xref: /freebsd/sys/dev/cxgbe/crypto/t4_crypto.c (revision e4e041744071ffade1a1c5e08714ed1d5db8e6a6)
1 /*-
2  * Copyright (c) 2017 Chelsio Communications, Inc.
3  * All rights reserved.
4  * Written by: John Baldwin <jhb@FreeBSD.org>
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30 
31 #include <sys/types.h>
32 #include <sys/bus.h>
33 #include <sys/lock.h>
34 #include <sys/malloc.h>
35 #include <sys/mutex.h>
36 #include <sys/module.h>
37 #include <sys/sglist.h>
38 
39 #include <opencrypto/cryptodev.h>
40 #include <opencrypto/xform.h>
41 
42 #include "cryptodev_if.h"
43 
44 #include "common/common.h"
45 #include "crypto/t4_crypto.h"
46 
47 /*
48  * Requests consist of:
49  *
50  * +-------------------------------+
51  * | struct fw_crypto_lookaside_wr |
52  * +-------------------------------+
53  * | struct ulp_txpkt              |
54  * +-------------------------------+
55  * | struct ulptx_idata            |
56  * +-------------------------------+
57  * | struct cpl_tx_sec_pdu         |
58  * +-------------------------------+
59  * | struct cpl_tls_tx_scmd_fmt    |
60  * +-------------------------------+
61  * | key context header            |
62  * +-------------------------------+
63  * | AES key                       |  ----- For requests with AES
64  * +-------------------------------+
65  * | Hash state                    |  ----- For hash-only requests
66  * +-------------------------------+ -
67  * | IPAD (16-byte aligned)        |  \
68  * +-------------------------------+  +---- For requests with HMAC
69  * | OPAD (16-byte aligned)        |  /
70  * +-------------------------------+ -
71  * | GMAC H                        |  ----- For AES-GCM
72  * +-------------------------------+ -
73  * | struct cpl_rx_phys_dsgl       |  \
74  * +-------------------------------+  +---- Destination buffer for
75  * | PHYS_DSGL entries             |  /     non-hash-only requests
76  * +-------------------------------+ -
77  * | 16 dummy bytes                |  ----- Only for HMAC/hash-only requests
78  * +-------------------------------+
79  * | IV                            |  ----- If immediate IV
80  * +-------------------------------+
81  * | Payload                       |  ----- If immediate Payload
82  * +-------------------------------+ -
83  * | struct ulptx_sgl              |  \
84  * +-------------------------------+  +---- If payload via SGL
85  * | SGL entries                   |  /
86  * +-------------------------------+ -
87  *
88  * Note that the key context must be padded to ensure 16-byte alignment.
89  * For HMAC requests, the key consists of the partial hash of the IPAD
90  * followed by the partial hash of the OPAD.
91  *
92  * Replies consist of:
93  *
94  * +-------------------------------+
95  * | struct cpl_fw6_pld            |
96  * +-------------------------------+
97  * | hash digest                   |  ----- For HMAC request with
98  * +-------------------------------+        'hash_size' set in work request
99  *
100  * A 32-bit big-endian error status word is supplied in the last 4
101  * bytes of data[0] in the CPL_FW6_PLD message.  bit 0 indicates a
102  * "MAC" error and bit 1 indicates a "PAD" error.
103  *
104  * The 64-bit 'cookie' field from the fw_crypto_lookaside_wr message
105  * in the request is returned in data[1] of the CPL_FW6_PLD message.
106  *
107  * For block cipher replies, the updated IV is supplied in data[2] and
108  * data[3] of the CPL_FW6_PLD message.
109  *
110  * For hash replies where the work request set 'hash_size' to request
111  * a copy of the hash in the reply, the hash digest is supplied
112  * immediately following the CPL_FW6_PLD message.
113  */
114 
115 /*
116  * The crypto engine supports a maximum AAD size of 511 bytes.
117  */
118 #define	MAX_AAD_LEN		511
119 
120 /*
121  * The documentation for CPL_RX_PHYS_DSGL claims a maximum of 32 SG
122  * entries.  While the CPL includes a 16-bit length field, the T6 can
123  * sometimes hang if an error occurs while processing a request with a
124  * single DSGL entry larger than 2k.
125  */
126 #define	MAX_RX_PHYS_DSGL_SGE	32
127 #define	DSGL_SGE_MAXLEN		2048
128 
129 /*
130  * The adapter only supports requests with a total input or output
131  * length of 64k-1 or smaller.  Longer requests either result in hung
132  * requests or incorrect results.
133  */
134 #define	MAX_REQUEST_SIZE	65535
135 
136 static MALLOC_DEFINE(M_CCR, "ccr", "Chelsio T6 crypto");
137 
138 struct ccr_session_hmac {
139 	struct auth_hash *auth_hash;
140 	int hash_len;
141 	unsigned int partial_digest_len;
142 	unsigned int auth_mode;
143 	unsigned int mk_size;
144 	char pads[CHCR_HASH_MAX_BLOCK_SIZE_128 * 2];
145 };
146 
147 struct ccr_session_gmac {
148 	int hash_len;
149 	char ghash_h[GMAC_BLOCK_LEN];
150 };
151 
152 struct ccr_session_ccm_mac {
153 	int hash_len;
154 };
155 
156 struct ccr_session_blkcipher {
157 	unsigned int cipher_mode;
158 	unsigned int key_len;
159 	unsigned int iv_len;
160 	__be32 key_ctx_hdr;
161 	char enckey[CHCR_AES_MAX_KEY_LEN];
162 	char deckey[CHCR_AES_MAX_KEY_LEN];
163 };
164 
165 struct ccr_port {
166 	struct sge_wrq *txq;
167 	struct sge_rxq *rxq;
168 	int tx_channel_id;
169 	u_int active_sessions;
170 };
171 
172 struct ccr_session {
173 	bool active;
174 	int pending;
175 	enum { HASH, HMAC, BLKCIPHER, ETA, GCM, CCM } mode;
176 	struct ccr_port *port;
177 	union {
178 		struct ccr_session_hmac hmac;
179 		struct ccr_session_gmac gmac;
180 		struct ccr_session_ccm_mac ccm_mac;
181 	};
182 	struct ccr_session_blkcipher blkcipher;
183 };
184 
185 struct ccr_softc {
186 	struct adapter *adapter;
187 	device_t dev;
188 	uint32_t cid;
189 	struct mtx lock;
190 	bool detaching;
191 	struct ccr_port ports[MAX_NPORTS];
192 	u_int port_mask;
193 
194 	/*
195 	 * Pre-allocate S/G lists used when preparing a work request.
196 	 * 'sg_crp' contains an sglist describing the entire buffer
197 	 * for a 'struct cryptop'.  'sg_ulptx' is used to describe
198 	 * the data the engine should DMA as input via ULPTX_SGL.
199 	 * 'sg_dsgl' is used to describe the destination that cipher
200 	 * text and a tag should be written to.
201 	 */
202 	struct sglist *sg_crp;
203 	struct sglist *sg_ulptx;
204 	struct sglist *sg_dsgl;
205 
206 	/*
207 	 * Pre-allocate a dummy output buffer for the IV and AAD for
208 	 * AEAD requests.
209 	 */
210 	char *iv_aad_buf;
211 	struct sglist *sg_iv_aad;
212 
213 	/* Statistics. */
214 	uint64_t stats_blkcipher_encrypt;
215 	uint64_t stats_blkcipher_decrypt;
216 	uint64_t stats_hash;
217 	uint64_t stats_hmac;
218 	uint64_t stats_eta_encrypt;
219 	uint64_t stats_eta_decrypt;
220 	uint64_t stats_gcm_encrypt;
221 	uint64_t stats_gcm_decrypt;
222 	uint64_t stats_ccm_encrypt;
223 	uint64_t stats_ccm_decrypt;
224 	uint64_t stats_wr_nomem;
225 	uint64_t stats_inflight;
226 	uint64_t stats_mac_error;
227 	uint64_t stats_pad_error;
228 	uint64_t stats_bad_session;
229 	uint64_t stats_sglist_error;
230 	uint64_t stats_process_error;
231 	uint64_t stats_sw_fallback;
232 };
233 
234 /*
235  * Crypto requests involve two kind of scatter/gather lists.
236  *
237  * Non-hash-only requests require a PHYS_DSGL that describes the
238  * location to store the results of the encryption or decryption
239  * operation.  This SGL uses a different format (PHYS_DSGL) and should
240  * exclude the skip bytes at the start of the data as well as any AAD
241  * or IV.  For authenticated encryption requests it should include the
242  * destination of the hash or tag.
243  *
244  * The input payload may either be supplied inline as immediate data,
245  * or via a standard ULP_TX SGL.  This SGL should include AAD,
246  * ciphertext, and the hash or tag for authenticated decryption
247  * requests.
248  *
249  * These scatter/gather lists can describe different subsets of the
250  * buffer described by the crypto operation.  ccr_populate_sglist()
251  * generates a scatter/gather list that covers the entire crypto
252  * operation buffer that is then used to construct the other
253  * scatter/gather lists.
254  */
255 static int
256 ccr_populate_sglist(struct sglist *sg, struct cryptop *crp)
257 {
258 	int error;
259 
260 	sglist_reset(sg);
261 	switch (crp->crp_buf_type) {
262 	case CRYPTO_BUF_MBUF:
263 		error = sglist_append_mbuf(sg, crp->crp_mbuf);
264 		break;
265 	case CRYPTO_BUF_UIO:
266 		error = sglist_append_uio(sg, crp->crp_uio);
267 		break;
268 	case CRYPTO_BUF_CONTIG:
269 		error = sglist_append(sg, crp->crp_buf, crp->crp_ilen);
270 		break;
271 	default:
272 		error = EINVAL;
273 	}
274 	return (error);
275 }
276 
277 /*
278  * Segments in 'sg' larger than 'maxsegsize' are counted as multiple
279  * segments.
280  */
281 static int
282 ccr_count_sgl(struct sglist *sg, int maxsegsize)
283 {
284 	int i, nsegs;
285 
286 	nsegs = 0;
287 	for (i = 0; i < sg->sg_nseg; i++)
288 		nsegs += howmany(sg->sg_segs[i].ss_len, maxsegsize);
289 	return (nsegs);
290 }
291 
292 /* These functions deal with PHYS_DSGL for the reply buffer. */
293 static inline int
294 ccr_phys_dsgl_len(int nsegs)
295 {
296 	int len;
297 
298 	len = (nsegs / 8) * sizeof(struct phys_sge_pairs);
299 	if ((nsegs % 8) != 0) {
300 		len += sizeof(uint16_t) * 8;
301 		len += roundup2(nsegs % 8, 2) * sizeof(uint64_t);
302 	}
303 	return (len);
304 }
305 
306 static void
307 ccr_write_phys_dsgl(struct ccr_softc *sc, struct ccr_session *s, void *dst,
308     int nsegs)
309 {
310 	struct sglist *sg;
311 	struct cpl_rx_phys_dsgl *cpl;
312 	struct phys_sge_pairs *sgl;
313 	vm_paddr_t paddr;
314 	size_t seglen;
315 	u_int i, j;
316 
317 	sg = sc->sg_dsgl;
318 	cpl = dst;
319 	cpl->op_to_tid = htobe32(V_CPL_RX_PHYS_DSGL_OPCODE(CPL_RX_PHYS_DSGL) |
320 	    V_CPL_RX_PHYS_DSGL_ISRDMA(0));
321 	cpl->pcirlxorder_to_noofsgentr = htobe32(
322 	    V_CPL_RX_PHYS_DSGL_PCIRLXORDER(0) |
323 	    V_CPL_RX_PHYS_DSGL_PCINOSNOOP(0) |
324 	    V_CPL_RX_PHYS_DSGL_PCITPHNTENB(0) | V_CPL_RX_PHYS_DSGL_DCAID(0) |
325 	    V_CPL_RX_PHYS_DSGL_NOOFSGENTR(nsegs));
326 	cpl->rss_hdr_int.opcode = CPL_RX_PHYS_ADDR;
327 	cpl->rss_hdr_int.qid = htobe16(s->port->rxq->iq.abs_id);
328 	cpl->rss_hdr_int.hash_val = 0;
329 	sgl = (struct phys_sge_pairs *)(cpl + 1);
330 	j = 0;
331 	for (i = 0; i < sg->sg_nseg; i++) {
332 		seglen = sg->sg_segs[i].ss_len;
333 		paddr = sg->sg_segs[i].ss_paddr;
334 		do {
335 			sgl->addr[j] = htobe64(paddr);
336 			if (seglen > DSGL_SGE_MAXLEN) {
337 				sgl->len[j] = htobe16(DSGL_SGE_MAXLEN);
338 				paddr += DSGL_SGE_MAXLEN;
339 				seglen -= DSGL_SGE_MAXLEN;
340 			} else {
341 				sgl->len[j] = htobe16(seglen);
342 				seglen = 0;
343 			}
344 			j++;
345 			if (j == 8) {
346 				sgl++;
347 				j = 0;
348 			}
349 		} while (seglen != 0);
350 	}
351 	MPASS(j + 8 * (sgl - (struct phys_sge_pairs *)(cpl + 1)) == nsegs);
352 }
353 
354 /* These functions deal with the ULPTX_SGL for input payload. */
355 static inline int
356 ccr_ulptx_sgl_len(int nsegs)
357 {
358 	u_int n;
359 
360 	nsegs--; /* first segment is part of ulptx_sgl */
361 	n = sizeof(struct ulptx_sgl) + 8 * ((3 * nsegs) / 2 + (nsegs & 1));
362 	return (roundup2(n, 16));
363 }
364 
365 static void
366 ccr_write_ulptx_sgl(struct ccr_softc *sc, void *dst, int nsegs)
367 {
368 	struct ulptx_sgl *usgl;
369 	struct sglist *sg;
370 	struct sglist_seg *ss;
371 	int i;
372 
373 	sg = sc->sg_ulptx;
374 	MPASS(nsegs == sg->sg_nseg);
375 	ss = &sg->sg_segs[0];
376 	usgl = dst;
377 	usgl->cmd_nsge = htobe32(V_ULPTX_CMD(ULP_TX_SC_DSGL) |
378 	    V_ULPTX_NSGE(nsegs));
379 	usgl->len0 = htobe32(ss->ss_len);
380 	usgl->addr0 = htobe64(ss->ss_paddr);
381 	ss++;
382 	for (i = 0; i < sg->sg_nseg - 1; i++) {
383 		usgl->sge[i / 2].len[i & 1] = htobe32(ss->ss_len);
384 		usgl->sge[i / 2].addr[i & 1] = htobe64(ss->ss_paddr);
385 		ss++;
386 	}
387 
388 }
389 
390 static bool
391 ccr_use_imm_data(u_int transhdr_len, u_int input_len)
392 {
393 
394 	if (input_len > CRYPTO_MAX_IMM_TX_PKT_LEN)
395 		return (false);
396 	if (roundup2(transhdr_len, 16) + roundup2(input_len, 16) >
397 	    SGE_MAX_WR_LEN)
398 		return (false);
399 	return (true);
400 }
401 
402 static void
403 ccr_populate_wreq(struct ccr_softc *sc, struct ccr_session *s,
404     struct chcr_wr *crwr, u_int kctx_len, u_int wr_len, u_int imm_len,
405     u_int sgl_len, u_int hash_size, struct cryptop *crp)
406 {
407 	u_int cctx_size, idata_len;
408 
409 	cctx_size = sizeof(struct _key_ctx) + kctx_len;
410 	crwr->wreq.op_to_cctx_size = htobe32(
411 	    V_FW_CRYPTO_LOOKASIDE_WR_OPCODE(FW_CRYPTO_LOOKASIDE_WR) |
412 	    V_FW_CRYPTO_LOOKASIDE_WR_COMPL(0) |
413 	    V_FW_CRYPTO_LOOKASIDE_WR_IMM_LEN(imm_len) |
414 	    V_FW_CRYPTO_LOOKASIDE_WR_CCTX_LOC(1) |
415 	    V_FW_CRYPTO_LOOKASIDE_WR_CCTX_SIZE(cctx_size >> 4));
416 	crwr->wreq.len16_pkd = htobe32(
417 	    V_FW_CRYPTO_LOOKASIDE_WR_LEN16(wr_len / 16));
418 	crwr->wreq.session_id = 0;
419 	crwr->wreq.rx_chid_to_rx_q_id = htobe32(
420 	    V_FW_CRYPTO_LOOKASIDE_WR_RX_CHID(s->port->tx_channel_id) |
421 	    V_FW_CRYPTO_LOOKASIDE_WR_LCB(0) |
422 	    V_FW_CRYPTO_LOOKASIDE_WR_PHASH(0) |
423 	    V_FW_CRYPTO_LOOKASIDE_WR_IV(IV_NOP) |
424 	    V_FW_CRYPTO_LOOKASIDE_WR_FQIDX(0) |
425 	    V_FW_CRYPTO_LOOKASIDE_WR_TX_CH(0) |
426 	    V_FW_CRYPTO_LOOKASIDE_WR_RX_Q_ID(s->port->rxq->iq.abs_id));
427 	crwr->wreq.key_addr = 0;
428 	crwr->wreq.pld_size_hash_size = htobe32(
429 	    V_FW_CRYPTO_LOOKASIDE_WR_PLD_SIZE(sgl_len) |
430 	    V_FW_CRYPTO_LOOKASIDE_WR_HASH_SIZE(hash_size));
431 	crwr->wreq.cookie = htobe64((uintptr_t)crp);
432 
433 	crwr->ulptx.cmd_dest = htobe32(V_ULPTX_CMD(ULP_TX_PKT) |
434 	    V_ULP_TXPKT_DATAMODIFY(0) |
435 	    V_ULP_TXPKT_CHANNELID(s->port->tx_channel_id) |
436 	    V_ULP_TXPKT_DEST(0) |
437 	    V_ULP_TXPKT_FID(s->port->rxq->iq.abs_id) | V_ULP_TXPKT_RO(1));
438 	crwr->ulptx.len = htobe32(
439 	    ((wr_len - sizeof(struct fw_crypto_lookaside_wr)) / 16));
440 
441 	crwr->sc_imm.cmd_more = htobe32(V_ULPTX_CMD(ULP_TX_SC_IMM) |
442 	    V_ULP_TX_SC_MORE(sgl_len != 0 ? 1 : 0));
443 	idata_len = wr_len - offsetof(struct chcr_wr, sec_cpl) - sgl_len;
444 	if (imm_len % 16 != 0)
445 		idata_len -= 16 - imm_len % 16;
446 	crwr->sc_imm.len = htobe32(idata_len);
447 }
448 
449 static int
450 ccr_hash(struct ccr_softc *sc, struct ccr_session *s, struct cryptop *crp)
451 {
452 	struct chcr_wr *crwr;
453 	struct wrqe *wr;
454 	struct auth_hash *axf;
455 	char *dst;
456 	u_int hash_size_in_response, kctx_flits, kctx_len, transhdr_len, wr_len;
457 	u_int hmac_ctrl, imm_len, iopad_size;
458 	int error, sgl_nsegs, sgl_len, use_opad;
459 
460 	/* Reject requests with too large of an input buffer. */
461 	if (crp->crp_payload_length > MAX_REQUEST_SIZE)
462 		return (EFBIG);
463 
464 	axf = s->hmac.auth_hash;
465 
466 	if (s->mode == HMAC) {
467 		use_opad = 1;
468 		hmac_ctrl = SCMD_HMAC_CTRL_NO_TRUNC;
469 	} else {
470 		use_opad = 0;
471 		hmac_ctrl = SCMD_HMAC_CTRL_NOP;
472 	}
473 
474 	/* PADs must be 128-bit aligned. */
475 	iopad_size = roundup2(s->hmac.partial_digest_len, 16);
476 
477 	/*
478 	 * The 'key' part of the context includes the aligned IPAD and
479 	 * OPAD.
480 	 */
481 	kctx_len = iopad_size;
482 	if (use_opad)
483 		kctx_len += iopad_size;
484 	hash_size_in_response = axf->hashsize;
485 	transhdr_len = HASH_TRANSHDR_SIZE(kctx_len);
486 
487 	if (crp->crp_payload_length == 0) {
488 		imm_len = axf->blocksize;
489 		sgl_nsegs = 0;
490 		sgl_len = 0;
491 	} else if (ccr_use_imm_data(transhdr_len, crp->crp_payload_length)) {
492 		imm_len = crp->crp_payload_length;
493 		sgl_nsegs = 0;
494 		sgl_len = 0;
495 	} else {
496 		imm_len = 0;
497 		sglist_reset(sc->sg_ulptx);
498 		error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
499 		    crp->crp_payload_start, crp->crp_payload_length);
500 		if (error)
501 			return (error);
502 		sgl_nsegs = sc->sg_ulptx->sg_nseg;
503 		sgl_len = ccr_ulptx_sgl_len(sgl_nsegs);
504 	}
505 
506 	wr_len = roundup2(transhdr_len, 16) + roundup2(imm_len, 16) + sgl_len;
507 	if (wr_len > SGE_MAX_WR_LEN)
508 		return (EFBIG);
509 	wr = alloc_wrqe(wr_len, s->port->txq);
510 	if (wr == NULL) {
511 		sc->stats_wr_nomem++;
512 		return (ENOMEM);
513 	}
514 	crwr = wrtod(wr);
515 	memset(crwr, 0, wr_len);
516 
517 	ccr_populate_wreq(sc, s, crwr, kctx_len, wr_len, imm_len, sgl_len,
518 	    hash_size_in_response, crp);
519 
520 	crwr->sec_cpl.op_ivinsrtofst = htobe32(
521 	    V_CPL_TX_SEC_PDU_OPCODE(CPL_TX_SEC_PDU) |
522 	    V_CPL_TX_SEC_PDU_RXCHID(s->port->tx_channel_id) |
523 	    V_CPL_TX_SEC_PDU_ACKFOLLOWS(0) | V_CPL_TX_SEC_PDU_ULPTXLPBK(1) |
524 	    V_CPL_TX_SEC_PDU_CPLLEN(2) | V_CPL_TX_SEC_PDU_PLACEHOLDER(0) |
525 	    V_CPL_TX_SEC_PDU_IVINSRTOFST(0));
526 
527 	crwr->sec_cpl.pldlen = htobe32(crp->crp_payload_length == 0 ?
528 	    axf->blocksize : crp->crp_payload_length);
529 
530 	crwr->sec_cpl.cipherstop_lo_authinsert = htobe32(
531 	    V_CPL_TX_SEC_PDU_AUTHSTART(1) | V_CPL_TX_SEC_PDU_AUTHSTOP(0));
532 
533 	/* These two flits are actually a CPL_TLS_TX_SCMD_FMT. */
534 	crwr->sec_cpl.seqno_numivs = htobe32(
535 	    V_SCMD_SEQ_NO_CTRL(0) |
536 	    V_SCMD_PROTO_VERSION(SCMD_PROTO_VERSION_GENERIC) |
537 	    V_SCMD_CIPH_MODE(SCMD_CIPH_MODE_NOP) |
538 	    V_SCMD_AUTH_MODE(s->hmac.auth_mode) |
539 	    V_SCMD_HMAC_CTRL(hmac_ctrl));
540 	crwr->sec_cpl.ivgen_hdrlen = htobe32(
541 	    V_SCMD_LAST_FRAG(0) |
542 	    V_SCMD_MORE_FRAGS(crp->crp_payload_length == 0 ? 1 : 0) |
543 	    V_SCMD_MAC_ONLY(1));
544 
545 	memcpy(crwr->key_ctx.key, s->hmac.pads, kctx_len);
546 
547 	/* XXX: F_KEY_CONTEXT_SALT_PRESENT set, but 'salt' not set. */
548 	kctx_flits = (sizeof(struct _key_ctx) + kctx_len) / 16;
549 	crwr->key_ctx.ctx_hdr = htobe32(V_KEY_CONTEXT_CTX_LEN(kctx_flits) |
550 	    V_KEY_CONTEXT_OPAD_PRESENT(use_opad) |
551 	    V_KEY_CONTEXT_SALT_PRESENT(1) |
552 	    V_KEY_CONTEXT_CK_SIZE(CHCR_KEYCTX_NO_KEY) |
553 	    V_KEY_CONTEXT_MK_SIZE(s->hmac.mk_size) | V_KEY_CONTEXT_VALID(1));
554 
555 	dst = (char *)(crwr + 1) + kctx_len + DUMMY_BYTES;
556 	if (crp->crp_payload_length == 0) {
557 		dst[0] = 0x80;
558 		if (s->mode == HMAC)
559 			*(uint64_t *)(dst + axf->blocksize - sizeof(uint64_t)) =
560 			    htobe64(axf->blocksize << 3);
561 	} else if (imm_len != 0)
562 		crypto_copydata(crp, crp->crp_payload_start,
563 		    crp->crp_payload_length, dst);
564 	else
565 		ccr_write_ulptx_sgl(sc, dst, sgl_nsegs);
566 
567 	/* XXX: TODO backpressure */
568 	t4_wrq_tx(sc->adapter, wr);
569 
570 	return (0);
571 }
572 
573 static int
574 ccr_hash_done(struct ccr_softc *sc, struct ccr_session *s, struct cryptop *crp,
575     const struct cpl_fw6_pld *cpl, int error)
576 {
577 	uint8_t hash[HASH_MAX_LEN];
578 
579 	if (error)
580 		return (error);
581 
582 	if (crp->crp_op & CRYPTO_OP_VERIFY_DIGEST) {
583 		crypto_copydata(crp, crp->crp_digest_start, s->hmac.hash_len,
584 		    hash);
585 		if (timingsafe_bcmp((cpl + 1), hash, s->hmac.hash_len) != 0)
586 			return (EBADMSG);
587 	} else
588 		crypto_copyback(crp, crp->crp_digest_start, s->hmac.hash_len,
589 		    (cpl + 1));
590 	return (0);
591 }
592 
593 static int
594 ccr_blkcipher(struct ccr_softc *sc, struct ccr_session *s, struct cryptop *crp)
595 {
596 	char iv[CHCR_MAX_CRYPTO_IV_LEN];
597 	struct chcr_wr *crwr;
598 	struct wrqe *wr;
599 	char *dst;
600 	u_int kctx_len, key_half, op_type, transhdr_len, wr_len;
601 	u_int imm_len, iv_len;
602 	int dsgl_nsegs, dsgl_len;
603 	int sgl_nsegs, sgl_len;
604 	int error;
605 
606 	if (s->blkcipher.key_len == 0 || crp->crp_payload_length == 0)
607 		return (EINVAL);
608 	if (s->blkcipher.cipher_mode == SCMD_CIPH_MODE_AES_CBC &&
609 	    (crp->crp_payload_length % AES_BLOCK_LEN) != 0)
610 		return (EINVAL);
611 
612 	/* Reject requests with too large of an input buffer. */
613 	if (crp->crp_payload_length > MAX_REQUEST_SIZE)
614 		return (EFBIG);
615 
616 	if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
617 		op_type = CHCR_ENCRYPT_OP;
618 	else
619 		op_type = CHCR_DECRYPT_OP;
620 
621 	sglist_reset(sc->sg_dsgl);
622 	error = sglist_append_sglist(sc->sg_dsgl, sc->sg_crp,
623 	    crp->crp_payload_start, crp->crp_payload_length);
624 	if (error)
625 		return (error);
626 	dsgl_nsegs = ccr_count_sgl(sc->sg_dsgl, DSGL_SGE_MAXLEN);
627 	if (dsgl_nsegs > MAX_RX_PHYS_DSGL_SGE)
628 		return (EFBIG);
629 	dsgl_len = ccr_phys_dsgl_len(dsgl_nsegs);
630 
631 	/* The 'key' must be 128-bit aligned. */
632 	kctx_len = roundup2(s->blkcipher.key_len, 16);
633 	transhdr_len = CIPHER_TRANSHDR_SIZE(kctx_len, dsgl_len);
634 
635 	/* For AES-XTS we send a 16-byte IV in the work request. */
636 	if (s->blkcipher.cipher_mode == SCMD_CIPH_MODE_AES_XTS)
637 		iv_len = AES_BLOCK_LEN;
638 	else
639 		iv_len = s->blkcipher.iv_len;
640 
641 	if (ccr_use_imm_data(transhdr_len, crp->crp_payload_length + iv_len)) {
642 		imm_len = crp->crp_payload_length;
643 		sgl_nsegs = 0;
644 		sgl_len = 0;
645 	} else {
646 		imm_len = 0;
647 		sglist_reset(sc->sg_ulptx);
648 		error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
649 		    crp->crp_payload_start, crp->crp_payload_length);
650 		if (error)
651 			return (error);
652 		sgl_nsegs = sc->sg_ulptx->sg_nseg;
653 		sgl_len = ccr_ulptx_sgl_len(sgl_nsegs);
654 	}
655 
656 	wr_len = roundup2(transhdr_len, 16) + iv_len +
657 	    roundup2(imm_len, 16) + sgl_len;
658 	if (wr_len > SGE_MAX_WR_LEN)
659 		return (EFBIG);
660 	wr = alloc_wrqe(wr_len, s->port->txq);
661 	if (wr == NULL) {
662 		sc->stats_wr_nomem++;
663 		return (ENOMEM);
664 	}
665 	crwr = wrtod(wr);
666 	memset(crwr, 0, wr_len);
667 
668 	crypto_read_iv(crp, iv);
669 
670 	/* Zero the remainder of the IV for AES-XTS. */
671 	memset(iv + s->blkcipher.iv_len, 0, iv_len - s->blkcipher.iv_len);
672 
673 	ccr_populate_wreq(sc, s, crwr, kctx_len, wr_len, imm_len, sgl_len, 0,
674 	    crp);
675 
676 	crwr->sec_cpl.op_ivinsrtofst = htobe32(
677 	    V_CPL_TX_SEC_PDU_OPCODE(CPL_TX_SEC_PDU) |
678 	    V_CPL_TX_SEC_PDU_RXCHID(s->port->tx_channel_id) |
679 	    V_CPL_TX_SEC_PDU_ACKFOLLOWS(0) | V_CPL_TX_SEC_PDU_ULPTXLPBK(1) |
680 	    V_CPL_TX_SEC_PDU_CPLLEN(2) | V_CPL_TX_SEC_PDU_PLACEHOLDER(0) |
681 	    V_CPL_TX_SEC_PDU_IVINSRTOFST(1));
682 
683 	crwr->sec_cpl.pldlen = htobe32(iv_len + crp->crp_payload_length);
684 
685 	crwr->sec_cpl.aadstart_cipherstop_hi = htobe32(
686 	    V_CPL_TX_SEC_PDU_CIPHERSTART(iv_len + 1) |
687 	    V_CPL_TX_SEC_PDU_CIPHERSTOP_HI(0));
688 	crwr->sec_cpl.cipherstop_lo_authinsert = htobe32(
689 	    V_CPL_TX_SEC_PDU_CIPHERSTOP_LO(0));
690 
691 	/* These two flits are actually a CPL_TLS_TX_SCMD_FMT. */
692 	crwr->sec_cpl.seqno_numivs = htobe32(
693 	    V_SCMD_SEQ_NO_CTRL(0) |
694 	    V_SCMD_PROTO_VERSION(SCMD_PROTO_VERSION_GENERIC) |
695 	    V_SCMD_ENC_DEC_CTRL(op_type) |
696 	    V_SCMD_CIPH_MODE(s->blkcipher.cipher_mode) |
697 	    V_SCMD_AUTH_MODE(SCMD_AUTH_MODE_NOP) |
698 	    V_SCMD_HMAC_CTRL(SCMD_HMAC_CTRL_NOP) |
699 	    V_SCMD_IV_SIZE(iv_len / 2) |
700 	    V_SCMD_NUM_IVS(0));
701 	crwr->sec_cpl.ivgen_hdrlen = htobe32(
702 	    V_SCMD_IV_GEN_CTRL(0) |
703 	    V_SCMD_MORE_FRAGS(0) | V_SCMD_LAST_FRAG(0) | V_SCMD_MAC_ONLY(0) |
704 	    V_SCMD_AADIVDROP(1) | V_SCMD_HDR_LEN(dsgl_len));
705 
706 	crwr->key_ctx.ctx_hdr = s->blkcipher.key_ctx_hdr;
707 	switch (s->blkcipher.cipher_mode) {
708 	case SCMD_CIPH_MODE_AES_CBC:
709 		if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
710 			memcpy(crwr->key_ctx.key, s->blkcipher.enckey,
711 			    s->blkcipher.key_len);
712 		else
713 			memcpy(crwr->key_ctx.key, s->blkcipher.deckey,
714 			    s->blkcipher.key_len);
715 		break;
716 	case SCMD_CIPH_MODE_AES_CTR:
717 		memcpy(crwr->key_ctx.key, s->blkcipher.enckey,
718 		    s->blkcipher.key_len);
719 		break;
720 	case SCMD_CIPH_MODE_AES_XTS:
721 		key_half = s->blkcipher.key_len / 2;
722 		memcpy(crwr->key_ctx.key, s->blkcipher.enckey + key_half,
723 		    key_half);
724 		if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
725 			memcpy(crwr->key_ctx.key + key_half,
726 			    s->blkcipher.enckey, key_half);
727 		else
728 			memcpy(crwr->key_ctx.key + key_half,
729 			    s->blkcipher.deckey, key_half);
730 		break;
731 	}
732 
733 	dst = (char *)(crwr + 1) + kctx_len;
734 	ccr_write_phys_dsgl(sc, s, dst, dsgl_nsegs);
735 	dst += sizeof(struct cpl_rx_phys_dsgl) + dsgl_len;
736 	memcpy(dst, iv, iv_len);
737 	dst += iv_len;
738 	if (imm_len != 0)
739 		crypto_copydata(crp, crp->crp_payload_start,
740 		    crp->crp_payload_length, dst);
741 	else
742 		ccr_write_ulptx_sgl(sc, dst, sgl_nsegs);
743 
744 	/* XXX: TODO backpressure */
745 	t4_wrq_tx(sc->adapter, wr);
746 
747 	return (0);
748 }
749 
750 static int
751 ccr_blkcipher_done(struct ccr_softc *sc, struct ccr_session *s,
752     struct cryptop *crp, const struct cpl_fw6_pld *cpl, int error)
753 {
754 
755 	/*
756 	 * The updated IV to permit chained requests is at
757 	 * cpl->data[2], but OCF doesn't permit chained requests.
758 	 */
759 	return (error);
760 }
761 
762 /*
763  * 'hashsize' is the length of a full digest.  'authsize' is the
764  * requested digest length for this operation which may be less
765  * than 'hashsize'.
766  */
767 static int
768 ccr_hmac_ctrl(unsigned int hashsize, unsigned int authsize)
769 {
770 
771 	if (authsize == 10)
772 		return (SCMD_HMAC_CTRL_TRUNC_RFC4366);
773 	if (authsize == 12)
774 		return (SCMD_HMAC_CTRL_IPSEC_96BIT);
775 	if (authsize == hashsize / 2)
776 		return (SCMD_HMAC_CTRL_DIV2);
777 	return (SCMD_HMAC_CTRL_NO_TRUNC);
778 }
779 
780 static int
781 ccr_eta(struct ccr_softc *sc, struct ccr_session *s, struct cryptop *crp)
782 {
783 	char iv[CHCR_MAX_CRYPTO_IV_LEN];
784 	struct chcr_wr *crwr;
785 	struct wrqe *wr;
786 	struct auth_hash *axf;
787 	char *dst;
788 	u_int kctx_len, key_half, op_type, transhdr_len, wr_len;
789 	u_int hash_size_in_response, imm_len, iopad_size, iv_len;
790 	u_int aad_start, aad_stop;
791 	u_int auth_insert;
792 	u_int cipher_start, cipher_stop;
793 	u_int hmac_ctrl, input_len;
794 	int dsgl_nsegs, dsgl_len;
795 	int sgl_nsegs, sgl_len;
796 	int error;
797 
798 	/*
799 	 * If there is a need in the future, requests with an empty
800 	 * payload could be supported as HMAC-only requests.
801 	 */
802 	if (s->blkcipher.key_len == 0 || crp->crp_payload_length == 0)
803 		return (EINVAL);
804 	if (s->blkcipher.cipher_mode == SCMD_CIPH_MODE_AES_CBC &&
805 	    (crp->crp_payload_length % AES_BLOCK_LEN) != 0)
806 		return (EINVAL);
807 
808 	/* For AES-XTS we send a 16-byte IV in the work request. */
809 	if (s->blkcipher.cipher_mode == SCMD_CIPH_MODE_AES_XTS)
810 		iv_len = AES_BLOCK_LEN;
811 	else
812 		iv_len = s->blkcipher.iv_len;
813 
814 	if (crp->crp_aad_length + iv_len > MAX_AAD_LEN)
815 		return (EINVAL);
816 
817 	axf = s->hmac.auth_hash;
818 	hash_size_in_response = s->hmac.hash_len;
819 	if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
820 		op_type = CHCR_ENCRYPT_OP;
821 	else
822 		op_type = CHCR_DECRYPT_OP;
823 
824 	/*
825 	 * The output buffer consists of the cipher text followed by
826 	 * the hash when encrypting.  For decryption it only contains
827 	 * the plain text.
828 	 *
829 	 * Due to a firmware bug, the output buffer must include a
830 	 * dummy output buffer for the IV and AAD prior to the real
831 	 * output buffer.
832 	 */
833 	if (op_type == CHCR_ENCRYPT_OP) {
834 		if (iv_len + crp->crp_aad_length + crp->crp_payload_length +
835 		    hash_size_in_response > MAX_REQUEST_SIZE)
836 			return (EFBIG);
837 	} else {
838 		if (iv_len + crp->crp_aad_length + crp->crp_payload_length >
839 		    MAX_REQUEST_SIZE)
840 			return (EFBIG);
841 	}
842 	sglist_reset(sc->sg_dsgl);
843 	error = sglist_append_sglist(sc->sg_dsgl, sc->sg_iv_aad, 0,
844 	    iv_len + crp->crp_aad_length);
845 	if (error)
846 		return (error);
847 	error = sglist_append_sglist(sc->sg_dsgl, sc->sg_crp,
848 	    crp->crp_payload_start, crp->crp_payload_length);
849 	if (error)
850 		return (error);
851 	if (op_type == CHCR_ENCRYPT_OP) {
852 		error = sglist_append_sglist(sc->sg_dsgl, sc->sg_crp,
853 		    crp->crp_digest_start, hash_size_in_response);
854 		if (error)
855 			return (error);
856 	}
857 	dsgl_nsegs = ccr_count_sgl(sc->sg_dsgl, DSGL_SGE_MAXLEN);
858 	if (dsgl_nsegs > MAX_RX_PHYS_DSGL_SGE)
859 		return (EFBIG);
860 	dsgl_len = ccr_phys_dsgl_len(dsgl_nsegs);
861 
862 	/* PADs must be 128-bit aligned. */
863 	iopad_size = roundup2(s->hmac.partial_digest_len, 16);
864 
865 	/*
866 	 * The 'key' part of the key context consists of the key followed
867 	 * by the IPAD and OPAD.
868 	 */
869 	kctx_len = roundup2(s->blkcipher.key_len, 16) + iopad_size * 2;
870 	transhdr_len = CIPHER_TRANSHDR_SIZE(kctx_len, dsgl_len);
871 
872 	/*
873 	 * The input buffer consists of the IV, any AAD, and then the
874 	 * cipher/plain text.  For decryption requests the hash is
875 	 * appended after the cipher text.
876 	 *
877 	 * The IV is always stored at the start of the input buffer
878 	 * even though it may be duplicated in the payload.  The
879 	 * crypto engine doesn't work properly if the IV offset points
880 	 * inside of the AAD region, so a second copy is always
881 	 * required.
882 	 */
883 	input_len = crp->crp_aad_length + crp->crp_payload_length;
884 
885 	/*
886 	 * The firmware hangs if sent a request which is a
887 	 * bit smaller than MAX_REQUEST_SIZE.  In particular, the
888 	 * firmware appears to require 512 - 16 bytes of spare room
889 	 * along with the size of the hash even if the hash isn't
890 	 * included in the input buffer.
891 	 */
892 	if (input_len + roundup2(axf->hashsize, 16) + (512 - 16) >
893 	    MAX_REQUEST_SIZE)
894 		return (EFBIG);
895 	if (op_type == CHCR_DECRYPT_OP)
896 		input_len += hash_size_in_response;
897 
898 	if (ccr_use_imm_data(transhdr_len, iv_len + input_len)) {
899 		imm_len = input_len;
900 		sgl_nsegs = 0;
901 		sgl_len = 0;
902 	} else {
903 		imm_len = 0;
904 		sglist_reset(sc->sg_ulptx);
905 		if (crp->crp_aad_length != 0) {
906 			error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
907 			    crp->crp_aad_start, crp->crp_aad_length);
908 			if (error)
909 				return (error);
910 		}
911 		error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
912 		    crp->crp_payload_start, crp->crp_payload_length);
913 		if (error)
914 			return (error);
915 		if (op_type == CHCR_DECRYPT_OP) {
916 			error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
917 			    crp->crp_digest_start, hash_size_in_response);
918 			if (error)
919 				return (error);
920 		}
921 		sgl_nsegs = sc->sg_ulptx->sg_nseg;
922 		sgl_len = ccr_ulptx_sgl_len(sgl_nsegs);
923 	}
924 
925 	/*
926 	 * Any auth-only data before the cipher region is marked as AAD.
927 	 * Auth-data that overlaps with the cipher region is placed in
928 	 * the auth section.
929 	 */
930 	if (crp->crp_aad_length != 0) {
931 		aad_start = iv_len + 1;
932 		aad_stop = aad_start + crp->crp_aad_length - 1;
933 	} else {
934 		aad_start = 0;
935 		aad_stop = 0;
936 	}
937 	cipher_start = iv_len + crp->crp_aad_length + 1;
938 	if (op_type == CHCR_DECRYPT_OP)
939 		cipher_stop = hash_size_in_response;
940 	else
941 		cipher_stop = 0;
942 	if (op_type == CHCR_DECRYPT_OP)
943 		auth_insert = hash_size_in_response;
944 	else
945 		auth_insert = 0;
946 
947 	wr_len = roundup2(transhdr_len, 16) + iv_len + roundup2(imm_len, 16) +
948 	    sgl_len;
949 	if (wr_len > SGE_MAX_WR_LEN)
950 		return (EFBIG);
951 	wr = alloc_wrqe(wr_len, s->port->txq);
952 	if (wr == NULL) {
953 		sc->stats_wr_nomem++;
954 		return (ENOMEM);
955 	}
956 	crwr = wrtod(wr);
957 	memset(crwr, 0, wr_len);
958 
959 	crypto_read_iv(crp, iv);
960 
961 	/* Zero the remainder of the IV for AES-XTS. */
962 	memset(iv + s->blkcipher.iv_len, 0, iv_len - s->blkcipher.iv_len);
963 
964 	ccr_populate_wreq(sc, s, crwr, kctx_len, wr_len, imm_len, sgl_len,
965 	    op_type == CHCR_DECRYPT_OP ? hash_size_in_response : 0, crp);
966 
967 	crwr->sec_cpl.op_ivinsrtofst = htobe32(
968 	    V_CPL_TX_SEC_PDU_OPCODE(CPL_TX_SEC_PDU) |
969 	    V_CPL_TX_SEC_PDU_RXCHID(s->port->tx_channel_id) |
970 	    V_CPL_TX_SEC_PDU_ACKFOLLOWS(0) | V_CPL_TX_SEC_PDU_ULPTXLPBK(1) |
971 	    V_CPL_TX_SEC_PDU_CPLLEN(2) | V_CPL_TX_SEC_PDU_PLACEHOLDER(0) |
972 	    V_CPL_TX_SEC_PDU_IVINSRTOFST(1));
973 
974 	crwr->sec_cpl.pldlen = htobe32(iv_len + input_len);
975 
976 	crwr->sec_cpl.aadstart_cipherstop_hi = htobe32(
977 	    V_CPL_TX_SEC_PDU_AADSTART(aad_start) |
978 	    V_CPL_TX_SEC_PDU_AADSTOP(aad_stop) |
979 	    V_CPL_TX_SEC_PDU_CIPHERSTART(cipher_start) |
980 	    V_CPL_TX_SEC_PDU_CIPHERSTOP_HI(cipher_stop >> 4));
981 	crwr->sec_cpl.cipherstop_lo_authinsert = htobe32(
982 	    V_CPL_TX_SEC_PDU_CIPHERSTOP_LO(cipher_stop & 0xf) |
983 	    V_CPL_TX_SEC_PDU_AUTHSTART(cipher_start) |
984 	    V_CPL_TX_SEC_PDU_AUTHSTOP(cipher_stop) |
985 	    V_CPL_TX_SEC_PDU_AUTHINSERT(auth_insert));
986 
987 	/* These two flits are actually a CPL_TLS_TX_SCMD_FMT. */
988 	hmac_ctrl = ccr_hmac_ctrl(axf->hashsize, hash_size_in_response);
989 	crwr->sec_cpl.seqno_numivs = htobe32(
990 	    V_SCMD_SEQ_NO_CTRL(0) |
991 	    V_SCMD_PROTO_VERSION(SCMD_PROTO_VERSION_GENERIC) |
992 	    V_SCMD_ENC_DEC_CTRL(op_type) |
993 	    V_SCMD_CIPH_AUTH_SEQ_CTRL(op_type == CHCR_ENCRYPT_OP ? 1 : 0) |
994 	    V_SCMD_CIPH_MODE(s->blkcipher.cipher_mode) |
995 	    V_SCMD_AUTH_MODE(s->hmac.auth_mode) |
996 	    V_SCMD_HMAC_CTRL(hmac_ctrl) |
997 	    V_SCMD_IV_SIZE(iv_len / 2) |
998 	    V_SCMD_NUM_IVS(0));
999 	crwr->sec_cpl.ivgen_hdrlen = htobe32(
1000 	    V_SCMD_IV_GEN_CTRL(0) |
1001 	    V_SCMD_MORE_FRAGS(0) | V_SCMD_LAST_FRAG(0) | V_SCMD_MAC_ONLY(0) |
1002 	    V_SCMD_AADIVDROP(0) | V_SCMD_HDR_LEN(dsgl_len));
1003 
1004 	crwr->key_ctx.ctx_hdr = s->blkcipher.key_ctx_hdr;
1005 	switch (s->blkcipher.cipher_mode) {
1006 	case SCMD_CIPH_MODE_AES_CBC:
1007 		if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
1008 			memcpy(crwr->key_ctx.key, s->blkcipher.enckey,
1009 			    s->blkcipher.key_len);
1010 		else
1011 			memcpy(crwr->key_ctx.key, s->blkcipher.deckey,
1012 			    s->blkcipher.key_len);
1013 		break;
1014 	case SCMD_CIPH_MODE_AES_CTR:
1015 		memcpy(crwr->key_ctx.key, s->blkcipher.enckey,
1016 		    s->blkcipher.key_len);
1017 		break;
1018 	case SCMD_CIPH_MODE_AES_XTS:
1019 		key_half = s->blkcipher.key_len / 2;
1020 		memcpy(crwr->key_ctx.key, s->blkcipher.enckey + key_half,
1021 		    key_half);
1022 		if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
1023 			memcpy(crwr->key_ctx.key + key_half,
1024 			    s->blkcipher.enckey, key_half);
1025 		else
1026 			memcpy(crwr->key_ctx.key + key_half,
1027 			    s->blkcipher.deckey, key_half);
1028 		break;
1029 	}
1030 
1031 	dst = crwr->key_ctx.key + roundup2(s->blkcipher.key_len, 16);
1032 	memcpy(dst, s->hmac.pads, iopad_size * 2);
1033 
1034 	dst = (char *)(crwr + 1) + kctx_len;
1035 	ccr_write_phys_dsgl(sc, s, dst, dsgl_nsegs);
1036 	dst += sizeof(struct cpl_rx_phys_dsgl) + dsgl_len;
1037 	memcpy(dst, iv, iv_len);
1038 	dst += iv_len;
1039 	if (imm_len != 0) {
1040 		if (crp->crp_aad_length != 0) {
1041 			crypto_copydata(crp, crp->crp_aad_start,
1042 			    crp->crp_aad_length, dst);
1043 			dst += crp->crp_aad_length;
1044 		}
1045 		crypto_copydata(crp, crp->crp_payload_start,
1046 		    crp->crp_payload_length, dst);
1047 		dst += crp->crp_payload_length;
1048 		if (op_type == CHCR_DECRYPT_OP)
1049 			crypto_copydata(crp, crp->crp_digest_start,
1050 			    hash_size_in_response, dst);
1051 	} else
1052 		ccr_write_ulptx_sgl(sc, dst, sgl_nsegs);
1053 
1054 	/* XXX: TODO backpressure */
1055 	t4_wrq_tx(sc->adapter, wr);
1056 
1057 	return (0);
1058 }
1059 
1060 static int
1061 ccr_eta_done(struct ccr_softc *sc, struct ccr_session *s,
1062     struct cryptop *crp, const struct cpl_fw6_pld *cpl, int error)
1063 {
1064 
1065 	/*
1066 	 * The updated IV to permit chained requests is at
1067 	 * cpl->data[2], but OCF doesn't permit chained requests.
1068 	 */
1069 	return (error);
1070 }
1071 
1072 static int
1073 ccr_gcm(struct ccr_softc *sc, struct ccr_session *s, struct cryptop *crp)
1074 {
1075 	char iv[CHCR_MAX_CRYPTO_IV_LEN];
1076 	struct chcr_wr *crwr;
1077 	struct wrqe *wr;
1078 	char *dst;
1079 	u_int iv_len, kctx_len, op_type, transhdr_len, wr_len;
1080 	u_int hash_size_in_response, imm_len;
1081 	u_int aad_start, aad_stop, cipher_start, cipher_stop, auth_insert;
1082 	u_int hmac_ctrl, input_len;
1083 	int dsgl_nsegs, dsgl_len;
1084 	int sgl_nsegs, sgl_len;
1085 	int error;
1086 
1087 	if (s->blkcipher.key_len == 0)
1088 		return (EINVAL);
1089 
1090 	/*
1091 	 * The crypto engine doesn't handle GCM requests with an empty
1092 	 * payload, so handle those in software instead.
1093 	 */
1094 	if (crp->crp_payload_length == 0)
1095 		return (EMSGSIZE);
1096 
1097 	if (crp->crp_aad_length + AES_BLOCK_LEN > MAX_AAD_LEN)
1098 		return (EMSGSIZE);
1099 
1100 	hash_size_in_response = s->gmac.hash_len;
1101 	if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
1102 		op_type = CHCR_ENCRYPT_OP;
1103 	else
1104 		op_type = CHCR_DECRYPT_OP;
1105 
1106 	/*
1107 	 * The IV handling for GCM in OCF is a bit more complicated in
1108 	 * that IPSec provides a full 16-byte IV (including the
1109 	 * counter), whereas the /dev/crypto interface sometimes
1110 	 * provides a full 16-byte IV (if no IV is provided in the
1111 	 * ioctl) and sometimes a 12-byte IV (if the IV was explicit).
1112 	 *
1113 	 * When provided a 12-byte IV, assume the IV is really 16 bytes
1114 	 * with a counter in the last 4 bytes initialized to 1.
1115 	 *
1116 	 * While iv_len is checked below, the value is currently
1117 	 * always set to 12 when creating a GCM session in this driver
1118 	 * due to limitations in OCF (there is no way to know what the
1119 	 * IV length of a given request will be).  This means that the
1120 	 * driver always assumes as 12-byte IV for now.
1121 	 */
1122 	if (s->blkcipher.iv_len == 12)
1123 		iv_len = AES_BLOCK_LEN;
1124 	else
1125 		iv_len = s->blkcipher.iv_len;
1126 
1127 	/*
1128 	 * GCM requests should always provide an explicit IV.
1129 	 */
1130 	if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
1131 		return (EINVAL);
1132 
1133 	/*
1134 	 * The output buffer consists of the cipher text followed by
1135 	 * the tag when encrypting.  For decryption it only contains
1136 	 * the plain text.
1137 	 *
1138 	 * Due to a firmware bug, the output buffer must include a
1139 	 * dummy output buffer for the IV and AAD prior to the real
1140 	 * output buffer.
1141 	 */
1142 	if (op_type == CHCR_ENCRYPT_OP) {
1143 		if (iv_len + crp->crp_aad_length + crp->crp_payload_length +
1144 		    hash_size_in_response > MAX_REQUEST_SIZE)
1145 			return (EFBIG);
1146 	} else {
1147 		if (iv_len + crp->crp_aad_length + crp->crp_payload_length >
1148 		    MAX_REQUEST_SIZE)
1149 			return (EFBIG);
1150 	}
1151 	sglist_reset(sc->sg_dsgl);
1152 	error = sglist_append_sglist(sc->sg_dsgl, sc->sg_iv_aad, 0, iv_len +
1153 	    crp->crp_aad_length);
1154 	if (error)
1155 		return (error);
1156 	error = sglist_append_sglist(sc->sg_dsgl, sc->sg_crp,
1157 	    crp->crp_payload_start, crp->crp_payload_length);
1158 	if (error)
1159 		return (error);
1160 	if (op_type == CHCR_ENCRYPT_OP) {
1161 		error = sglist_append_sglist(sc->sg_dsgl, sc->sg_crp,
1162 		    crp->crp_digest_start, hash_size_in_response);
1163 		if (error)
1164 			return (error);
1165 	}
1166 	dsgl_nsegs = ccr_count_sgl(sc->sg_dsgl, DSGL_SGE_MAXLEN);
1167 	if (dsgl_nsegs > MAX_RX_PHYS_DSGL_SGE)
1168 		return (EFBIG);
1169 	dsgl_len = ccr_phys_dsgl_len(dsgl_nsegs);
1170 
1171 	/*
1172 	 * The 'key' part of the key context consists of the key followed
1173 	 * by the Galois hash key.
1174 	 */
1175 	kctx_len = roundup2(s->blkcipher.key_len, 16) + GMAC_BLOCK_LEN;
1176 	transhdr_len = CIPHER_TRANSHDR_SIZE(kctx_len, dsgl_len);
1177 
1178 	/*
1179 	 * The input buffer consists of the IV, any AAD, and then the
1180 	 * cipher/plain text.  For decryption requests the hash is
1181 	 * appended after the cipher text.
1182 	 *
1183 	 * The IV is always stored at the start of the input buffer
1184 	 * even though it may be duplicated in the payload.  The
1185 	 * crypto engine doesn't work properly if the IV offset points
1186 	 * inside of the AAD region, so a second copy is always
1187 	 * required.
1188 	 */
1189 	input_len = crp->crp_aad_length + crp->crp_payload_length;
1190 	if (op_type == CHCR_DECRYPT_OP)
1191 		input_len += hash_size_in_response;
1192 	if (input_len > MAX_REQUEST_SIZE)
1193 		return (EFBIG);
1194 	if (ccr_use_imm_data(transhdr_len, iv_len + input_len)) {
1195 		imm_len = input_len;
1196 		sgl_nsegs = 0;
1197 		sgl_len = 0;
1198 	} else {
1199 		imm_len = 0;
1200 		sglist_reset(sc->sg_ulptx);
1201 		if (crp->crp_aad_length != 0) {
1202 			error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
1203 			    crp->crp_aad_start, crp->crp_aad_length);
1204 			if (error)
1205 				return (error);
1206 		}
1207 		error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
1208 		    crp->crp_payload_start, crp->crp_payload_length);
1209 		if (error)
1210 			return (error);
1211 		if (op_type == CHCR_DECRYPT_OP) {
1212 			error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
1213 			    crp->crp_digest_start, hash_size_in_response);
1214 			if (error)
1215 				return (error);
1216 		}
1217 		sgl_nsegs = sc->sg_ulptx->sg_nseg;
1218 		sgl_len = ccr_ulptx_sgl_len(sgl_nsegs);
1219 	}
1220 
1221 	if (crp->crp_aad_length != 0) {
1222 		aad_start = iv_len + 1;
1223 		aad_stop = aad_start + crp->crp_aad_length - 1;
1224 	} else {
1225 		aad_start = 0;
1226 		aad_stop = 0;
1227 	}
1228 	cipher_start = iv_len + crp->crp_aad_length + 1;
1229 	if (op_type == CHCR_DECRYPT_OP)
1230 		cipher_stop = hash_size_in_response;
1231 	else
1232 		cipher_stop = 0;
1233 	if (op_type == CHCR_DECRYPT_OP)
1234 		auth_insert = hash_size_in_response;
1235 	else
1236 		auth_insert = 0;
1237 
1238 	wr_len = roundup2(transhdr_len, 16) + iv_len + roundup2(imm_len, 16) +
1239 	    sgl_len;
1240 	if (wr_len > SGE_MAX_WR_LEN)
1241 		return (EFBIG);
1242 	wr = alloc_wrqe(wr_len, s->port->txq);
1243 	if (wr == NULL) {
1244 		sc->stats_wr_nomem++;
1245 		return (ENOMEM);
1246 	}
1247 	crwr = wrtod(wr);
1248 	memset(crwr, 0, wr_len);
1249 
1250 	memcpy(iv, crp->crp_iv, s->blkcipher.iv_len);
1251 	if (s->blkcipher.iv_len == 12)
1252 		*(uint32_t *)&iv[12] = htobe32(1);
1253 
1254 	ccr_populate_wreq(sc, s, crwr, kctx_len, wr_len, imm_len, sgl_len, 0,
1255 	    crp);
1256 
1257 	crwr->sec_cpl.op_ivinsrtofst = htobe32(
1258 	    V_CPL_TX_SEC_PDU_OPCODE(CPL_TX_SEC_PDU) |
1259 	    V_CPL_TX_SEC_PDU_RXCHID(s->port->tx_channel_id) |
1260 	    V_CPL_TX_SEC_PDU_ACKFOLLOWS(0) | V_CPL_TX_SEC_PDU_ULPTXLPBK(1) |
1261 	    V_CPL_TX_SEC_PDU_CPLLEN(2) | V_CPL_TX_SEC_PDU_PLACEHOLDER(0) |
1262 	    V_CPL_TX_SEC_PDU_IVINSRTOFST(1));
1263 
1264 	crwr->sec_cpl.pldlen = htobe32(iv_len + input_len);
1265 
1266 	/*
1267 	 * NB: cipherstop is explicitly set to 0.  On encrypt it
1268 	 * should normally be set to 0 anyway.  However, for decrypt
1269 	 * the cipher ends before the tag in the ETA case (and
1270 	 * authstop is set to stop before the tag), but for GCM the
1271 	 * cipher still runs to the end of the buffer.  Not sure if
1272 	 * this is intentional or a firmware quirk, but it is required
1273 	 * for working tag validation with GCM decryption.
1274 	 */
1275 	crwr->sec_cpl.aadstart_cipherstop_hi = htobe32(
1276 	    V_CPL_TX_SEC_PDU_AADSTART(aad_start) |
1277 	    V_CPL_TX_SEC_PDU_AADSTOP(aad_stop) |
1278 	    V_CPL_TX_SEC_PDU_CIPHERSTART(cipher_start) |
1279 	    V_CPL_TX_SEC_PDU_CIPHERSTOP_HI(0));
1280 	crwr->sec_cpl.cipherstop_lo_authinsert = htobe32(
1281 	    V_CPL_TX_SEC_PDU_CIPHERSTOP_LO(0) |
1282 	    V_CPL_TX_SEC_PDU_AUTHSTART(cipher_start) |
1283 	    V_CPL_TX_SEC_PDU_AUTHSTOP(cipher_stop) |
1284 	    V_CPL_TX_SEC_PDU_AUTHINSERT(auth_insert));
1285 
1286 	/* These two flits are actually a CPL_TLS_TX_SCMD_FMT. */
1287 	hmac_ctrl = ccr_hmac_ctrl(AES_GMAC_HASH_LEN, hash_size_in_response);
1288 	crwr->sec_cpl.seqno_numivs = htobe32(
1289 	    V_SCMD_SEQ_NO_CTRL(0) |
1290 	    V_SCMD_PROTO_VERSION(SCMD_PROTO_VERSION_GENERIC) |
1291 	    V_SCMD_ENC_DEC_CTRL(op_type) |
1292 	    V_SCMD_CIPH_AUTH_SEQ_CTRL(op_type == CHCR_ENCRYPT_OP ? 1 : 0) |
1293 	    V_SCMD_CIPH_MODE(SCMD_CIPH_MODE_AES_GCM) |
1294 	    V_SCMD_AUTH_MODE(SCMD_AUTH_MODE_GHASH) |
1295 	    V_SCMD_HMAC_CTRL(hmac_ctrl) |
1296 	    V_SCMD_IV_SIZE(iv_len / 2) |
1297 	    V_SCMD_NUM_IVS(0));
1298 	crwr->sec_cpl.ivgen_hdrlen = htobe32(
1299 	    V_SCMD_IV_GEN_CTRL(0) |
1300 	    V_SCMD_MORE_FRAGS(0) | V_SCMD_LAST_FRAG(0) | V_SCMD_MAC_ONLY(0) |
1301 	    V_SCMD_AADIVDROP(0) | V_SCMD_HDR_LEN(dsgl_len));
1302 
1303 	crwr->key_ctx.ctx_hdr = s->blkcipher.key_ctx_hdr;
1304 	memcpy(crwr->key_ctx.key, s->blkcipher.enckey, s->blkcipher.key_len);
1305 	dst = crwr->key_ctx.key + roundup2(s->blkcipher.key_len, 16);
1306 	memcpy(dst, s->gmac.ghash_h, GMAC_BLOCK_LEN);
1307 
1308 	dst = (char *)(crwr + 1) + kctx_len;
1309 	ccr_write_phys_dsgl(sc, s, dst, dsgl_nsegs);
1310 	dst += sizeof(struct cpl_rx_phys_dsgl) + dsgl_len;
1311 	memcpy(dst, iv, iv_len);
1312 	dst += iv_len;
1313 	if (imm_len != 0) {
1314 		if (crp->crp_aad_length != 0) {
1315 			crypto_copydata(crp, crp->crp_aad_start,
1316 			    crp->crp_aad_length, dst);
1317 			dst += crp->crp_aad_length;
1318 		}
1319 		crypto_copydata(crp, crp->crp_payload_start,
1320 		    crp->crp_payload_length, dst);
1321 		dst += crp->crp_payload_length;
1322 		if (op_type == CHCR_DECRYPT_OP)
1323 			crypto_copydata(crp, crp->crp_digest_start,
1324 			    hash_size_in_response, dst);
1325 	} else
1326 		ccr_write_ulptx_sgl(sc, dst, sgl_nsegs);
1327 
1328 	/* XXX: TODO backpressure */
1329 	t4_wrq_tx(sc->adapter, wr);
1330 
1331 	return (0);
1332 }
1333 
1334 static int
1335 ccr_gcm_done(struct ccr_softc *sc, struct ccr_session *s,
1336     struct cryptop *crp, const struct cpl_fw6_pld *cpl, int error)
1337 {
1338 
1339 	/*
1340 	 * The updated IV to permit chained requests is at
1341 	 * cpl->data[2], but OCF doesn't permit chained requests.
1342 	 *
1343 	 * Note that the hardware should always verify the GMAC hash.
1344 	 */
1345 	return (error);
1346 }
1347 
1348 /*
1349  * Handle a GCM request that is not supported by the crypto engine by
1350  * performing the operation in software.  Derived from swcr_authenc().
1351  */
1352 static void
1353 ccr_gcm_soft(struct ccr_session *s, struct cryptop *crp)
1354 {
1355 	struct auth_hash *axf;
1356 	struct enc_xform *exf;
1357 	void *auth_ctx;
1358 	uint8_t *kschedule;
1359 	char block[GMAC_BLOCK_LEN];
1360 	char digest[GMAC_DIGEST_LEN];
1361 	char iv[AES_BLOCK_LEN];
1362 	int error, i, len;
1363 
1364 	auth_ctx = NULL;
1365 	kschedule = NULL;
1366 
1367 	/* Initialize the MAC. */
1368 	switch (s->blkcipher.key_len) {
1369 	case 16:
1370 		axf = &auth_hash_nist_gmac_aes_128;
1371 		break;
1372 	case 24:
1373 		axf = &auth_hash_nist_gmac_aes_192;
1374 		break;
1375 	case 32:
1376 		axf = &auth_hash_nist_gmac_aes_256;
1377 		break;
1378 	default:
1379 		error = EINVAL;
1380 		goto out;
1381 	}
1382 	auth_ctx = malloc(axf->ctxsize, M_CCR, M_NOWAIT);
1383 	if (auth_ctx == NULL) {
1384 		error = ENOMEM;
1385 		goto out;
1386 	}
1387 	axf->Init(auth_ctx);
1388 	axf->Setkey(auth_ctx, s->blkcipher.enckey, s->blkcipher.key_len);
1389 
1390 	/* Initialize the cipher. */
1391 	exf = &enc_xform_aes_nist_gcm;
1392 	error = exf->setkey(&kschedule, s->blkcipher.enckey,
1393 	    s->blkcipher.key_len);
1394 	if (error)
1395 		goto out;
1396 
1397 	/*
1398 	 * This assumes a 12-byte IV from the crp.  See longer comment
1399 	 * above in ccr_gcm() for more details.
1400 	 */
1401 	if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) {
1402 		error = EINVAL;
1403 		goto out;
1404 	}
1405 	memcpy(iv, crp->crp_iv, 12);
1406 	*(uint32_t *)&iv[12] = htobe32(1);
1407 
1408 	axf->Reinit(auth_ctx, iv, sizeof(iv));
1409 
1410 	/* MAC the AAD. */
1411 	for (i = 0; i < crp->crp_aad_length; i += sizeof(block)) {
1412 		len = imin(crp->crp_aad_length - i, sizeof(block));
1413 		crypto_copydata(crp, crp->crp_aad_start + i, len, block);
1414 		bzero(block + len, sizeof(block) - len);
1415 		axf->Update(auth_ctx, block, sizeof(block));
1416 	}
1417 
1418 	exf->reinit(kschedule, iv);
1419 
1420 	/* Do encryption with MAC */
1421 	for (i = 0; i < crp->crp_payload_length; i += sizeof(block)) {
1422 		len = imin(crp->crp_payload_length - i, sizeof(block));
1423 		crypto_copydata(crp, crp->crp_payload_start + i, len, block);
1424 		bzero(block + len, sizeof(block) - len);
1425 		if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
1426 			exf->encrypt(kschedule, block);
1427 			axf->Update(auth_ctx, block, len);
1428 			crypto_copyback(crp, crp->crp_payload_start + i, len,
1429 			    block);
1430 		} else {
1431 			axf->Update(auth_ctx, block, len);
1432 		}
1433 	}
1434 
1435 	/* Length block. */
1436 	bzero(block, sizeof(block));
1437 	((uint32_t *)block)[1] = htobe32(crp->crp_aad_length * 8);
1438 	((uint32_t *)block)[3] = htobe32(crp->crp_payload_length * 8);
1439 	axf->Update(auth_ctx, block, sizeof(block));
1440 
1441 	/* Finalize MAC. */
1442 	axf->Final(digest, auth_ctx);
1443 
1444 	/* Inject or validate tag. */
1445 	if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
1446 		crypto_copyback(crp, crp->crp_digest_start, sizeof(digest),
1447 		    digest);
1448 		error = 0;
1449 	} else {
1450 		char digest2[GMAC_DIGEST_LEN];
1451 
1452 		crypto_copydata(crp, crp->crp_digest_start, sizeof(digest2),
1453 		    digest2);
1454 		if (timingsafe_bcmp(digest, digest2, sizeof(digest)) == 0) {
1455 			error = 0;
1456 
1457 			/* Tag matches, decrypt data. */
1458 			for (i = 0; i < crp->crp_payload_length;
1459 			     i += sizeof(block)) {
1460 				len = imin(crp->crp_payload_length - i,
1461 				    sizeof(block));
1462 				crypto_copydata(crp, crp->crp_payload_start + i,
1463 				    len, block);
1464 				bzero(block + len, sizeof(block) - len);
1465 				exf->decrypt(kschedule, block);
1466 				crypto_copyback(crp, crp->crp_payload_start + i,
1467 				    len, block);
1468 			}
1469 		} else
1470 			error = EBADMSG;
1471 	}
1472 
1473 	exf->zerokey(&kschedule);
1474 out:
1475 	if (auth_ctx != NULL) {
1476 		memset(auth_ctx, 0, axf->ctxsize);
1477 		free(auth_ctx, M_CCR);
1478 	}
1479 	crp->crp_etype = error;
1480 	crypto_done(crp);
1481 }
1482 
1483 static void
1484 generate_ccm_b0(struct cryptop *crp, u_int hash_size_in_response,
1485     const char *iv, char *b0)
1486 {
1487 	u_int i, payload_len;
1488 
1489 	/* NB: L is already set in the first byte of the IV. */
1490 	memcpy(b0, iv, CCM_B0_SIZE);
1491 
1492 	/* Set length of hash in bits 3 - 5. */
1493 	b0[0] |= (((hash_size_in_response - 2) / 2) << 3);
1494 
1495 	/* Store the payload length as a big-endian value. */
1496 	payload_len = crp->crp_payload_length;
1497 	for (i = 0; i < iv[0]; i++) {
1498 		b0[CCM_CBC_BLOCK_LEN - 1 - i] = payload_len;
1499 		payload_len >>= 8;
1500 	}
1501 
1502 	/*
1503 	 * If there is AAD in the request, set bit 6 in the flags
1504 	 * field and store the AAD length as a big-endian value at the
1505 	 * start of block 1.  This only assumes a 16-bit AAD length
1506 	 * since T6 doesn't support large AAD sizes.
1507 	 */
1508 	if (crp->crp_aad_length != 0) {
1509 		b0[0] |= (1 << 6);
1510 		*(uint16_t *)(b0 + CCM_B0_SIZE) = htobe16(crp->crp_aad_length);
1511 	}
1512 }
1513 
1514 static int
1515 ccr_ccm(struct ccr_softc *sc, struct ccr_session *s, struct cryptop *crp)
1516 {
1517 	char iv[CHCR_MAX_CRYPTO_IV_LEN];
1518 	struct ulptx_idata *idata;
1519 	struct chcr_wr *crwr;
1520 	struct wrqe *wr;
1521 	char *dst;
1522 	u_int iv_len, kctx_len, op_type, transhdr_len, wr_len;
1523 	u_int aad_len, b0_len, hash_size_in_response, imm_len;
1524 	u_int aad_start, aad_stop, cipher_start, cipher_stop, auth_insert;
1525 	u_int hmac_ctrl, input_len;
1526 	int dsgl_nsegs, dsgl_len;
1527 	int sgl_nsegs, sgl_len;
1528 	int error;
1529 
1530 	if (s->blkcipher.key_len == 0)
1531 		return (EINVAL);
1532 
1533 	/*
1534 	 * The crypto engine doesn't handle CCM requests with an empty
1535 	 * payload, so handle those in software instead.
1536 	 */
1537 	if (crp->crp_payload_length == 0)
1538 		return (EMSGSIZE);
1539 
1540 	/*
1541 	 * CCM always includes block 0 in the AAD before AAD from the
1542 	 * request.
1543 	 */
1544 	b0_len = CCM_B0_SIZE;
1545 	if (crp->crp_aad_length != 0)
1546 		b0_len += CCM_AAD_FIELD_SIZE;
1547 	aad_len = b0_len + crp->crp_aad_length;
1548 
1549 	/*
1550 	 * CCM requests should always provide an explicit IV (really
1551 	 * the nonce).
1552 	 */
1553 	if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0)
1554 		return (EINVAL);
1555 
1556 	/*
1557 	 * Always assume a 12 byte input nonce for now since that is
1558 	 * what OCF always generates.  The full IV in the work request
1559 	 * is 16 bytes.
1560 	 */
1561 	iv_len = AES_BLOCK_LEN;
1562 
1563 	if (iv_len + aad_len > MAX_AAD_LEN)
1564 		return (EMSGSIZE);
1565 
1566 	hash_size_in_response = s->ccm_mac.hash_len;
1567 	if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
1568 		op_type = CHCR_ENCRYPT_OP;
1569 	else
1570 		op_type = CHCR_DECRYPT_OP;
1571 
1572 	/*
1573 	 * The output buffer consists of the cipher text followed by
1574 	 * the tag when encrypting.  For decryption it only contains
1575 	 * the plain text.
1576 	 *
1577 	 * Due to a firmware bug, the output buffer must include a
1578 	 * dummy output buffer for the IV and AAD prior to the real
1579 	 * output buffer.
1580 	 */
1581 	if (op_type == CHCR_ENCRYPT_OP) {
1582 		if (iv_len + aad_len + crp->crp_payload_length +
1583 		    hash_size_in_response > MAX_REQUEST_SIZE)
1584 			return (EFBIG);
1585 	} else {
1586 		if (iv_len + aad_len + crp->crp_payload_length >
1587 		    MAX_REQUEST_SIZE)
1588 			return (EFBIG);
1589 	}
1590 	sglist_reset(sc->sg_dsgl);
1591 	error = sglist_append_sglist(sc->sg_dsgl, sc->sg_iv_aad, 0, iv_len +
1592 	    aad_len);
1593 	if (error)
1594 		return (error);
1595 	error = sglist_append_sglist(sc->sg_dsgl, sc->sg_crp,
1596 	    crp->crp_payload_start, crp->crp_payload_length);
1597 	if (error)
1598 		return (error);
1599 	if (op_type == CHCR_ENCRYPT_OP) {
1600 		error = sglist_append_sglist(sc->sg_dsgl, sc->sg_crp,
1601 		    crp->crp_digest_start, hash_size_in_response);
1602 		if (error)
1603 			return (error);
1604 	}
1605 	dsgl_nsegs = ccr_count_sgl(sc->sg_dsgl, DSGL_SGE_MAXLEN);
1606 	if (dsgl_nsegs > MAX_RX_PHYS_DSGL_SGE)
1607 		return (EFBIG);
1608 	dsgl_len = ccr_phys_dsgl_len(dsgl_nsegs);
1609 
1610 	/*
1611 	 * The 'key' part of the key context consists of two copies of
1612 	 * the AES key.
1613 	 */
1614 	kctx_len = roundup2(s->blkcipher.key_len, 16) * 2;
1615 	transhdr_len = CIPHER_TRANSHDR_SIZE(kctx_len, dsgl_len);
1616 
1617 	/*
1618 	 * The input buffer consists of the IV, AAD (including block
1619 	 * 0), and then the cipher/plain text.  For decryption
1620 	 * requests the hash is appended after the cipher text.
1621 	 *
1622 	 * The IV is always stored at the start of the input buffer
1623 	 * even though it may be duplicated in the payload.  The
1624 	 * crypto engine doesn't work properly if the IV offset points
1625 	 * inside of the AAD region, so a second copy is always
1626 	 * required.
1627 	 */
1628 	input_len = aad_len + crp->crp_payload_length;
1629 	if (op_type == CHCR_DECRYPT_OP)
1630 		input_len += hash_size_in_response;
1631 	if (input_len > MAX_REQUEST_SIZE)
1632 		return (EFBIG);
1633 	if (ccr_use_imm_data(transhdr_len, iv_len + input_len)) {
1634 		imm_len = input_len;
1635 		sgl_nsegs = 0;
1636 		sgl_len = 0;
1637 	} else {
1638 		/* Block 0 is passed as immediate data. */
1639 		imm_len = b0_len;
1640 
1641 		sglist_reset(sc->sg_ulptx);
1642 		if (crp->crp_aad_length != 0) {
1643 			error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
1644 			    crp->crp_aad_start, crp->crp_aad_length);
1645 			if (error)
1646 				return (error);
1647 		}
1648 		error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
1649 		    crp->crp_payload_start, crp->crp_payload_length);
1650 		if (error)
1651 			return (error);
1652 		if (op_type == CHCR_DECRYPT_OP) {
1653 			error = sglist_append_sglist(sc->sg_ulptx, sc->sg_crp,
1654 			    crp->crp_digest_start, hash_size_in_response);
1655 			if (error)
1656 				return (error);
1657 		}
1658 		sgl_nsegs = sc->sg_ulptx->sg_nseg;
1659 		sgl_len = ccr_ulptx_sgl_len(sgl_nsegs);
1660 	}
1661 
1662 	aad_start = iv_len + 1;
1663 	aad_stop = aad_start + aad_len - 1;
1664 	cipher_start = aad_stop + 1;
1665 	if (op_type == CHCR_DECRYPT_OP)
1666 		cipher_stop = hash_size_in_response;
1667 	else
1668 		cipher_stop = 0;
1669 	if (op_type == CHCR_DECRYPT_OP)
1670 		auth_insert = hash_size_in_response;
1671 	else
1672 		auth_insert = 0;
1673 
1674 	wr_len = roundup2(transhdr_len, 16) + iv_len + roundup2(imm_len, 16) +
1675 	    sgl_len;
1676 	if (wr_len > SGE_MAX_WR_LEN)
1677 		return (EFBIG);
1678 	wr = alloc_wrqe(wr_len, s->port->txq);
1679 	if (wr == NULL) {
1680 		sc->stats_wr_nomem++;
1681 		return (ENOMEM);
1682 	}
1683 	crwr = wrtod(wr);
1684 	memset(crwr, 0, wr_len);
1685 
1686 	/*
1687 	 * Read the nonce from the request.  Use the nonce to generate
1688 	 * the full IV with the counter set to 0.
1689 	 */
1690 	memset(iv, 0, iv_len);
1691 	iv[0] = (15 - AES_CCM_IV_LEN) - 1;
1692 	memcpy(iv + 1, crp->crp_iv, AES_CCM_IV_LEN);
1693 
1694 	ccr_populate_wreq(sc, s, crwr, kctx_len, wr_len, imm_len, sgl_len, 0,
1695 	    crp);
1696 
1697 	crwr->sec_cpl.op_ivinsrtofst = htobe32(
1698 	    V_CPL_TX_SEC_PDU_OPCODE(CPL_TX_SEC_PDU) |
1699 	    V_CPL_TX_SEC_PDU_RXCHID(s->port->tx_channel_id) |
1700 	    V_CPL_TX_SEC_PDU_ACKFOLLOWS(0) | V_CPL_TX_SEC_PDU_ULPTXLPBK(1) |
1701 	    V_CPL_TX_SEC_PDU_CPLLEN(2) | V_CPL_TX_SEC_PDU_PLACEHOLDER(0) |
1702 	    V_CPL_TX_SEC_PDU_IVINSRTOFST(1));
1703 
1704 	crwr->sec_cpl.pldlen = htobe32(iv_len + input_len);
1705 
1706 	/*
1707 	 * NB: cipherstop is explicitly set to 0.  See comments above
1708 	 * in ccr_gcm().
1709 	 */
1710 	crwr->sec_cpl.aadstart_cipherstop_hi = htobe32(
1711 	    V_CPL_TX_SEC_PDU_AADSTART(aad_start) |
1712 	    V_CPL_TX_SEC_PDU_AADSTOP(aad_stop) |
1713 	    V_CPL_TX_SEC_PDU_CIPHERSTART(cipher_start) |
1714 	    V_CPL_TX_SEC_PDU_CIPHERSTOP_HI(0));
1715 	crwr->sec_cpl.cipherstop_lo_authinsert = htobe32(
1716 	    V_CPL_TX_SEC_PDU_CIPHERSTOP_LO(0) |
1717 	    V_CPL_TX_SEC_PDU_AUTHSTART(cipher_start) |
1718 	    V_CPL_TX_SEC_PDU_AUTHSTOP(cipher_stop) |
1719 	    V_CPL_TX_SEC_PDU_AUTHINSERT(auth_insert));
1720 
1721 	/* These two flits are actually a CPL_TLS_TX_SCMD_FMT. */
1722 	hmac_ctrl = ccr_hmac_ctrl(AES_CBC_MAC_HASH_LEN, hash_size_in_response);
1723 	crwr->sec_cpl.seqno_numivs = htobe32(
1724 	    V_SCMD_SEQ_NO_CTRL(0) |
1725 	    V_SCMD_PROTO_VERSION(SCMD_PROTO_VERSION_GENERIC) |
1726 	    V_SCMD_ENC_DEC_CTRL(op_type) |
1727 	    V_SCMD_CIPH_AUTH_SEQ_CTRL(op_type == CHCR_ENCRYPT_OP ? 0 : 1) |
1728 	    V_SCMD_CIPH_MODE(SCMD_CIPH_MODE_AES_CCM) |
1729 	    V_SCMD_AUTH_MODE(SCMD_AUTH_MODE_CBCMAC) |
1730 	    V_SCMD_HMAC_CTRL(hmac_ctrl) |
1731 	    V_SCMD_IV_SIZE(iv_len / 2) |
1732 	    V_SCMD_NUM_IVS(0));
1733 	crwr->sec_cpl.ivgen_hdrlen = htobe32(
1734 	    V_SCMD_IV_GEN_CTRL(0) |
1735 	    V_SCMD_MORE_FRAGS(0) | V_SCMD_LAST_FRAG(0) | V_SCMD_MAC_ONLY(0) |
1736 	    V_SCMD_AADIVDROP(0) | V_SCMD_HDR_LEN(dsgl_len));
1737 
1738 	crwr->key_ctx.ctx_hdr = s->blkcipher.key_ctx_hdr;
1739 	memcpy(crwr->key_ctx.key, s->blkcipher.enckey, s->blkcipher.key_len);
1740 	memcpy(crwr->key_ctx.key + roundup(s->blkcipher.key_len, 16),
1741 	    s->blkcipher.enckey, s->blkcipher.key_len);
1742 
1743 	dst = (char *)(crwr + 1) + kctx_len;
1744 	ccr_write_phys_dsgl(sc, s, dst, dsgl_nsegs);
1745 	dst += sizeof(struct cpl_rx_phys_dsgl) + dsgl_len;
1746 	memcpy(dst, iv, iv_len);
1747 	dst += iv_len;
1748 	generate_ccm_b0(crp, hash_size_in_response, iv, dst);
1749 	if (sgl_nsegs == 0) {
1750 		dst += b0_len;
1751 		if (crp->crp_aad_length != 0) {
1752 			crypto_copydata(crp, crp->crp_aad_start,
1753 			    crp->crp_aad_length, dst);
1754 			dst += crp->crp_aad_length;
1755 		}
1756 		crypto_copydata(crp, crp->crp_payload_start,
1757 		    crp->crp_payload_length, dst);
1758 		dst += crp->crp_payload_length;
1759 		if (op_type == CHCR_DECRYPT_OP)
1760 			crypto_copydata(crp, crp->crp_digest_start,
1761 			    hash_size_in_response, dst);
1762 	} else {
1763 		dst += CCM_B0_SIZE;
1764 		if (b0_len > CCM_B0_SIZE) {
1765 			/*
1766 			 * If there is AAD, insert padding including a
1767 			 * ULP_TX_SC_NOOP so that the ULP_TX_SC_DSGL
1768 			 * is 16-byte aligned.
1769 			 */
1770 			KASSERT(b0_len - CCM_B0_SIZE == CCM_AAD_FIELD_SIZE,
1771 			    ("b0_len mismatch"));
1772 			memset(dst + CCM_AAD_FIELD_SIZE, 0,
1773 			    8 - CCM_AAD_FIELD_SIZE);
1774 			idata = (void *)(dst + 8);
1775 			idata->cmd_more = htobe32(V_ULPTX_CMD(ULP_TX_SC_NOOP));
1776 			idata->len = htobe32(0);
1777 			dst = (void *)(idata + 1);
1778 		}
1779 		ccr_write_ulptx_sgl(sc, dst, sgl_nsegs);
1780 	}
1781 
1782 	/* XXX: TODO backpressure */
1783 	t4_wrq_tx(sc->adapter, wr);
1784 
1785 	return (0);
1786 }
1787 
1788 static int
1789 ccr_ccm_done(struct ccr_softc *sc, struct ccr_session *s,
1790     struct cryptop *crp, const struct cpl_fw6_pld *cpl, int error)
1791 {
1792 
1793 	/*
1794 	 * The updated IV to permit chained requests is at
1795 	 * cpl->data[2], but OCF doesn't permit chained requests.
1796 	 *
1797 	 * Note that the hardware should always verify the CBC MAC
1798 	 * hash.
1799 	 */
1800 	return (error);
1801 }
1802 
1803 /*
1804  * Handle a CCM request that is not supported by the crypto engine by
1805  * performing the operation in software.  Derived from swcr_authenc().
1806  */
1807 static void
1808 ccr_ccm_soft(struct ccr_session *s, struct cryptop *crp)
1809 {
1810 	struct auth_hash *axf;
1811 	struct enc_xform *exf;
1812 	union authctx *auth_ctx;
1813 	uint8_t *kschedule;
1814 	char block[CCM_CBC_BLOCK_LEN];
1815 	char digest[AES_CBC_MAC_HASH_LEN];
1816 	char iv[AES_CCM_IV_LEN];
1817 	int error, i, len;
1818 
1819 	auth_ctx = NULL;
1820 	kschedule = NULL;
1821 
1822 	/* Initialize the MAC. */
1823 	switch (s->blkcipher.key_len) {
1824 	case 16:
1825 		axf = &auth_hash_ccm_cbc_mac_128;
1826 		break;
1827 	case 24:
1828 		axf = &auth_hash_ccm_cbc_mac_192;
1829 		break;
1830 	case 32:
1831 		axf = &auth_hash_ccm_cbc_mac_256;
1832 		break;
1833 	default:
1834 		error = EINVAL;
1835 		goto out;
1836 	}
1837 	auth_ctx = malloc(axf->ctxsize, M_CCR, M_NOWAIT);
1838 	if (auth_ctx == NULL) {
1839 		error = ENOMEM;
1840 		goto out;
1841 	}
1842 	axf->Init(auth_ctx);
1843 	axf->Setkey(auth_ctx, s->blkcipher.enckey, s->blkcipher.key_len);
1844 
1845 	/* Initialize the cipher. */
1846 	exf = &enc_xform_ccm;
1847 	error = exf->setkey(&kschedule, s->blkcipher.enckey,
1848 	    s->blkcipher.key_len);
1849 	if (error)
1850 		goto out;
1851 
1852 	if ((crp->crp_flags & CRYPTO_F_IV_SEPARATE) == 0) {
1853 		error = EINVAL;
1854 		goto out;
1855 	}
1856 	memcpy(iv, crp->crp_iv, AES_CCM_IV_LEN);
1857 
1858 	auth_ctx->aes_cbc_mac_ctx.authDataLength = crp->crp_aad_length;
1859 	auth_ctx->aes_cbc_mac_ctx.cryptDataLength = crp->crp_payload_length;
1860 	axf->Reinit(auth_ctx, iv, sizeof(iv));
1861 
1862 	/* MAC the AAD. */
1863 	for (i = 0; i < crp->crp_aad_length; i += sizeof(block)) {
1864 		len = imin(crp->crp_aad_length - i, sizeof(block));
1865 		crypto_copydata(crp, crp->crp_aad_start + i, len, block);
1866 		bzero(block + len, sizeof(block) - len);
1867 		axf->Update(auth_ctx, block, sizeof(block));
1868 	}
1869 
1870 	exf->reinit(kschedule, iv);
1871 
1872 	/* Do encryption/decryption with MAC */
1873 	for (i = 0; i < crp->crp_payload_length; i += sizeof(block)) {
1874 		len = imin(crp->crp_payload_length - i, sizeof(block));
1875 		crypto_copydata(crp, crp->crp_payload_start + i, len, block);
1876 		bzero(block + len, sizeof(block) - len);
1877 		if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
1878 			axf->Update(auth_ctx, block, len);
1879 			exf->encrypt(kschedule, block);
1880 			crypto_copyback(crp, crp->crp_payload_start + i, len,
1881 			    block);
1882 		} else {
1883 			exf->decrypt(kschedule, block);
1884 			axf->Update(auth_ctx, block, len);
1885 		}
1886 	}
1887 
1888 	/* Finalize MAC. */
1889 	axf->Final(digest, auth_ctx);
1890 
1891 	/* Inject or validate tag. */
1892 	if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op)) {
1893 		crypto_copyback(crp, crp->crp_digest_start, sizeof(digest),
1894 		    digest);
1895 		error = 0;
1896 	} else {
1897 		char digest2[AES_CBC_MAC_HASH_LEN];
1898 
1899 		crypto_copydata(crp, crp->crp_digest_start, sizeof(digest2),
1900 		    digest2);
1901 		if (timingsafe_bcmp(digest, digest2, sizeof(digest)) == 0) {
1902 			error = 0;
1903 
1904 			/* Tag matches, decrypt data. */
1905 			exf->reinit(kschedule, iv);
1906 			for (i = 0; i < crp->crp_payload_length;
1907 			     i += sizeof(block)) {
1908 				len = imin(crp->crp_payload_length - i,
1909 				    sizeof(block));
1910 				crypto_copydata(crp, crp->crp_payload_start + i,
1911 				    len, block);
1912 				bzero(block + len, sizeof(block) - len);
1913 				exf->decrypt(kschedule, block);
1914 				crypto_copyback(crp, crp->crp_payload_start + i,
1915 				    len, block);
1916 			}
1917 		} else
1918 			error = EBADMSG;
1919 	}
1920 
1921 	exf->zerokey(&kschedule);
1922 out:
1923 	if (auth_ctx != NULL) {
1924 		memset(auth_ctx, 0, axf->ctxsize);
1925 		free(auth_ctx, M_CCR);
1926 	}
1927 	crp->crp_etype = error;
1928 	crypto_done(crp);
1929 }
1930 
1931 static void
1932 ccr_identify(driver_t *driver, device_t parent)
1933 {
1934 	struct adapter *sc;
1935 
1936 	sc = device_get_softc(parent);
1937 	if (sc->cryptocaps & FW_CAPS_CONFIG_CRYPTO_LOOKASIDE &&
1938 	    device_find_child(parent, "ccr", -1) == NULL)
1939 		device_add_child(parent, "ccr", -1);
1940 }
1941 
1942 static int
1943 ccr_probe(device_t dev)
1944 {
1945 
1946 	device_set_desc(dev, "Chelsio Crypto Accelerator");
1947 	return (BUS_PROBE_DEFAULT);
1948 }
1949 
1950 static void
1951 ccr_sysctls(struct ccr_softc *sc)
1952 {
1953 	struct sysctl_ctx_list *ctx;
1954 	struct sysctl_oid *oid, *port_oid;
1955 	struct sysctl_oid_list *children;
1956 	char buf[16];
1957 	int i;
1958 
1959 	ctx = device_get_sysctl_ctx(sc->dev);
1960 
1961 	/*
1962 	 * dev.ccr.X.
1963 	 */
1964 	oid = device_get_sysctl_tree(sc->dev);
1965 	children = SYSCTL_CHILDREN(oid);
1966 
1967 	SYSCTL_ADD_UINT(ctx, children, OID_AUTO, "port_mask", CTLFLAG_RW,
1968 	    &sc->port_mask, 0, "Mask of enabled ports");
1969 
1970 	/*
1971 	 * dev.ccr.X.stats.
1972 	 */
1973 	oid = SYSCTL_ADD_NODE(ctx, children, OID_AUTO, "stats",
1974 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "statistics");
1975 	children = SYSCTL_CHILDREN(oid);
1976 
1977 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "hash", CTLFLAG_RD,
1978 	    &sc->stats_hash, 0, "Hash requests submitted");
1979 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "hmac", CTLFLAG_RD,
1980 	    &sc->stats_hmac, 0, "HMAC requests submitted");
1981 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "cipher_encrypt", CTLFLAG_RD,
1982 	    &sc->stats_blkcipher_encrypt, 0,
1983 	    "Cipher encryption requests submitted");
1984 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "cipher_decrypt", CTLFLAG_RD,
1985 	    &sc->stats_blkcipher_decrypt, 0,
1986 	    "Cipher decryption requests submitted");
1987 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "eta_encrypt", CTLFLAG_RD,
1988 	    &sc->stats_eta_encrypt, 0,
1989 	    "Combined AES+HMAC encryption requests submitted");
1990 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "eta_decrypt", CTLFLAG_RD,
1991 	    &sc->stats_eta_decrypt, 0,
1992 	    "Combined AES+HMAC decryption requests submitted");
1993 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "gcm_encrypt", CTLFLAG_RD,
1994 	    &sc->stats_gcm_encrypt, 0, "AES-GCM encryption requests submitted");
1995 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "gcm_decrypt", CTLFLAG_RD,
1996 	    &sc->stats_gcm_decrypt, 0, "AES-GCM decryption requests submitted");
1997 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "ccm_encrypt", CTLFLAG_RD,
1998 	    &sc->stats_ccm_encrypt, 0, "AES-CCM encryption requests submitted");
1999 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "ccm_decrypt", CTLFLAG_RD,
2000 	    &sc->stats_ccm_decrypt, 0, "AES-CCM decryption requests submitted");
2001 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "wr_nomem", CTLFLAG_RD,
2002 	    &sc->stats_wr_nomem, 0, "Work request memory allocation failures");
2003 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "inflight", CTLFLAG_RD,
2004 	    &sc->stats_inflight, 0, "Requests currently pending");
2005 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "mac_error", CTLFLAG_RD,
2006 	    &sc->stats_mac_error, 0, "MAC errors");
2007 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "pad_error", CTLFLAG_RD,
2008 	    &sc->stats_pad_error, 0, "Padding errors");
2009 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "bad_session", CTLFLAG_RD,
2010 	    &sc->stats_bad_session, 0, "Requests with invalid session ID");
2011 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "sglist_error", CTLFLAG_RD,
2012 	    &sc->stats_sglist_error, 0,
2013 	    "Requests for which DMA mapping failed");
2014 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "process_error", CTLFLAG_RD,
2015 	    &sc->stats_process_error, 0, "Requests failed during queueing");
2016 	SYSCTL_ADD_U64(ctx, children, OID_AUTO, "sw_fallback", CTLFLAG_RD,
2017 	    &sc->stats_sw_fallback, 0,
2018 	    "Requests processed by falling back to software");
2019 
2020 	/*
2021 	 * dev.ccr.X.stats.port
2022 	 */
2023 	port_oid = SYSCTL_ADD_NODE(ctx, children, OID_AUTO, "port",
2024 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "Per-port statistics");
2025 
2026 	for (i = 0; i < nitems(sc->ports); i++) {
2027 		if (sc->ports[i].rxq == NULL)
2028 			continue;
2029 
2030 		/*
2031 		 * dev.ccr.X.stats.port.Y
2032 		 */
2033 		snprintf(buf, sizeof(buf), "%d", i);
2034 		oid = SYSCTL_ADD_NODE(ctx, SYSCTL_CHILDREN(port_oid), OID_AUTO,
2035 		    buf, CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, buf);
2036 		children = SYSCTL_CHILDREN(oid);
2037 
2038 		SYSCTL_ADD_UINT(ctx, children, OID_AUTO, "active_sessions",
2039 		    CTLFLAG_RD, &sc->ports[i].active_sessions, 0,
2040 		    "Count of active sessions");
2041 	}
2042 }
2043 
2044 static void
2045 ccr_init_port(struct ccr_softc *sc, int port)
2046 {
2047 
2048 	sc->ports[port].txq = &sc->adapter->sge.ctrlq[port];
2049 	sc->ports[port].rxq =
2050 	    &sc->adapter->sge.rxq[sc->adapter->port[port]->vi->first_rxq];
2051 	sc->ports[port].tx_channel_id = port;
2052 	_Static_assert(sizeof(sc->port_mask) * NBBY >= MAX_NPORTS - 1,
2053 	    "Too many ports to fit in port_mask");
2054 	sc->port_mask |= 1u << port;
2055 }
2056 
2057 static int
2058 ccr_attach(device_t dev)
2059 {
2060 	struct ccr_softc *sc;
2061 	int32_t cid;
2062 	int i;
2063 
2064 	sc = device_get_softc(dev);
2065 	sc->dev = dev;
2066 	sc->adapter = device_get_softc(device_get_parent(dev));
2067 	for_each_port(sc->adapter, i) {
2068 		ccr_init_port(sc, i);
2069 	}
2070 	cid = crypto_get_driverid(dev, sizeof(struct ccr_session),
2071 	    CRYPTOCAP_F_HARDWARE);
2072 	if (cid < 0) {
2073 		device_printf(dev, "could not get crypto driver id\n");
2074 		return (ENXIO);
2075 	}
2076 	sc->cid = cid;
2077 	sc->adapter->ccr_softc = sc;
2078 
2079 	mtx_init(&sc->lock, "ccr", NULL, MTX_DEF);
2080 	sc->sg_crp = sglist_alloc(TX_SGL_SEGS, M_WAITOK);
2081 	sc->sg_ulptx = sglist_alloc(TX_SGL_SEGS, M_WAITOK);
2082 	sc->sg_dsgl = sglist_alloc(MAX_RX_PHYS_DSGL_SGE, M_WAITOK);
2083 	sc->iv_aad_buf = malloc(MAX_AAD_LEN, M_CCR, M_WAITOK);
2084 	sc->sg_iv_aad = sglist_build(sc->iv_aad_buf, MAX_AAD_LEN, M_WAITOK);
2085 	ccr_sysctls(sc);
2086 
2087 	return (0);
2088 }
2089 
2090 static int
2091 ccr_detach(device_t dev)
2092 {
2093 	struct ccr_softc *sc;
2094 
2095 	sc = device_get_softc(dev);
2096 
2097 	mtx_lock(&sc->lock);
2098 	sc->detaching = true;
2099 	mtx_unlock(&sc->lock);
2100 
2101 	crypto_unregister_all(sc->cid);
2102 
2103 	mtx_destroy(&sc->lock);
2104 	sglist_free(sc->sg_iv_aad);
2105 	free(sc->iv_aad_buf, M_CCR);
2106 	sglist_free(sc->sg_dsgl);
2107 	sglist_free(sc->sg_ulptx);
2108 	sglist_free(sc->sg_crp);
2109 	sc->adapter->ccr_softc = NULL;
2110 	return (0);
2111 }
2112 
2113 static void
2114 ccr_init_hash_digest(struct ccr_session *s)
2115 {
2116 	union authctx auth_ctx;
2117 	struct auth_hash *axf;
2118 
2119 	axf = s->hmac.auth_hash;
2120 	axf->Init(&auth_ctx);
2121 	t4_copy_partial_hash(axf->type, &auth_ctx, s->hmac.pads);
2122 }
2123 
2124 static bool
2125 ccr_aes_check_keylen(int alg, int klen)
2126 {
2127 
2128 	switch (klen * 8) {
2129 	case 128:
2130 	case 192:
2131 		if (alg == CRYPTO_AES_XTS)
2132 			return (false);
2133 		break;
2134 	case 256:
2135 		break;
2136 	case 512:
2137 		if (alg != CRYPTO_AES_XTS)
2138 			return (false);
2139 		break;
2140 	default:
2141 		return (false);
2142 	}
2143 	return (true);
2144 }
2145 
2146 static void
2147 ccr_aes_setkey(struct ccr_session *s, const void *key, int klen)
2148 {
2149 	unsigned int ck_size, iopad_size, kctx_flits, kctx_len, kbits, mk_size;
2150 	unsigned int opad_present;
2151 
2152 	if (s->blkcipher.cipher_mode == SCMD_CIPH_MODE_AES_XTS)
2153 		kbits = (klen / 2) * 8;
2154 	else
2155 		kbits = klen * 8;
2156 	switch (kbits) {
2157 	case 128:
2158 		ck_size = CHCR_KEYCTX_CIPHER_KEY_SIZE_128;
2159 		break;
2160 	case 192:
2161 		ck_size = CHCR_KEYCTX_CIPHER_KEY_SIZE_192;
2162 		break;
2163 	case 256:
2164 		ck_size = CHCR_KEYCTX_CIPHER_KEY_SIZE_256;
2165 		break;
2166 	default:
2167 		panic("should not get here");
2168 	}
2169 
2170 	s->blkcipher.key_len = klen;
2171 	memcpy(s->blkcipher.enckey, key, s->blkcipher.key_len);
2172 	switch (s->blkcipher.cipher_mode) {
2173 	case SCMD_CIPH_MODE_AES_CBC:
2174 	case SCMD_CIPH_MODE_AES_XTS:
2175 		t4_aes_getdeckey(s->blkcipher.deckey, key, kbits);
2176 		break;
2177 	}
2178 
2179 	kctx_len = roundup2(s->blkcipher.key_len, 16);
2180 	switch (s->mode) {
2181 	case ETA:
2182 		mk_size = s->hmac.mk_size;
2183 		opad_present = 1;
2184 		iopad_size = roundup2(s->hmac.partial_digest_len, 16);
2185 		kctx_len += iopad_size * 2;
2186 		break;
2187 	case GCM:
2188 		mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_128;
2189 		opad_present = 0;
2190 		kctx_len += GMAC_BLOCK_LEN;
2191 		break;
2192 	case CCM:
2193 		switch (kbits) {
2194 		case 128:
2195 			mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_128;
2196 			break;
2197 		case 192:
2198 			mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_192;
2199 			break;
2200 		case 256:
2201 			mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_256;
2202 			break;
2203 		default:
2204 			panic("should not get here");
2205 		}
2206 		opad_present = 0;
2207 		kctx_len *= 2;
2208 		break;
2209 	default:
2210 		mk_size = CHCR_KEYCTX_NO_KEY;
2211 		opad_present = 0;
2212 		break;
2213 	}
2214 	kctx_flits = (sizeof(struct _key_ctx) + kctx_len) / 16;
2215 	s->blkcipher.key_ctx_hdr = htobe32(V_KEY_CONTEXT_CTX_LEN(kctx_flits) |
2216 	    V_KEY_CONTEXT_DUAL_CK(s->blkcipher.cipher_mode ==
2217 	    SCMD_CIPH_MODE_AES_XTS) |
2218 	    V_KEY_CONTEXT_OPAD_PRESENT(opad_present) |
2219 	    V_KEY_CONTEXT_SALT_PRESENT(1) | V_KEY_CONTEXT_CK_SIZE(ck_size) |
2220 	    V_KEY_CONTEXT_MK_SIZE(mk_size) | V_KEY_CONTEXT_VALID(1));
2221 }
2222 
2223 static bool
2224 ccr_auth_supported(const struct crypto_session_params *csp)
2225 {
2226 
2227 	switch (csp->csp_auth_alg) {
2228 	case CRYPTO_SHA1:
2229 	case CRYPTO_SHA2_224:
2230 	case CRYPTO_SHA2_256:
2231 	case CRYPTO_SHA2_384:
2232 	case CRYPTO_SHA2_512:
2233 	case CRYPTO_SHA1_HMAC:
2234 	case CRYPTO_SHA2_224_HMAC:
2235 	case CRYPTO_SHA2_256_HMAC:
2236 	case CRYPTO_SHA2_384_HMAC:
2237 	case CRYPTO_SHA2_512_HMAC:
2238 		break;
2239 	default:
2240 		return (false);
2241 	}
2242 	return (true);
2243 }
2244 
2245 static bool
2246 ccr_cipher_supported(const struct crypto_session_params *csp)
2247 {
2248 
2249 	switch (csp->csp_cipher_alg) {
2250 	case CRYPTO_AES_CBC:
2251 		if (csp->csp_ivlen != AES_BLOCK_LEN)
2252 			return (false);
2253 		break;
2254 	case CRYPTO_AES_ICM:
2255 		if (csp->csp_ivlen != AES_BLOCK_LEN)
2256 			return (false);
2257 		break;
2258 	case CRYPTO_AES_XTS:
2259 		if (csp->csp_ivlen != AES_XTS_IV_LEN)
2260 			return (false);
2261 		break;
2262 	default:
2263 		return (false);
2264 	}
2265 	return (ccr_aes_check_keylen(csp->csp_cipher_alg,
2266 	    csp->csp_cipher_klen));
2267 }
2268 
2269 static int
2270 ccr_cipher_mode(const struct crypto_session_params *csp)
2271 {
2272 
2273 	switch (csp->csp_cipher_alg) {
2274 	case CRYPTO_AES_CBC:
2275 		return (SCMD_CIPH_MODE_AES_CBC);
2276 	case CRYPTO_AES_ICM:
2277 		return (SCMD_CIPH_MODE_AES_CTR);
2278 	case CRYPTO_AES_NIST_GCM_16:
2279 		return (SCMD_CIPH_MODE_AES_GCM);
2280 	case CRYPTO_AES_XTS:
2281 		return (SCMD_CIPH_MODE_AES_XTS);
2282 	case CRYPTO_AES_CCM_16:
2283 		return (SCMD_CIPH_MODE_AES_CCM);
2284 	default:
2285 		return (SCMD_CIPH_MODE_NOP);
2286 	}
2287 }
2288 
2289 static int
2290 ccr_probesession(device_t dev, const struct crypto_session_params *csp)
2291 {
2292 	unsigned int cipher_mode;
2293 
2294 	if (csp->csp_flags != 0)
2295 		return (EINVAL);
2296 	switch (csp->csp_mode) {
2297 	case CSP_MODE_DIGEST:
2298 		if (!ccr_auth_supported(csp))
2299 			return (EINVAL);
2300 		break;
2301 	case CSP_MODE_CIPHER:
2302 		if (!ccr_cipher_supported(csp))
2303 			return (EINVAL);
2304 		break;
2305 	case CSP_MODE_AEAD:
2306 		switch (csp->csp_cipher_alg) {
2307 		case CRYPTO_AES_NIST_GCM_16:
2308 			if (csp->csp_ivlen != AES_GCM_IV_LEN)
2309 				return (EINVAL);
2310 			if (csp->csp_auth_mlen < 0 ||
2311 			    csp->csp_auth_mlen > AES_GMAC_HASH_LEN)
2312 				return (EINVAL);
2313 			break;
2314 		case CRYPTO_AES_CCM_16:
2315 			if (csp->csp_ivlen != AES_CCM_IV_LEN)
2316 				return (EINVAL);
2317 			if (csp->csp_auth_mlen < 0 ||
2318 			    csp->csp_auth_mlen > AES_CBC_MAC_HASH_LEN)
2319 				return (EINVAL);
2320 			break;
2321 		default:
2322 			return (EINVAL);
2323 		}
2324 		break;
2325 	case CSP_MODE_ETA:
2326 		if (!ccr_auth_supported(csp) || !ccr_cipher_supported(csp))
2327 			return (EINVAL);
2328 		break;
2329 	default:
2330 		return (EINVAL);
2331 	}
2332 
2333 	if (csp->csp_cipher_klen != 0) {
2334 		cipher_mode = ccr_cipher_mode(csp);
2335 		if (cipher_mode == SCMD_CIPH_MODE_NOP)
2336 			return (EINVAL);
2337 	}
2338 
2339 	return (CRYPTODEV_PROBE_HARDWARE);
2340 }
2341 
2342 /*
2343  * Select an available port with the lowest number of active sessions.
2344  */
2345 static struct ccr_port *
2346 ccr_choose_port(struct ccr_softc *sc)
2347 {
2348 	struct ccr_port *best, *p;
2349 	int i;
2350 
2351 	mtx_assert(&sc->lock, MA_OWNED);
2352 	best = NULL;
2353 	for (i = 0; i < nitems(sc->ports); i++) {
2354 		p = &sc->ports[i];
2355 
2356 		/* Ignore non-existent ports. */
2357 		if (p->rxq == NULL)
2358 			continue;
2359 
2360 		/*
2361 		 * XXX: Ignore ports whose queues aren't initialized.
2362 		 * This is racy as the rxq can be destroyed by the
2363 		 * associated VI detaching.  Eventually ccr should use
2364 		 * dedicated queues.
2365 		 */
2366 		if (p->rxq->iq.adapter == NULL || p->txq->adapter == NULL)
2367 			continue;
2368 
2369 		if ((sc->port_mask & (1u << i)) == 0)
2370 			continue;
2371 
2372 		if (best == NULL ||
2373 		    p->active_sessions < best->active_sessions)
2374 			best = p;
2375 	}
2376 	return (best);
2377 }
2378 
2379 static int
2380 ccr_newsession(device_t dev, crypto_session_t cses,
2381     const struct crypto_session_params *csp)
2382 {
2383 	struct ccr_softc *sc;
2384 	struct ccr_session *s;
2385 	struct auth_hash *auth_hash;
2386 	unsigned int auth_mode, cipher_mode, mk_size;
2387 	unsigned int partial_digest_len;
2388 
2389 	switch (csp->csp_auth_alg) {
2390 	case CRYPTO_SHA1:
2391 	case CRYPTO_SHA1_HMAC:
2392 		auth_hash = &auth_hash_hmac_sha1;
2393 		auth_mode = SCMD_AUTH_MODE_SHA1;
2394 		mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_160;
2395 		partial_digest_len = SHA1_HASH_LEN;
2396 		break;
2397 	case CRYPTO_SHA2_224:
2398 	case CRYPTO_SHA2_224_HMAC:
2399 		auth_hash = &auth_hash_hmac_sha2_224;
2400 		auth_mode = SCMD_AUTH_MODE_SHA224;
2401 		mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_256;
2402 		partial_digest_len = SHA2_256_HASH_LEN;
2403 		break;
2404 	case CRYPTO_SHA2_256:
2405 	case CRYPTO_SHA2_256_HMAC:
2406 		auth_hash = &auth_hash_hmac_sha2_256;
2407 		auth_mode = SCMD_AUTH_MODE_SHA256;
2408 		mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_256;
2409 		partial_digest_len = SHA2_256_HASH_LEN;
2410 		break;
2411 	case CRYPTO_SHA2_384:
2412 	case CRYPTO_SHA2_384_HMAC:
2413 		auth_hash = &auth_hash_hmac_sha2_384;
2414 		auth_mode = SCMD_AUTH_MODE_SHA512_384;
2415 		mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_512;
2416 		partial_digest_len = SHA2_512_HASH_LEN;
2417 		break;
2418 	case CRYPTO_SHA2_512:
2419 	case CRYPTO_SHA2_512_HMAC:
2420 		auth_hash = &auth_hash_hmac_sha2_512;
2421 		auth_mode = SCMD_AUTH_MODE_SHA512_512;
2422 		mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_512;
2423 		partial_digest_len = SHA2_512_HASH_LEN;
2424 		break;
2425 	default:
2426 		auth_hash = NULL;
2427 		auth_mode = SCMD_AUTH_MODE_NOP;
2428 		mk_size = 0;
2429 		partial_digest_len = 0;
2430 		break;
2431 	}
2432 
2433 	cipher_mode = ccr_cipher_mode(csp);
2434 
2435 #ifdef INVARIANTS
2436 	switch (csp->csp_mode) {
2437 	case CSP_MODE_CIPHER:
2438 		if (cipher_mode == SCMD_CIPH_MODE_NOP ||
2439 		    cipher_mode == SCMD_CIPH_MODE_AES_GCM ||
2440 		    cipher_mode == SCMD_CIPH_MODE_AES_CCM)
2441 			panic("invalid cipher algo");
2442 		break;
2443 	case CSP_MODE_DIGEST:
2444 		if (auth_mode == SCMD_AUTH_MODE_NOP)
2445 			panic("invalid auth algo");
2446 		break;
2447 	case CSP_MODE_AEAD:
2448 		if (cipher_mode != SCMD_CIPH_MODE_AES_GCM &&
2449 		    cipher_mode != SCMD_CIPH_MODE_AES_CCM)
2450 			panic("invalid aead cipher algo");
2451 		if (auth_mode != SCMD_AUTH_MODE_NOP)
2452 			panic("invalid aead auth aglo");
2453 		break;
2454 	case CSP_MODE_ETA:
2455 		if (cipher_mode == SCMD_CIPH_MODE_NOP ||
2456 		    cipher_mode == SCMD_CIPH_MODE_AES_GCM ||
2457 		    cipher_mode == SCMD_CIPH_MODE_AES_CCM)
2458 			panic("invalid cipher algo");
2459 		if (auth_mode == SCMD_AUTH_MODE_NOP)
2460 			panic("invalid auth algo");
2461 		break;
2462 	default:
2463 		panic("invalid csp mode");
2464 	}
2465 #endif
2466 
2467 	sc = device_get_softc(dev);
2468 
2469 	mtx_lock(&sc->lock);
2470 	if (sc->detaching) {
2471 		mtx_unlock(&sc->lock);
2472 		return (ENXIO);
2473 	}
2474 
2475 	s = crypto_get_driver_session(cses);
2476 	s->port = ccr_choose_port(sc);
2477 	if (s->port == NULL) {
2478 		mtx_unlock(&sc->lock);
2479 		return (ENXIO);
2480 	}
2481 
2482 	switch (csp->csp_mode) {
2483 	case CSP_MODE_AEAD:
2484 		if (cipher_mode == SCMD_CIPH_MODE_AES_CCM)
2485 			s->mode = CCM;
2486 		else
2487 			s->mode = GCM;
2488 		break;
2489 	case CSP_MODE_ETA:
2490 		s->mode = ETA;
2491 		break;
2492 	case CSP_MODE_DIGEST:
2493 		if (csp->csp_auth_klen != 0)
2494 			s->mode = HMAC;
2495 		else
2496 			s->mode = HASH;
2497 		break;
2498 	case CSP_MODE_CIPHER:
2499 		s->mode = BLKCIPHER;
2500 		break;
2501 	}
2502 
2503 	if (s->mode == GCM) {
2504 		if (csp->csp_auth_mlen == 0)
2505 			s->gmac.hash_len = AES_GMAC_HASH_LEN;
2506 		else
2507 			s->gmac.hash_len = csp->csp_auth_mlen;
2508 		t4_init_gmac_hash(csp->csp_cipher_key, csp->csp_cipher_klen,
2509 		    s->gmac.ghash_h);
2510 	} else if (s->mode == CCM) {
2511 		if (csp->csp_auth_mlen == 0)
2512 			s->ccm_mac.hash_len = AES_CBC_MAC_HASH_LEN;
2513 		else
2514 			s->ccm_mac.hash_len = csp->csp_auth_mlen;
2515 	} else if (auth_mode != SCMD_AUTH_MODE_NOP) {
2516 		s->hmac.auth_hash = auth_hash;
2517 		s->hmac.auth_mode = auth_mode;
2518 		s->hmac.mk_size = mk_size;
2519 		s->hmac.partial_digest_len = partial_digest_len;
2520 		if (csp->csp_auth_mlen == 0)
2521 			s->hmac.hash_len = auth_hash->hashsize;
2522 		else
2523 			s->hmac.hash_len = csp->csp_auth_mlen;
2524 		if (csp->csp_auth_key != NULL)
2525 			t4_init_hmac_digest(auth_hash, partial_digest_len,
2526 			    csp->csp_auth_key, csp->csp_auth_klen,
2527 			    s->hmac.pads);
2528 		else
2529 			ccr_init_hash_digest(s);
2530 	}
2531 	if (cipher_mode != SCMD_CIPH_MODE_NOP) {
2532 		s->blkcipher.cipher_mode = cipher_mode;
2533 		s->blkcipher.iv_len = csp->csp_ivlen;
2534 		if (csp->csp_cipher_key != NULL)
2535 			ccr_aes_setkey(s, csp->csp_cipher_key,
2536 			    csp->csp_cipher_klen);
2537 	}
2538 
2539 	s->active = true;
2540 	s->port->active_sessions++;
2541 	mtx_unlock(&sc->lock);
2542 	return (0);
2543 }
2544 
2545 static void
2546 ccr_freesession(device_t dev, crypto_session_t cses)
2547 {
2548 	struct ccr_softc *sc;
2549 	struct ccr_session *s;
2550 
2551 	sc = device_get_softc(dev);
2552 	s = crypto_get_driver_session(cses);
2553 	mtx_lock(&sc->lock);
2554 	if (s->pending != 0)
2555 		device_printf(dev,
2556 		    "session %p freed with %d pending requests\n", s,
2557 		    s->pending);
2558 	s->active = false;
2559 	s->port->active_sessions--;
2560 	mtx_unlock(&sc->lock);
2561 }
2562 
2563 static int
2564 ccr_process(device_t dev, struct cryptop *crp, int hint)
2565 {
2566 	const struct crypto_session_params *csp;
2567 	struct ccr_softc *sc;
2568 	struct ccr_session *s;
2569 	int error;
2570 
2571 	csp = crypto_get_params(crp->crp_session);
2572 	s = crypto_get_driver_session(crp->crp_session);
2573 	sc = device_get_softc(dev);
2574 
2575 	mtx_lock(&sc->lock);
2576 	error = ccr_populate_sglist(sc->sg_crp, crp);
2577 	if (error) {
2578 		sc->stats_sglist_error++;
2579 		goto out;
2580 	}
2581 
2582 	switch (s->mode) {
2583 	case HASH:
2584 		error = ccr_hash(sc, s, crp);
2585 		if (error == 0)
2586 			sc->stats_hash++;
2587 		break;
2588 	case HMAC:
2589 		if (crp->crp_auth_key != NULL)
2590 			t4_init_hmac_digest(s->hmac.auth_hash,
2591 			    s->hmac.partial_digest_len, crp->crp_auth_key,
2592 			    csp->csp_auth_klen, s->hmac.pads);
2593 		error = ccr_hash(sc, s, crp);
2594 		if (error == 0)
2595 			sc->stats_hmac++;
2596 		break;
2597 	case BLKCIPHER:
2598 		if (crp->crp_cipher_key != NULL)
2599 			ccr_aes_setkey(s, crp->crp_cipher_key,
2600 			    csp->csp_cipher_klen);
2601 		error = ccr_blkcipher(sc, s, crp);
2602 		if (error == 0) {
2603 			if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
2604 				sc->stats_blkcipher_encrypt++;
2605 			else
2606 				sc->stats_blkcipher_decrypt++;
2607 		}
2608 		break;
2609 	case ETA:
2610 		if (crp->crp_auth_key != NULL)
2611 			t4_init_hmac_digest(s->hmac.auth_hash,
2612 			    s->hmac.partial_digest_len, crp->crp_auth_key,
2613 			    csp->csp_auth_klen, s->hmac.pads);
2614 		if (crp->crp_cipher_key != NULL)
2615 			ccr_aes_setkey(s, crp->crp_cipher_key,
2616 			    csp->csp_cipher_klen);
2617 		error = ccr_eta(sc, s, crp);
2618 		if (error == 0) {
2619 			if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
2620 				sc->stats_eta_encrypt++;
2621 			else
2622 				sc->stats_eta_decrypt++;
2623 		}
2624 		break;
2625 	case GCM:
2626 		if (crp->crp_cipher_key != NULL) {
2627 			t4_init_gmac_hash(crp->crp_cipher_key,
2628 			    csp->csp_cipher_klen, s->gmac.ghash_h);
2629 			ccr_aes_setkey(s, crp->crp_cipher_key,
2630 			    csp->csp_cipher_klen);
2631 		}
2632 		if (crp->crp_payload_length == 0) {
2633 			mtx_unlock(&sc->lock);
2634 			ccr_gcm_soft(s, crp);
2635 			return (0);
2636 		}
2637 		error = ccr_gcm(sc, s, crp);
2638 		if (error == EMSGSIZE) {
2639 			sc->stats_sw_fallback++;
2640 			mtx_unlock(&sc->lock);
2641 			ccr_gcm_soft(s, crp);
2642 			return (0);
2643 		}
2644 		if (error == 0) {
2645 			if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
2646 				sc->stats_gcm_encrypt++;
2647 			else
2648 				sc->stats_gcm_decrypt++;
2649 		}
2650 		break;
2651 	case CCM:
2652 		if (crp->crp_cipher_key != NULL) {
2653 			ccr_aes_setkey(s, crp->crp_cipher_key,
2654 			    csp->csp_cipher_klen);
2655 		}
2656 		error = ccr_ccm(sc, s, crp);
2657 		if (error == EMSGSIZE) {
2658 			sc->stats_sw_fallback++;
2659 			mtx_unlock(&sc->lock);
2660 			ccr_ccm_soft(s, crp);
2661 			return (0);
2662 		}
2663 		if (error == 0) {
2664 			if (CRYPTO_OP_IS_ENCRYPT(crp->crp_op))
2665 				sc->stats_ccm_encrypt++;
2666 			else
2667 				sc->stats_ccm_decrypt++;
2668 		}
2669 		break;
2670 	}
2671 
2672 	if (error == 0) {
2673 		s->pending++;
2674 		sc->stats_inflight++;
2675 	} else
2676 		sc->stats_process_error++;
2677 
2678 out:
2679 	mtx_unlock(&sc->lock);
2680 
2681 	if (error) {
2682 		crp->crp_etype = error;
2683 		crypto_done(crp);
2684 	}
2685 
2686 	return (0);
2687 }
2688 
2689 static int
2690 do_cpl6_fw_pld(struct sge_iq *iq, const struct rss_header *rss,
2691     struct mbuf *m)
2692 {
2693 	struct ccr_softc *sc = iq->adapter->ccr_softc;
2694 	struct ccr_session *s;
2695 	const struct cpl_fw6_pld *cpl;
2696 	struct cryptop *crp;
2697 	uint32_t status;
2698 	int error;
2699 
2700 	if (m != NULL)
2701 		cpl = mtod(m, const void *);
2702 	else
2703 		cpl = (const void *)(rss + 1);
2704 
2705 	crp = (struct cryptop *)(uintptr_t)be64toh(cpl->data[1]);
2706 	s = crypto_get_driver_session(crp->crp_session);
2707 	status = be64toh(cpl->data[0]);
2708 	if (CHK_MAC_ERR_BIT(status) || CHK_PAD_ERR_BIT(status))
2709 		error = EBADMSG;
2710 	else
2711 		error = 0;
2712 
2713 	mtx_lock(&sc->lock);
2714 	s->pending--;
2715 	sc->stats_inflight--;
2716 
2717 	switch (s->mode) {
2718 	case HASH:
2719 	case HMAC:
2720 		error = ccr_hash_done(sc, s, crp, cpl, error);
2721 		break;
2722 	case BLKCIPHER:
2723 		error = ccr_blkcipher_done(sc, s, crp, cpl, error);
2724 		break;
2725 	case ETA:
2726 		error = ccr_eta_done(sc, s, crp, cpl, error);
2727 		break;
2728 	case GCM:
2729 		error = ccr_gcm_done(sc, s, crp, cpl, error);
2730 		break;
2731 	case CCM:
2732 		error = ccr_ccm_done(sc, s, crp, cpl, error);
2733 		break;
2734 	}
2735 
2736 	if (error == EBADMSG) {
2737 		if (CHK_MAC_ERR_BIT(status))
2738 			sc->stats_mac_error++;
2739 		if (CHK_PAD_ERR_BIT(status))
2740 			sc->stats_pad_error++;
2741 	}
2742 	mtx_unlock(&sc->lock);
2743 	crp->crp_etype = error;
2744 	crypto_done(crp);
2745 	m_freem(m);
2746 	return (0);
2747 }
2748 
2749 static int
2750 ccr_modevent(module_t mod, int cmd, void *arg)
2751 {
2752 
2753 	switch (cmd) {
2754 	case MOD_LOAD:
2755 		t4_register_cpl_handler(CPL_FW6_PLD, do_cpl6_fw_pld);
2756 		return (0);
2757 	case MOD_UNLOAD:
2758 		t4_register_cpl_handler(CPL_FW6_PLD, NULL);
2759 		return (0);
2760 	default:
2761 		return (EOPNOTSUPP);
2762 	}
2763 }
2764 
2765 static device_method_t ccr_methods[] = {
2766 	DEVMETHOD(device_identify,	ccr_identify),
2767 	DEVMETHOD(device_probe,		ccr_probe),
2768 	DEVMETHOD(device_attach,	ccr_attach),
2769 	DEVMETHOD(device_detach,	ccr_detach),
2770 
2771 	DEVMETHOD(cryptodev_probesession, ccr_probesession),
2772 	DEVMETHOD(cryptodev_newsession,	ccr_newsession),
2773 	DEVMETHOD(cryptodev_freesession, ccr_freesession),
2774 	DEVMETHOD(cryptodev_process,	ccr_process),
2775 
2776 	DEVMETHOD_END
2777 };
2778 
2779 static driver_t ccr_driver = {
2780 	"ccr",
2781 	ccr_methods,
2782 	sizeof(struct ccr_softc)
2783 };
2784 
2785 static devclass_t ccr_devclass;
2786 
2787 DRIVER_MODULE(ccr, t6nex, ccr_driver, ccr_devclass, ccr_modevent, NULL);
2788 MODULE_VERSION(ccr, 1);
2789 MODULE_DEPEND(ccr, crypto, 1, 1, 1);
2790 MODULE_DEPEND(ccr, t6nex, 1, 1, 1);
2791