k][1]=1/(1/rsa_results[k][1]+1/d);
 531 @@ -2870,12 +2981,18 @@ static int do_multi(int multi)
 532                                 k=atoi(sstrsep(&p,sep));
 533                                 sstrsep(&p,sep);
 534
 535 +                               /* before we move the token along */
 536 +                               if (do_cpu && strchr(p, '/'))
 537 +                                       dsa_cpu_usage[k][0] = atoi(strchr(p, '/') + 1);
 538                                 d=atof(sstrsep(&p,sep));
 539                                 if(n)
 540                                         dsa_results[k][0]=1/(1/dsa_results[k][0]+1/d);
 541                                 else
 542                                         dsa_results[k][0]=d;
 543
 544 +                               /* before we move the token along */
 545 +                               if (do_cpu && strchr(p, '/'))
 546 +                                       dsa_cpu_usage[k][1] = atoi(strchr(p, '/') + 1);
 547                                 d=atof(sstrsep(&p,sep));
 548                                 if(n)
 549                                         dsa_results[k][1]=1/(1/dsa_results[k][1]+1/d);
 550 --- a/crypto/cryptlib.h
 551 +++ b/crypto/cryptlib.h
 552 @@ -62,7 +62,7 @@
 553  #include <stdlib.h>
 554  #include <string.h>
 555
 556 -#include "e_os.h"
 557 +#include <openssl/e_os.h>
 558
 559  #ifdef OPENSSL_USE_APPLINK
 560  #define BIO_FLAGS_UPLINK 0x8000
 561 --- a/crypto/engine/eng_all.c
 562 +++ b/crypto/engine/eng_all.c
 563 @@ -113,7 +113,7 @@ void ENGINE_load_builtin_engines(void)
 564  #endif
 565         }
 566
 567 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
 568 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
 569  void ENGINE_setup_bsd_cryptodev(void) {
 570         static int bsd_cryptodev_default_loaded = 0;
 571         if (!bsd_cryptodev_default_loaded) {
 572 --- a/crypto/engine/eng_cryptodev.c
 573 +++ b/crypto/engine/eng_cryptodev.c
 574 @@ -72,6 +72,16 @@ ENGINE_load_cryptodev(void)
 575  struct dev_crypto_state {
 576         struct session_op d_sess;
 577         int d_fd;
 578 +
 579 +#ifdef USE_CRYPTODEV_DIGESTS
 580 +       char dummy_mac_key[20];
 581 +
 582 +       unsigned char digest_res[20];
 583 +       char *mac_data;
 584 +       int mac_len;
 585 +
 586 +       int copy;
 587 +#endif
 588  };
 589
 590  static u_int32_t cryptodev_asymfeat = 0;
 591 @@ -79,9 +89,6 @@ static u_int32_t cryptodev_asymfeat = 0;
 592  static int get_asym_dev_crypto(void);
 593  static int open_dev_crypto(void);
 594  static int get_dev_crypto(void);
 595 -static int cryptodev_max_iv(int cipher);
 596 -static int cryptodev_key_length_valid(int cipher, int len);
 597 -static int cipher_nid_to_cryptodev(int nid);
 598  static int get_cryptodev_ciphers(const int **cnids);
 599  /*static int get_cryptodev_digests(const int **cnids);*/
 600  static int cryptodev_usable_ciphers(const int **nids);
 601 @@ -134,9 +141,12 @@ static struct {
 602         int     ivmax;
 603         int     keylen;
 604  } ciphers[] = {
 605 +       { CRYPTO_ARC4,                  NID_rc4,                0,      16, },
 606         { CRYPTO_DES_CBC,               NID_des_cbc,            8,       8, },
 607         { CRYPTO_3DES_CBC,              NID_des_ede3_cbc,       8,      24, },
 608         { CRYPTO_AES_CBC,               NID_aes_128_cbc,        16,     16, },
 609 +       { CRYPTO_AES_CBC,               NID_aes_192_cbc,        16,     24, },
 610 +       { CRYPTO_AES_CBC,               NID_aes_256_cbc,        16,     32, },
 611         { CRYPTO_BLF_CBC,               NID_bf_cbc,             8,      16, },
 612         { CRYPTO_CAST_CBC,              NID_cast5_cbc,          8,      16, },
 613         { CRYPTO_SKIPJACK_CBC,          NID_undef,              0,       0, },
 614 @@ -147,14 +157,16 @@ static struct {
 615  static struct {
 616         int     id;
 617         int     nid;
 618 +       int     keylen;
 619  } digests[] = {
 620 -       { CRYPTO_SHA1_HMAC,             NID_hmacWithSHA1,       },
 621 -       { CRYPTO_RIPEMD160_HMAC,        NID_ripemd160,          },
 622 -       { CRYPTO_MD5_KPDK,              NID_undef,              },
 623 -       { CRYPTO_SHA1_KPDK,             NID_undef,              },
 624 -       { CRYPTO_MD5,                   NID_md5,                },
 625 -       { CRYPTO_SHA1,                  NID_undef,              },
 626 -       { 0,                            NID_undef,              },
 627 +       { CRYPTO_MD5_HMAC,              NID_hmacWithMD5,        16},
 628 +       { CRYPTO_SHA1_HMAC,             NID_hmacWithSHA1,       20},
 629 +       { CRYPTO_RIPEMD160_HMAC,        NID_ripemd160,          16/*?*/},
 630 +       { CRYPTO_MD5_KPDK,              NID_undef,              0},
 631 +       { CRYPTO_SHA1_KPDK,             NID_undef,              0},
 632 +       { CRYPTO_MD5,                   NID_md5,                16},
 633 +       { CRYPTO_SHA1,                  NID_sha1,               20},
 634 +       { 0,                            NID_undef,              0},
 635  };
 636  #endif
 637
 638 @@ -182,10 +194,17 @@ open_dev_crypto(void)
 639  static int
 640  get_dev_crypto(void)
 641  {
 642 -       int fd, retfd;
 643 +       static int fd = -1;
 644 +       int retfd;
 645
 646 -       if ((fd = open_dev_crypto()) == -1)
 647 -               return (-1);
 648 +       if (fd == -1) {
 649 +               if ((fd = open_dev_crypto()) == -1)
 650 +                       return (-1);
 651 +               if (fcntl(fd, F_SETFD, 1) == -1) {
 652 +                       close(fd);
 653 +                       return (-1);
 654 +               }
 655 +       }
 656         if (ioctl(fd, CRIOGET, &retfd) == -1)
 657                 return (-1);
 658
 659 @@ -209,50 +228,6 @@ get_asym_dev_crypto(void)
 660  }
 661
 662  /*
 663 - * XXXX this needs to be set for each alg - and determined from
 664 - * a running card.
 665 - */
 666 -static int
 667 -cryptodev_max_iv(int cipher)
 668 -{
 669 -       int i;
 670 -
 671 -       for (i = 0; ciphers[i].id; i++)
 672 -               if (ciphers[i].id == cipher)
 673 -                       return (ciphers[i].ivmax);
 674 -       return (0);
 675 -}
 676 -
 677 -/*
 678 - * XXXX this needs to be set for each alg - and determined from
 679 - * a running card. For now, fake it out - but most of these
 680 - * for real devices should return 1 for the supported key
 681 - * sizes the device can handle.
 682 - */
 683 -static int
 684 -cryptodev_key_length_valid(int cipher, int len)
 685 -{
 686 -       int i;
 687 -
 688 -       for (i = 0; ciphers[i].id; i++)
 689 -               if (ciphers[i].id == cipher)
 690 -                       return (ciphers[i].keylen == len);
 691 -       return (0);
 692 -}
 693 -
 694 -/* convert libcrypto nids to cryptodev */
 695 -static int
 696 -cipher_nid_to_cryptodev(int nid)
 697 -{
 698 -       int i;
 699 -
 700 -       for (i = 0; ciphers[i].id; i++)
 701 -               if (ciphers[i].nid == nid)
 702 -                       return (ciphers[i].id);
 703 -       return (0);
 704 -}
 705 -
 706 -/*
 707   * Find out what ciphers /dev/crypto will let us have a session for.
 708   * XXX note, that some of these openssl doesn't deal with yet!
 709   * returning them here is harmless, as long as we return NULL
 710 @@ -270,7 +245,7 @@ get_cryptodev_ciphers(const int **cnids)
 711                 return (0);
 712         }
 713         memset(&sess, 0, sizeof(sess));
 714 -       sess.key = (caddr_t)"123456781234567812345678";
 715 +       sess.key = (caddr_t)"123456789abcdefghijklmno";
 716
 717         for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
 718                 if (ciphers[i].nid == NID_undef)
 719 @@ -310,10 +285,12 @@ get_cryptodev_digests(const int **cnids)
 720                 return (0);
 721         }
 722         memset(&sess, 0, sizeof(sess));
 723 +       sess.mackey = (caddr_t)"123456789abcdefghijklmno";
 724         for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
 725                 if (digests[i].nid == NID_undef)
 726                         continue;
 727                 sess.mac = digests[i].id;
 728 +               sess.mackeylen = digests[i].keylen;
 729                 sess.cipher = 0;
 730                 if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
 731                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
 732 @@ -360,6 +337,9 @@ cryptodev_usable_ciphers(const int **nid
 733  static int
 734  cryptodev_usable_digests(const int **nids)
 735  {
 736 +#ifdef USE_CRYPTODEV_DIGESTS
 737 +       return (get_cryptodev_digests(nids));
 738 +#else
 739         /*
 740          * XXXX just disable all digests for now, because it sucks.
 741          * we need a better way to decide this - i.e. I may not
 742 @@ -374,6 +354,7 @@ cryptodev_usable_digests(const int **nid
 743          */
 744         *nids = NULL;
 745         return (0);
 746 +#endif
 747  }
 748
 749  static int
 750 @@ -436,16 +417,20 @@ cryptodev_init_key(EVP_CIPHER_CTX *ctx,
 751  {
 752         struct dev_crypto_state *state = ctx->cipher_data;
 753         struct session_op *sess = &state->d_sess;
 754 -       int cipher;
 755 -
 756 -       if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef)
 757 -               return (0);
 758 +       int cipher, i;
 759
 760 -       if (ctx->cipher->iv_len > cryptodev_max_iv(cipher))
 761 -               return (0);
 762 +       for (i = 0; ciphers[i].id; i++)
 763 +               if (ctx->cipher->nid == ciphers[i].nid &&
 764 +                   ctx->cipher->iv_len <= ciphers[i].ivmax &&
 765 +                   ctx->key_len == ciphers[i].keylen) {
 766 +                       cipher = ciphers[i].id;
 767 +                       break;
 768 +               }
 769
 770 -       if (!cryptodev_key_length_valid(cipher, ctx->key_len))
 771 +       if (!ciphers[i].id) {
 772 +               state->d_fd = -1;
 773                 return (0);
 774 +       }
 775
 776         memset(sess, 0, sizeof(struct session_op));
 777
 778 @@ -505,6 +490,20 @@ cryptodev_cleanup(EVP_CIPHER_CTX *ctx)
 779   * gets called when libcrypto requests a cipher NID.
 780   */
 781
 782 +/* RC4 */
 783 +const EVP_CIPHER cryptodev_rc4 = {
 784 +       NID_rc4,
 785 +       1, 16, 0,
 786 +       EVP_CIPH_VARIABLE_LENGTH,
 787 +       cryptodev_init_key,
 788 +       cryptodev_cipher,
 789 +       cryptodev_cleanup,
 790 +       sizeof(struct dev_crypto_state),
 791 +       NULL,
 792 +       NULL,
 793 +       NULL
 794 +};
 795 +
 796  /* DES CBC EVP */
 797  const EVP_CIPHER cryptodev_des_cbc = {
 798         NID_des_cbc,
 799 @@ -572,6 +571,32 @@ const EVP_CIPHER cryptodev_aes_cbc = {
 800         NULL
 801  };
 802
 803 +const EVP_CIPHER cryptodev_aes_192_cbc = {
 804 +       NID_aes_192_cbc,
 805 +       16, 24, 16,
 806 +       EVP_CIPH_CBC_MODE,
 807 +       cryptodev_init_key,
 808 +       cryptodev_cipher,
 809 +       cryptodev_cleanup,
 810 +       sizeof(struct dev_crypto_state),
 811 +       EVP_CIPHER_set_asn1_iv,
 812 +       EVP_CIPHER_get_asn1_iv,
 813 +       NULL
 814 +};
 815 +
 816 +const EVP_CIPHER cryptodev_aes_256_cbc = {
 817 +       NID_aes_256_cbc,
 818 +       16, 32, 16,
 819 +       EVP_CIPH_CBC_MODE,
 820 +       cryptodev_init_key,
 821 +       cryptodev_cipher,
 822 +       cryptodev_cleanup,
 823 +       sizeof(struct dev_crypto_state),
 824 +       EVP_CIPHER_set_asn1_iv,
 825 +       EVP_CIPHER_get_asn1_iv,
 826 +       NULL
 827 +};
 828 +
 829  /*
 830   * Registered by the ENGINE when used to find out how to deal with
 831   * a particular NID in the ENGINE. this says what we'll do at the
 832 @@ -585,6 +610,9 @@ cryptodev_engine_ciphers(ENGINE *e, cons
 833                 return (cryptodev_usable_ciphers(nids));
 834
 835         switch (nid) {
 836 +       case NID_rc4:
 837 +               *cipher = &cryptodev_rc4;
 838 +               break;
 839         case NID_des_ede3_cbc:
 840                 *cipher = &cryptodev_3des_cbc;
 841                 break;
 842 @@ -600,6 +628,12 @@ cryptodev_engine_ciphers(ENGINE *e, cons
 843         case NID_aes_128_cbc:
 844                 *cipher = &cryptodev_aes_cbc;
 845                 break;
 846 +       case NID_aes_192_cbc:
 847 +               *cipher = &cryptodev_aes_192_cbc;
 848 +               break;
 849 +       case NID_aes_256_cbc:
 850 +               *cipher = &cryptodev_aes_256_cbc;
 851 +               break;
 852         default:
 853                 *cipher = NULL;
 854                 break;
 855 @@ -607,6 +641,234 @@ cryptodev_engine_ciphers(ENGINE *e, cons
 856         return (*cipher != NULL);
 857  }
 858
 859 +
 860 +#ifdef USE_CRYPTODEV_DIGESTS
 861 +
 862 +/* convert digest type to cryptodev */
 863 +static int
 864 +digest_nid_to_cryptodev(int nid)
 865 +{
 866 +       int i;
 867 +
 868 +       for (i = 0; digests[i].id; i++)
 869 +               if (digests[i].nid == nid)
 870 +                       return (digests[i].id);
 871 +       return (0);
 872 +}
 873 +
 874 +
 875 +static int
 876 +digest_key_length(int nid)
 877 +{
 878 +       int i;
 879 +
 880 +       for (i = 0; digests[i].id; i++)
 881 +               if (digests[i].nid == nid)
 882 +                       return digests[i].keylen;
 883 +       return (0);
 884 +}
 885 +
 886 +
 887 +static int cryptodev_digest_init(EVP_MD_CTX *ctx)
 888 +{
 889 +       struct dev_crypto_state *state = ctx->md_data;
 890 +       struct session_op *sess = &state->d_sess;
 891 +       int digest;
 892 +
 893 +       if ((digest = digest_nid_to_cryptodev(ctx->digest->type)) == NID_undef){
 894 +               fprintf(stderr, "cryptodev_digest_init: Can't get digest \n");
 895 +               return (0);
 896 +       }
 897 +
 898 +       memset(state, 0, sizeof(struct dev_crypto_state));
 899 +
 900 +       if ((state->d_fd = get_dev_crypto()) < 0) {
 901 +               fprintf(stderr, "cryptodev_digest_init: Can't get Dev \n");
 902 +               return (0);
 903 +       }
 904 +
 905 +       sess->mackey = state->dummy_mac_key;
 906 +       sess->mackeylen = digest_key_length(ctx->digest->type);
 907 +       sess->mac = digest;
 908 +
 909 +       if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
 910 +               close(state->d_fd);
 911 +               state->d_fd = -1;
 912 +               fprintf(stderr, "cryptodev_digest_init: Open session failed\n");
 913 +               return (0);
 914 +       }
 915 +
 916 +       return (1);
 917 +}
 918 +
 919 +static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
 920 +               size_t count)
 921 +{
 922 +       struct crypt_op cryp;
 923 +       struct dev_crypto_state *state = ctx->md_data;
 924 +       struct session_op *sess = &state->d_sess;
 925 +
 926 +       if (!data || state->d_fd < 0) {
 927 +               fprintf(stderr, "cryptodev_digest_update: illegal inputs \n");
 928 +               return (0);
 929 +       }
 930 +
 931 +       if (!count) {
 932 +               return (0);
 933 +       }
 934 +
 935 +       if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
 936 +               /* if application doesn't support one buffer */
 937 +               state->mac_data = OPENSSL_realloc(state->mac_data, state->mac_len + count);
 938 +
 939 +               if (!state->mac_data) {
 940 +                       fprintf(stderr, "cryptodev_digest_update: realloc failed\n");
 941 +                       return (0);
 942 +               }
 943 +
 944 +               memcpy(state->mac_data + state->mac_len, data, count);
 945 +               state->mac_len += count;
 946 +
 947 +               return (1);
 948 +       }
 949 +
 950 +       memset(&cryp, 0, sizeof(cryp));
 951 +
 952 +       cryp.ses = sess->ses;
 953 +       cryp.flags = 0;
 954 +       cryp.len = count;
 955 +       cryp.src = (caddr_t) data;
 956 +       cryp.dst = NULL;
 957 +       cryp.mac = state->digest_res;
 958 +       if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
 959 +               fprintf(stderr, "cryptodev_digest_update: digest failed\n");
 960 +               return (0);
 961 +       }
 962 +       return (1);
 963 +}
 964 +
 965 +
 966 +static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
 967 +{
 968 +       struct crypt_op cryp;
 969 +       struct dev_crypto_state *state = ctx->md_data;
 970 +       struct session_op *sess = &state->d_sess;
 971 +
 972 +       int ret = 1;
 973 +
 974 +       if (!md || state->d_fd < 0) {
 975 +               fprintf(stderr, "cryptodev_digest_final: illegal input\n");
 976 +               return(0);
 977 +       }
 978 +
 979 +       if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
 980 +               /* if application doesn't support one buffer */
 981 +               memset(&cryp, 0, sizeof(cryp));
 982 +
 983 +               cryp.ses = sess->ses;
 984 +               cryp.flags = 0;
 985 +               cryp.len = state->mac_len;
 986 +               cryp.src = state->mac_data;
 987 +               cryp.dst = NULL;
 988 +               cryp.mac = md;
 989 +
 990 +               if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
 991 +                       fprintf(stderr, "cryptodev_digest_final: digest failed\n");
 992 +                       return (0);
 993 +               }
 994 +
 995 +               return 1;
 996 +       }
 997 +
 998 +       memcpy(md, state->digest_res, ctx->digest->md_size);
 999 +
1000 +       return (ret);
1001 +}
1002 +
1003 +
1004 +static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
1005 +{
1006 +       int ret = 1;
1007 +       struct dev_crypto_state *state = ctx->md_data;
1008 +       struct session_op *sess = &state->d_sess;
1009 +
1010 +       if (state->d_fd < 0) {
1011 +               fprintf(stderr, "cryptodev_digest_cleanup: illegal input\n");
1012 +               return (0);
1013 +       }
1014 +
1015 +       if (state->mac_data) {
1016 +               OPENSSL_free(state->mac_data);
1017 +               state->mac_data = NULL;
1018 +               state->mac_len = 0;
1019 +       }
1020 +
1021 +       if (state->copy)
1022 +               return 1;
1023 +
1024 +       if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
1025 +               fprintf(stderr, "cryptodev_digest_cleanup: failed to close session\n");
1026 +               ret = 0;
1027 +       } else {
1028 +               ret = 1;
1029 +       }
1030 +       close(state->d_fd);
1031 +       state->d_fd = -1;
1032 +
1033 +       return (ret);
1034 +}
1035 +
1036 +static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
1037 +{
1038 +       struct dev_crypto_state *fstate = from->md_data;
1039 +       struct dev_crypto_state *dstate = to->md_data;
1040 +
1041 +       memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
1042 +
1043 +       if (fstate->mac_len != 0) {
1044 +               dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
1045 +               memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
1046 +       }
1047 +
1048 +       dstate->copy = 1;
1049 +
1050 +       return 1;
1051 +}
1052 +
1053 +
1054 +const EVP_MD cryptodev_sha1 = {
1055 +       NID_sha1,
1056 +       NID_undef,
1057 +       SHA_DIGEST_LENGTH,
1058 +       EVP_MD_FLAG_ONESHOT,
1059 +       cryptodev_digest_init,
1060 +       cryptodev_digest_update,
1061 +       cryptodev_digest_final,
1062 +       cryptodev_digest_copy,
1063 +       cryptodev_digest_cleanup,
1064 +       EVP_PKEY_NULL_method,
1065 +       SHA_CBLOCK,
1066 +       sizeof(struct dev_crypto_state),
1067 +};
1068 +
1069 +const EVP_MD cryptodev_md5 = {
1070 +       NID_md5,
1071 +       NID_undef,
1072 +       16 /* MD5_DIGEST_LENGTH */,
1073 +       EVP_MD_FLAG_ONESHOT,
1074 +       cryptodev_digest_init,
1075 +       cryptodev_digest_update,
1076 +       cryptodev_digest_final,
1077 +       cryptodev_digest_copy,
1078 +       cryptodev_digest_cleanup,
1079 +       EVP_PKEY_NULL_method,
1080 +       64 /* MD5_CBLOCK */,
1081 +       sizeof(struct dev_crypto_state),
1082 +};
1083 +
1084 +#endif /* USE_CRYPTODEV_DIGESTS */
1085 +
1086 +
1087  static int
1088  cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest,
1089      const int **nids, int nid)
1090 @@ -615,10 +877,15 @@ cryptodev_engine_digests(ENGINE *e, cons
1091                 return (cryptodev_usable_digests(nids));
1092
1093         switch (nid) {
1094 +#ifdef USE_CRYPTODEV_DIGESTS
1095         case NID_md5:
1096 -               *digest = NULL; /* need to make a clean md5 critter */
1097 +               *digest = &cryptodev_md5;
1098                 break;
1099 +       case NID_sha1:
1100 +               *digest = &cryptodev_sha1;
1101 +               break;
1102         default:
1103 +#endif /* USE_CRYPTODEV_DIGESTS */
1104                 *digest = NULL;
1105                 break;
1106         }
1107 @@ -646,6 +913,7 @@ bn2crparam(const BIGNUM *a, struct crpar
1108         b = malloc(bytes);
1109         if (b == NULL)
1110                 return (1);
1111 +       memset(b, 0, bytes);
1112
1113         crp->crp_p = (char *)b;
1114         crp->crp_nbits = bits;
1115 @@ -690,7 +958,7 @@ zapparams(struct crypt_kop *kop)
1116  {
1117         int i;
1118
1119 -       for (i = 0; i <= kop->crk_iparams + kop->crk_oparams; i++) {
1120 +       for (i = 0; i < kop->crk_iparams + kop->crk_oparams; i++) {
1121                 if (kop->crk_param[i].crp_p)
1122                         free(kop->crk_param[i].crp_p);
1123                 kop->crk_param[i].crp_p = NULL;
1124 @@ -757,6 +1025,9 @@ cryptodev_bn_mod_exp(BIGNUM *r, const BI
1125
1126         if (cryptodev_asym(&kop, BN_num_bytes(m), r, 0, NULL) == -1) {
1127                 const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
1128 +               fprintf(stderr, "cryptodev_asym: CRK_MOD_EXP %s failed, "
1129 +                       "Running in software\n", errno==kop.crk_status ?
1130 +                       "hardware operation" : "asym process");
1131                 ret = meth->bn_mod_exp(r, a, p, m, ctx, in_mont);
1132         }
1133  err:
1134 @@ -768,7 +1039,6 @@ static int
1135  cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
1136  {
1137         int r;
1138 -
1139         r = cryptodev_bn_mod_exp(r0, I, rsa->d, rsa->n, ctx, NULL);
1140         return (r);
1141  }
1142 @@ -803,6 +1073,9 @@ cryptodev_rsa_mod_exp(BIGNUM *r0, const
1143
1144         if (cryptodev_asym(&kop, BN_num_bytes(rsa->n), r0, 0, NULL) == -1) {
1145                 const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
1146 +               fprintf(stderr, "cryptodev_asym: CRK_MOD_EXP_CRT %s failed, "
1147 +                       "Running in software\n", errno==kop.crk_status ?
1148 +                       "hardware operation" : "asym process");
1149                 ret = (*meth->rsa_mod_exp)(r0, I, rsa, ctx);
1150         }
1151  err:
1152 @@ -904,6 +1177,9 @@ cryptodev_dsa_do_sign(const unsigned cha
1153                 const DSA_METHOD *meth = DSA_OpenSSL();
1154                 BN_free(r);
1155                 BN_free(s);
1156 +               fprintf(stderr, "cryptodev_asym: CRK_DSA_SIGN %s failed, "
1157 +                       "Running in software\n", errno==kop.crk_status ?
1158 +                       "hardware operation" : "asym process");
1159                 dsaret = (meth->dsa_do_sign)(dgst, dlen, dsa);
1160         }
1161  err:
1162 @@ -944,6 +1220,9 @@ cryptodev_dsa_verify(const unsigned char
1163         } else {
1164                 const DSA_METHOD *meth = DSA_OpenSSL();
1165
1166 +               fprintf(stderr, "cryptodev_asym: CRK_DSA_VERIFY %s failed, "
1167 +                       "Running in software\n", errno==kop.crk_status ?
1168 +                       "hardware operation" : "asym process");
1169                 dsaret = (meth->dsa_do_verify)(dgst, dlen, sig, dsa);
1170         }
1171  err:
1172 @@ -977,8 +1256,8 @@ static int
1173  cryptodev_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
1174  {
1175         struct crypt_kop kop;
1176 -       int dhret = 1;
1177 -       int fd, keylen;
1178 +       int dhret = -1;
1179 +       int fd, keybits;
1180
1181         if ((fd = get_asym_dev_crypto()) < 0) {
1182                 const DH_METHOD *meth = DH_OpenSSL();
1183 @@ -986,7 +1265,7 @@ cryptodev_dh_compute_key(unsigned char *
1184                 return ((meth->compute_key)(key, pub_key, dh));
1185         }
1186
1187 -       keylen = BN_num_bits(dh->p);
1188 +       keybits = BN_num_bits(dh->p);
1189
1190         memset(&kop, 0, sizeof kop);
1191         kop.crk_op = CRK_DH_COMPUTE_KEY;
1192 @@ -1001,14 +1280,18 @@ cryptodev_dh_compute_key(unsigned char *
1193         kop.crk_iparams = 3;
1194
1195         kop.crk_param[3].crp_p = (char *)key;
1196 -       kop.crk_param[3].crp_nbits = keylen * 8;
1197 +       kop.crk_param[3].crp_nbits = keybits;
1198         kop.crk_oparams = 1;
1199
1200         if (ioctl(fd, CIOCKEY, &kop) == -1) {
1201                 const DH_METHOD *meth = DH_OpenSSL();
1202
1203 +               fprintf(stderr, "cryptodev_asym: CRK_DH_COMPUTE_KEY %s failed, "
1204 +                       "Running in software\n", errno==kop.crk_status ?
1205 +                       "hardware operation" : "asym process");
1206                 dhret = (meth->compute_key)(key, pub_key, dh);
1207 -       }
1208 +       } else
1209 +               dhret = (keybits + 7) / 8;
1210  err:
1211         kop.crk_param[3].crp_p = NULL;
1212         zapparams(&kop);
1213 --- a/crypto/engine/engine.h
1214 +++ b/crypto/engine/engine.h
1215 @@ -705,7 +705,7 @@ typedef int (*dynamic_bind_engine)(ENGIN
1216   * values. */
1217  void *ENGINE_get_static_state(void);
1218
1219 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
1220 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
1221  void ENGINE_setup_bsd_cryptodev(void);
1222  #endif
1223
1224 --- a/crypto/evp/c_all.c
1225 +++ b/crypto/evp/c_all.c
1226 @@ -83,7 +83,7 @@ void OPENSSL_add_all_algorithms_noconf(v
1227         OpenSSL_add_all_ciphers();
1228         OpenSSL_add_all_digests();
1229  #ifndef OPENSSL_NO_ENGINE
1230 -# if defined(__OpenBSD__) || defined(__FreeBSD__)
1231 +# if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
1232         ENGINE_setup_bsd_cryptodev();
1233  # endif
1234  #endif
1235 --- a/crypto/evp/c_alld.c
1236 +++ b/crypto/evp/c_alld.c
1237 @@ -78,7 +78,7 @@ void OpenSSL_add_all_digests(void)
1238         EVP_add_digest(EVP_dss());
1239  #endif
1240  #endif
1241 -#ifndef OPENSSL_NO_SHA
1242 +#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
1243         EVP_add_digest(EVP_sha1());
1244         EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
1245         EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA);
1246 --- a/engines/Makefile
1247 +++ b/engines/Makefile
1248 @@ -97,6 +97,7 @@ install:
1249                         ( echo installing $$l; \
1250                           if [ "$(PLATFORM)" != "Cygwin" ]; then \
1251                                 case "$(CFLAGS)" in \
1252 +                               *OPENSSL_NO_HW*)        continue;;      \
1253                                 *DSO_DLFCN*)    sfx="so";;      \
1254                                 *DSO_DL*)       sfx="sl";;      \
1255                                 *)              sfx="bad";;     \