void ieee80211_wep_free(struct ieee80211_local *local)
{
	if (!IS_ERR(local->wep_tx_tfm))
		crypto_free_cipher(local->wep_tx_tfm);
	if (!IS_ERR(local->wep_rx_tfm))
		crypto_free_cipher(local->wep_rx_tfm);
}

/* Set up per cpu cipher state */
static struct crypto_cipher *setup_essiv_cpu(struct crypt_config *cc,
        struct dm_target *ti,
        u8 *salt, unsigned saltsize)
{
    struct crypto_cipher *essiv_tfm;
    int err;

    /* Setup the essiv_tfm with the given salt */
    essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, CRYPTO_ALG_ASYNC);
    if (IS_ERR(essiv_tfm)) {
        ti->error = "Error allocating crypto tfm for ESSIV";
        return essiv_tfm;
    }

    if (crypto_cipher_blocksize(essiv_tfm) !=
            crypto_ablkcipher_ivsize(any_tfm(cc))) {
        ti->error = "Block size of ESSIV cipher does "
                    "not match IV size of block cipher";
        crypto_free_cipher(essiv_tfm);
        return ERR_PTR(-EINVAL);
    }

    err = crypto_cipher_setkey(essiv_tfm, salt, saltsize);
    if (err) {
        ti->error = "Failed to set key for ESSIV cipher";
        crypto_free_cipher(essiv_tfm);
        return ERR_PTR(err);
    }

    return essiv_tfm;
}

static int reset_prng_context(struct prng_context *ctx,
			      unsigned char *key, size_t klen,
			      unsigned char *V, unsigned char *DT)
{
	int ret;
	int rc = -EINVAL;
	unsigned char *prng_key;

	spin_lock(&ctx->prng_lock);
	ctx->flags |= PRNG_NEED_RESET;

	prng_key = (key != NULL) ? key : (unsigned char *)DEFAULT_PRNG_KEY;

	if (!key)
		klen = DEFAULT_PRNG_KSZ;

	if (V)
		memcpy(ctx->V, V, DEFAULT_BLK_SZ);
	else
		memcpy(ctx->V, DEFAULT_V_SEED, DEFAULT_BLK_SZ);

	if (DT)
		memcpy(ctx->DT, DT, DEFAULT_BLK_SZ);
	else
		memset(ctx->DT, 0, DEFAULT_BLK_SZ);

	memset(ctx->rand_data, 0, DEFAULT_BLK_SZ);
	memset(ctx->last_rand_data, 0, DEFAULT_BLK_SZ);

	if (ctx->tfm)
		crypto_free_cipher(ctx->tfm);

	ctx->tfm = crypto_alloc_cipher("aes", 0, 0);
	if (IS_ERR(ctx->tfm)) {
		dbgprint(KERN_CRIT "Failed to alloc tfm for context %p\n",
			ctx);
		ctx->tfm = NULL;
		goto out;
	}

	ctx->rand_data_valid = DEFAULT_BLK_SZ;

	ret = crypto_cipher_setkey(ctx->tfm, prng_key, klen);
	if (ret) {
		dbgprint(KERN_CRIT "PRNG: setkey() failed flags=%x\n",
			crypto_cipher_get_flags(ctx->tfm));
		crypto_free_cipher(ctx->tfm);
		goto out;
	}

	rc = 0;
	ctx->flags &= ~PRNG_NEED_RESET;
out:
	spin_unlock(&ctx->prng_lock);

	return rc;

}

static void fallback_exit_cip(struct crypto_tfm *tfm)
{
	struct geode_aes_op *op = crypto_tfm_ctx(tfm);

	crypto_free_cipher(op->fallback.cip);
	op->fallback.cip = NULL;
}

int tcp_fastopen_reset_cipher(void *key, unsigned int len)
{
	int err;
	struct tcp_fastopen_context *ctx, *octx;

	ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
	if (!ctx)
		return -ENOMEM;
	ctx->tfm = crypto_alloc_cipher("aes", 0, 0);

	if (IS_ERR(ctx->tfm)) {
		err = PTR_ERR(ctx->tfm);
error:		kfree(ctx);
		pr_err("TCP: TFO aes cipher alloc error: %d\n", err);
		return err;
	}
	err = crypto_cipher_setkey(ctx->tfm, key, len);
	if (err) {
		pr_err("TCP: TFO cipher key error: %d\n", err);
		crypto_free_cipher(ctx->tfm);
		goto error;
	}
	memcpy(ctx->key, key, len);

	spin_lock(&tcp_fastopen_ctx_lock);

	octx = rcu_dereference_protected(tcp_fastopen_ctx,
				lockdep_is_held(&tcp_fastopen_ctx_lock));
	rcu_assign_pointer(tcp_fastopen_ctx, ctx);
	spin_unlock(&tcp_fastopen_ctx_lock);

	if (octx)
		call_rcu(&octx->rcu, tcp_fastopen_ctx_free);
	return err;
}

static int crypto4xx_compute_gcm_hash_key_sw(__le32 *hash_start, const u8 *key,
					     unsigned int keylen)
{
	struct crypto_cipher *aes_tfm = NULL;
	uint8_t src[16] = { 0 };
	int rc = 0;

	aes_tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC |
				      CRYPTO_ALG_NEED_FALLBACK);
	if (IS_ERR(aes_tfm)) {
		rc = PTR_ERR(aes_tfm);
		pr_warn("could not load aes cipher driver: %d\n", rc);
		return rc;
	}

	rc = crypto_cipher_setkey(aes_tfm, key, keylen);
	if (rc) {
		pr_err("setkey() failed: %d\n", rc);
		goto out;
	}

	crypto_cipher_encrypt_one(aes_tfm, src, src);
	crypto4xx_memcpy_to_le32(hash_start, src, 16);
out:
	crypto_free_cipher(aes_tfm);
	return rc;
}

static int crypto_ccm_init_tfm(struct crypto_tfm *tfm)
{
	struct crypto_instance *inst = (void *)tfm->__crt_alg;
	struct ccm_instance_ctx *ictx = crypto_instance_ctx(inst);
	struct crypto_ccm_ctx *ctx = crypto_tfm_ctx(tfm);
	struct crypto_cipher *cipher;
	struct crypto_ablkcipher *ctr;
	unsigned long align;
	int err;

	cipher = crypto_spawn_cipher(&ictx->cipher);
	if (IS_ERR(cipher))
		return PTR_ERR(cipher);

	ctr = crypto_spawn_skcipher(&ictx->ctr);
	err = PTR_ERR(ctr);
	if (IS_ERR(ctr))
		goto err_free_cipher;

	ctx->cipher = cipher;
	ctx->ctr = ctr;

	align = crypto_tfm_alg_alignmask(tfm);
	align &= ~(crypto_tfm_ctx_alignment() - 1);
	tfm->crt_aead.reqsize = align +
				sizeof(struct crypto_ccm_req_priv_ctx) +
				crypto_ablkcipher_reqsize(ctr);

	return 0;

err_free_cipher:
	crypto_free_cipher(cipher);
	return err;
}

static void crypto_ccm_exit_tfm(struct crypto_tfm *tfm)
{
	struct crypto_ccm_ctx *ctx = crypto_tfm_ctx(tfm);

	crypto_free_cipher(ctx->cipher);
	crypto_free_ablkcipher(ctx->ctr);
}

static void fallback_exit_cip(struct crypto_tfm *tfm)
{
	struct s390_aes_ctx *sctx = crypto_tfm_ctx(tfm);

	crypto_free_cipher(sctx->fallback.cip);
	sctx->fallback.cip = NULL;
}

 static void __exit sbd_exit(void)
 {
     crypto_free_cipher(crypt);
     del_gendisk(Device.gd);
     put_disk(Device.gd);
     unregister_blkdev(major_num, "sbd");
     blk_cleanup_queue(Queue);
     vfree(Device.data);
 }

static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
			      const char *opts)
{
	struct crypto_cipher *essiv_tfm = NULL;
	struct crypto_hash *hash_tfm = NULL;
	u8 *salt = NULL;
	int err;

	if (!opts) {
		ti->error = "Digest algorithm missing for ESSIV mode";
		return -EINVAL;
	}

	/* Allocate hash algorithm */
	hash_tfm = crypto_alloc_hash(opts, 0, CRYPTO_ALG_ASYNC);
	if (IS_ERR(hash_tfm)) {
		ti->error = "Error initializing ESSIV hash";
		err = PTR_ERR(hash_tfm);
		goto bad;
	}

	salt = kzalloc(crypto_hash_digestsize(hash_tfm), GFP_KERNEL);
	if (!salt) {
		ti->error = "Error kmallocing salt storage in ESSIV";
		err = -ENOMEM;
		goto bad;
	}

	/* Allocate essiv_tfm */
	essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, CRYPTO_ALG_ASYNC);
	if (IS_ERR(essiv_tfm)) {
		ti->error = "Error allocating crypto tfm for ESSIV";
		err = PTR_ERR(essiv_tfm);
		goto bad;
	}
	if (crypto_cipher_blocksize(essiv_tfm) !=
	    crypto_ablkcipher_ivsize(cc->tfm)) {
		ti->error = "Block size of ESSIV cipher does "
			    "not match IV size of block cipher";
		err = -EINVAL;
		goto bad;
	}

	cc->iv_gen_private.essiv.salt = salt;
	cc->iv_gen_private.essiv.tfm = essiv_tfm;
	cc->iv_gen_private.essiv.hash_tfm = hash_tfm;

	return 0;

bad:
	if (essiv_tfm && !IS_ERR(essiv_tfm))
		crypto_free_cipher(essiv_tfm);
	if (hash_tfm && !IS_ERR(hash_tfm))
		crypto_free_hash(hash_tfm);
	kfree(salt);
	return err;
}

static void put_crypt_info(struct fscrypt_info *ci)
{
	if (!ci)
		return;

	crypto_free_skcipher(ci->ci_ctfm);
	crypto_free_cipher(ci->ci_essiv_tfm);
	kmem_cache_free(fscrypt_info_cachep, ci);
}

/*
 * WUSB Pseudo Random Function (WUSB1.0[6.5])
 *
 * @b: buffer to the source data; cannot be a global or const local
 *     (will confuse the scatterlists)
 */
ssize_t wusb_prf(void *out, size_t out_size,
		 const u8 key[16], const struct aes_ccm_nonce *_n,
		 const struct aes_ccm_label *a,
		 const void *b, size_t blen, size_t len)
{
	ssize_t result, bytes = 0, bitr;
	struct aes_ccm_nonce n = *_n;
	struct crypto_blkcipher *tfm_cbc;
	struct crypto_cipher *tfm_aes;
	u64 sfn = 0;
	__le64 sfn_le;

	tfm_cbc = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
	if (IS_ERR(tfm_cbc)) {
		result = PTR_ERR(tfm_cbc);
		printk(KERN_ERR "E: can't load CBC(AES): %d\n", (int)result);
		goto error_alloc_cbc;
	}
	result = crypto_blkcipher_setkey(tfm_cbc, key, 16);
	if (result < 0) {
		printk(KERN_ERR "E: can't set CBC key: %d\n", (int)result);
		goto error_setkey_cbc;
	}

	tfm_aes = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
	if (IS_ERR(tfm_aes)) {
		result = PTR_ERR(tfm_aes);
		printk(KERN_ERR "E: can't load AES: %d\n", (int)result);
		goto error_alloc_aes;
	}
	result = crypto_cipher_setkey(tfm_aes, key, 16);
	if (result < 0) {
		printk(KERN_ERR "E: can't set AES key: %d\n", (int)result);
		goto error_setkey_aes;
	}

	for (bitr = 0; bitr < (len + 63) / 64; bitr++) {
		sfn_le = cpu_to_le64(sfn++);
		memcpy(&n.sfn, &sfn_le, sizeof(n.sfn));	/* n.sfn++... */
		result = wusb_ccm_mac(tfm_cbc, tfm_aes, out + bytes,
				      &n, a, b, blen);
		if (result < 0)
			goto error_ccm_mac;
		bytes += result;
	}
	result = bytes;
error_ccm_mac:
error_setkey_aes:
	crypto_free_cipher(tfm_aes);
error_alloc_aes:
error_setkey_cbc:
	crypto_free_blkcipher(tfm_cbc);
error_alloc_cbc:
	return result;
}

static void crypt_iv_essiv_dtr(struct crypt_config *cc)
{
	struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;

	crypto_free_cipher(essiv->tfm);
	essiv->tfm = NULL;

	crypto_free_hash(essiv->hash_tfm);
	essiv->hash_tfm = NULL;

	kzfree(essiv->salt);
	essiv->salt = NULL;
}

static void __exit sbd_exit(void)
{
	del_gendisk(Device.gd);
	put_disk(Device.gd);
	unregister_blkdev(major_num, "sbd");
	blk_cleanup_queue(Queue);
	crypto_free_cipher(tfm);

	device_remove_file(&rd_root_dev, &dev_attr_key);
	device_unregister(&rd_root_dev);

	vfree(Device.data);
}

int wrapfs_read_lower(char *data, loff_t offset, size_t size,
                        struct inode *wrapfs_inode, struct file *file)
{
		struct file *lower_file;
        mm_segment_t fs_save;
        ssize_t rc;
	  mode_t previous_mode;

#ifdef WRAPFS_CRYPTO
	struct crypto_cipher *tfm;
	char *decrypted_page_buffer = NULL; // free this
#endif
      
	lower_file = wrapfs_lower_file(file);
        if (!lower_file)
                return -EIO;
        fs_save = get_fs();
        set_fs(get_ds());
	previous_mode = lower_file->f_mode;
	lower_file->f_mode |= FMODE_READ;
        rc = vfs_read(lower_file, data, size, &offset);
	lower_file->f_mode = previous_mode;

#ifdef WRAPFS_CRYPTO	
	decrypted_page_buffer = kmalloc(size, GFP_KERNEL);
	if (decrypted_page_buffer == NULL)
		goto out;		
	memset(decrypted_page_buffer, 0, size);
	
	tfm = crypto_alloc_cipher("aes", 0, 16);
	if (!IS_ERR(tfm))
		crypto_cipher_setkey(tfm, WRAPFS_SB(file->f_dentry->d_sb)->key, 16);
	else
		goto fail;

	crypto_cipher_decrypt_one(tfm, decrypted_page_buffer, data);
	
	/*printk(KERN_ALERT "Decrypted buffer = %s\n", decrypted_page_buffer);*/

	memcpy(data, decrypted_page_buffer, size);
#endif
        set_fs(fs_save);

#ifdef WRAPFS_CRYPTO
	crypto_free_cipher(tfm);
fail:
		kfree(decrypted_page_buffer);
out:
#endif
        return rc;
}

int wrapfs_write_lower_page_segment(struct inode *wrapfs_inode,
                                      struct page *page_for_lower,
                                      size_t offset_in_page, size_t size, 
                                      struct file *file)
{
        char *virt;
        loff_t offset;
        int rc = -1;

#ifdef WRAPFS_CRYPTO
        unsigned char *encrypted_page_buffer;
        struct crypto_cipher *tfm;
#endif

        offset = ((((loff_t)page_for_lower->index) << PAGE_CACHE_SHIFT)
                  + offset_in_page);
        virt = kmap(page_for_lower);

#ifdef WRAPFS_CRYPTO
        encrypted_page_buffer = kmalloc(size, GFP_KERNEL); //free this
		if (encrypted_page_buffer == NULL)
			goto out;		
        memset(encrypted_page_buffer, 0, size);

        tfm = crypto_alloc_cipher("aes", 0, 16);
        if (!IS_ERR(tfm))
                crypto_cipher_setkey(tfm, WRAPFS_SB(file->f_dentry->d_sb)->key, 16);
		else
				goto fail;

        crypto_cipher_encrypt_one(tfm, encrypted_page_buffer, virt);
        /*printk(KERN_ALERT "Encrypted buffer = %s\n", encrypted_page_buffer);*/
	    /*memcpy(virt, encrypted_page_buffer, size);*/

        rc = wrapfs_write_lower(wrapfs_inode, encrypted_page_buffer, offset, size, file);
#else
		rc = wrapfs_write_lower(wrapfs_inode, virt, offset, size, file);
#endif

        if (rc > 0)
                rc = 0;
        kunmap(page_for_lower);
#ifdef WRAPFS_CRYPTO
	crypto_free_cipher(tfm);
fail:
		kfree(encrypted_page_buffer);
out:
#endif
        return rc;
}

/* Replace the cipher instance, and free the old one when readers have
 * abandoned it.
 */
static void update_cipher(struct crypto_cipher **cipher_ptr,
			  struct crypto_cipher *new_cipher)
{
	struct crypto_cipher *old_cipher;

	/* Perform RCU update */
	spin_lock(&param_write_lock);
	old_cipher = *cipher_ptr;
	rcu_assign_pointer(*cipher_ptr, new_cipher);
	spin_unlock(&param_write_lock);

	/* Free the old cipher when ready. */
	synchronize_rcu();
	crypto_free_cipher(old_cipher);
}

static int param_set_cipher_key(const char *val, struct kernel_param *kp)
{
	struct crypto_cipher *new_cipher;
	int key_len;
	u8 key[128];
	int err = 0;

	/* Try to convert the user's key to raw bytes. */
	key_len = parse_hex_string(val, key, ARRAY_SIZE(key));
	if (key_len < 0) {
		printk(KERN_INFO "stubl: Can't parse key.\n");
		return key_len;
	}

	/* If the key is empty, then clear it. */
	if (key_len == 0) {
		printk(KERN_INFO "stubl: Clearing tunnel key.\n");
		update_cipher(kp->arg, NULL);
		return 0;
	} 

	printk(KERN_INFO "stubl: Setting tunnel key.\n");

	/* Init a new cipher */
	new_cipher = crypto_alloc_cipher("blowfish", 0, 0);
	if (IS_ERR(new_cipher)) {
		printk(KERN_INFO "stubl: Can't init cipher: %ld\n",
				PTR_ERR(new_cipher));
		return PTR_ERR(new_cipher);
	}

	/* Set key */
	err = crypto_cipher_setkey(new_cipher, key, key_len);
	if (err < 0) {
		printk(KERN_INFO "stubl: Can't set key: %d\n", err);
		crypto_free_cipher(new_cipher);
		return err;
	}

	/* Perform RCU update */
	update_cipher(kp->arg, new_cipher);

	return 0;
}

void aes_decrypt(u8 *cdata, u8 *pdata, u8 *key, int len)
{
	struct crypto_cipher *tfm;
	u8 *ptmp, *ctmp;
	int i;

	tfm = crypto_alloc_cipher("aes", 4, CRYPTO_ALG_ASYNC);

	ptmp = pdata;
	ctmp = cdata;
	for(i=0; i<len; i+=AES_BLOCK_SIZE)
	{
		crypto_cipher_decrypt_one(tfm, ptmp, ctmp);
		ptmp += AES_BLOCK_SIZE;
		ctmp += AES_BLOCK_SIZE;
	}

	crypto_free_cipher(tfm);
}