Hi/fn 7751 Driver for NT and Unix

1. What is it?

This driver is a open-source, beta-quality driver for the Hi/fn 7751 encryption/compression coprocessor. It supports most 7751 add-in boards, including:

• Hi/fn's own 7751 Reference Hardware (DRAM)
• Invertex AEON [no longer made] (DRAM or SRAM) [1]
• GTGI PowerCrypt (512K SRAM)
• Other add-in boards used in VPN appiances, made by NETSEC and others.

[1] The Aeon boards may require changes to the onboard EEPROM to work with this driver. The other boards listed use the Hi/fn Reference Hardware's PCI ID, and use an export key of all zeroes -- I do not currently know if Invertex did things differently, as the one Aeon board I've seen was received at GTGI with a zeroed EEPROM.

We currently support the following OSes:

• Windows NT 4.0
• FreeBSD 2.x and 4.x/5.x
• Linux 2.2.x and 2.4.x (any distribution)

2. Getting the driver

3. Building the driver

These instructions assume you have the driver source unpacked (NT users: WinZip can unpack the .tar.gz format we use for source drops.)

• Copy the .c and .h files from the PORTABLE directory into the NTSPECFC and NTUMI directories.
• Run BUILD -zE in the NTSPECFC directory. Once it finishes, go to the NTUMI directory and run the build there.
• The finished drivers will be in the I386\ (where build-type is FREE OR CHECKED, depending on which environment you chose) in each subdirectory. Copy each one into %NtDir%\SYSTEM32\DRIVERS.
• Run the two REG files in the NTSPECFC directory, either by double-clicking them from Windows Explorer, or rom the command line using START. This will add two Services entries under HKeyLocalMachine\System\CurrentControlSet:
  
  PwrCrypt
  PcrptUMI
  
  Both are normal kernel-mode drivers, set to be started manually. PcrptUMI depends on PwrCrypt.
  
  (The names are the originals used for the driver, and will be changed eventually to something more generic.)
  

On Linux:

• Make sure you have the Linux kernel sources for whichever kernel version you're building for installed in /usr/src/linux. The current build setup uses headers from there, and if it doesn't find them, it'll use the default headers from /usr/include (which causes problems on some distributions, notably Debian potato).
• Change to either the LINUX22 or LINUX24 directory (depending on what kernel version you're using) and copy the Makefile.in file to Makefile. You'll want to uncomment a line in the Makefile if your kernel is configured for SMP, since we don't yet autodetect that.
• Run make. If you see lots of warnings, this is normal. If the build falls over, see section 5.
• Load the driver using insmod. You should see a quick initialisation notice and a list of boards found.

On FreeBSD:

The FreeBSD build is currently semi-broken and being worked on. Updated instructions on how to build here will be posted shortly.

4. Known problems with the driver

These are some known problems with the driver in its present state. It *is* useable, but some things still need work.

If you're interested in working on the driver, email me and I'll add you to the developer list.

• The NT port of the driver is very old, and is in serious need of a cleanup. In particular, the whole thing needs to be ported to WDM, and the build structure changed to one like that used in the Windows 2000/XP/2003 DDKS for export drivers (classpnp is a good example of what I'd like).
• None of the drivers do board memory type and size auto-detection. The 7751 supports several different configurations of context memory and memory management, and at the moment, the settings must be changed manually. The Invertex boards in particular came in both DRAM and SRAM versions, each with different memory options available. OpenBSD has working auto-detect code, which should be easy enough to integrate once we verify that READ RAM is usable.
• Various timing-related bugs within the interrupt handler. On some systems, the 7751 hits the end of the descriptor list prematurely (my theory), causing a read or write to a bogus address on the bus, and a PCI abort -- which, due to the 7751's interface, requires completely resetting and reloading the chip. Again, most of this has been fixed in OpenBSD's code, and their workarounds should port over easily.
• For Unix versions, have better Makefiles (that pull in the kernel makefile system) for Linux 2.2 and 2.4, and properly link into the system makefile tree in FreeBSD (some of this has already been done, but needs cleaning up due to bogus path assumptions). Hopefully, this will make compilation easier, and lessen complaints about the drivers not compiling in certain environments. Also, change the major numbers to match that of the new GTGI Linux driver (first device at major 10, minor 63 and descending from there). This is assuming we even want to continue supporting Unix at all with this driver. The new Linux driver is also Open Source, and FreeBSD is using a port of the entire OpenBSD infrastructure, including hifn(4), as of versions 4.8 and 5.0.

• Hi/fn has a newer chip (the 7951) available that is basically a 7751 with public-key support. So far, compatibility with this chip has not been tested.

• Also, Hifn makes several "superchips", the 7811 being the most common of them, that can run in either an "enhanced" mode (using a builder-provided MIPS processor, extra RAM and Hi/fn-provided firmware; this is referred to in later Hifn product literature as "HIPP" or "HSP") or in 7751-compatibility mode (which is basically a faster 7751 with some quirks). This driver has not been tested on those, but they should work in compatibility mode with one minor change to the DMA initialization (again, due to a 7811 quirk). We do not have any support for the enhanced mode at the moment, due to lack of demand; all of the 7811-based cards I know of are used in 7751-compatible mode.
• Right now, public key processing (present in the 7951) and the hardware RNG (present in the 7811 and 7951) aren't supported. Eventually, I'd like the public-key stuff to be supported as an RSA offload module to Windows' CAPI subsystem (which isn't nearly as nice as OpenBSD's cryptodev system -- it's basically a clone of PKCS#11, meant for use by things like web browsers -- but it's there, so why not). Also, the later HIPP-only processors, such as the 7814, 7851 and 8100 series, aren't supported at all.

5. If you have problems...

If you are having trouble with the driver, email me at the address below. I'll have a look at the problem and see if I can help.

GTGI support for this driver is no longer available. Linux users are encouraged to use the ported OpenBSD driver for new applications; at the moment, no official Windows support is provided. Contact GTGI for more details.

There's also a mailing list available for driver users. The address is hifn7751-users@lists.sourceforge.net, and you can use this link to subscribe to it.

6. Credits

This page is maintained by Lee Cremeans <lee@lcremeans.homeip.net>.

The drivers were provided to the open source community by Global Technologies Group, Inc., and bear this copyright notice:

(C) 1999-2001 Global Technologies Group, Inc.
(C) 1998-1999 Ashley-Laurent, Inc.

All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:

1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.

Last modified 8 September 2003[B.