ep11: Fixed Makefile to complement common code dependencies
This will fix the side effect that the ep11 token could not
plugged into slot 0, because of unresolved symbols.

Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
ep11: switched to official m_init() function based on library change

Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Scenario: processA creates private token key object and before he can
use it, processB gets it, uses it, and deletes it.
Because opencryptoki was not checking the global token object count,
process B segfaulted when count was zero, thinking there were objects in
shared memory to search.
Also, it was not checking return code of object_mgr_check_shm() in
object_mgr_find_in_map1 to see if anything was found in shm.
And lastly, return correct error code.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
ep11's h_opaque_2_blob needs to catch the return code from
object_mgr_find_in_map1 and return it.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
EP11: some README updates about usage and restrictions.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
pkcsconf: remove 'M' from the optstring and the help message

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
print_mechanism() ignored bad returncodes from the called function
token_specific_get_mechanism_list(). So the token init was just
running fine but mechanism list kept empty (eg. because of wrong
adapter configuration). Fixed this and adjusted some of the
related log messages.

Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Fix failure when confname is not given, use default ep11tok.conf instead.

Slight rework on the way how the ep11 token config file is found:
If env has no OCK_EP11_TOKEN_DIR
 if confname is not null, try to use it
 if this fails, try ock default config dir + confname
 if this fails, try ock default config dir + ep11tok.conf
if OCK_EP11_TOKEN_DIR given then
 if confname is not null, try OCK_EP11_TOKEN_DIR + confname
 if this fails, try OCK_EP11_TOKEN_DIR + ep11tok.conf
if still unsuccessful then token init will fail.

Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Configure was checking for the ep11 lib and the m_init() function.
As this library will be dynamically loaded at run time and there
is no dependency at build time (but build will break if ep11 lib
is not available) removed this check.

Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
The asm/zcrypt.h header file uses some std int types and so
the stdint.h include statement should occur before the zcrypt
header file.

Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Small reworks:
- Some of the ock testcase c files are tracked by git as 755.
  Fixed, c code files should appear 644 now.
- pkcs11 misc_func test improved to show not just the
  mechanism number but also the (preprocessor defined)
  mechanism name.
- misc speed test rsa encrypt receive buffer increased
  so the "buffer size too small" is fixed now.
- misc speed test rsa uses now an exponent value of
  17 (0x01,0x00,0x01) instead of 3 (0x03). Some tokens (eg. ep11)
  do not allow such low exponents and reject RSA key
  generation.

Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
The 31 bit build on s390 showed an build error at initialization
of an static long long variable which gets an address assigned.
Fixed and tested on 31 and 64 bit.

Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
[PATCH 1/10]: add new token_specific_shaX calls to the header files.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
[PATCH 2/10]: Remove ckm_* calls and make one call into the hash functions.
Add single-part SHAs, instead of calling both update and final to do
what should really be one call for the token.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
[PATCH 3/10]: Replace calls to ckm_* with their new counterparts.
Also to allow the shaX_* calls to be called internally, remove
the check for a session. It is done earlier when called from api.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
[PATCH 4/10]: Add token-specific single-part shaX to ica token.
Remove doing single-part with update and final calls.
Now ctx->multi should only be TRUE when doing update and final to
indicate was a multi-part operation.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
[PATCH 5/10]: Add single-part sha2 to cca token.
Remove doing single-part sha2 within tokn_specific_sha2_update and final.
Made corrections in token_specific_sha2_update and token_specific_sha2_init
so that we do not malloc the saved buffer in ctx. No need to do this if
we send data once we have a multiple of the blocksize. The CSNBOWH has
ability to chain data, so best to use it. Thus saved data is always going
to be less than blocksize and don't need to realloc or malloc it.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
[PATCH 6/10] : Add support for SHA384 and SHA512 to cca token.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
[PATCH 7/10]: Add single-part sha to ep11 token.
Also, in the shaX_init and sign_init, only add state and set
to active if the m_XXX_init call succeeds.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
[PATCH 8/10]: Only icsf token supports multi-part hmac. But icsf is only
token with no "identifiable" properties, so only run hmac multipart
if not the other tokens.

Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>