ethdev: hide internal structures
[dpdk.git] / drivers / crypto / octeontx2 / otx2_cryptodev_ops.c
index 9d51b17..f0b72e0 100644 (file)
@@ -4,15 +4,18 @@
 
 #include <unistd.h>
 
-#include <rte_cryptodev_pmd.h>
+#include <cryptodev_pmd.h>
 #include <rte_errno.h>
-#include <rte_ethdev.h>
+#include <ethdev_driver.h>
+#include <rte_event_crypto_adapter.h>
 
 #include "otx2_cryptodev.h"
 #include "otx2_cryptodev_capabilities.h"
 #include "otx2_cryptodev_hw_access.h"
 #include "otx2_cryptodev_mbox.h"
 #include "otx2_cryptodev_ops.h"
+#include "otx2_cryptodev_ops_helper.h"
+#include "otx2_ipsec_anti_replay.h"
 #include "otx2_ipsec_po_ops.h"
 #include "otx2_mbox.h"
 #include "otx2_sec_idev.h"
@@ -42,12 +45,13 @@ qp_memzone_name_get(char *name, int size, int dev_id, int qp_id)
 static int
 otx2_cpt_metabuf_mempool_create(const struct rte_cryptodev *dev,
                                struct otx2_cpt_qp *qp, uint8_t qp_id,
-                               int nb_elements)
+                               unsigned int nb_elements)
 {
        char mempool_name[RTE_MEMPOOL_NAMESIZE];
        struct cpt_qp_meta_info *meta_info;
+       int lcore_cnt = rte_lcore_count();
+       int ret, max_mlen, mb_pool_sz;
        struct rte_mempool *pool;
-       int ret, max_mlen;
        int asym_mlen = 0;
        int lb_mlen = 0;
        int sg_mlen = 0;
@@ -84,7 +88,15 @@ otx2_cpt_metabuf_mempool_create(const struct rte_cryptodev *dev,
        snprintf(mempool_name, RTE_MEMPOOL_NAMESIZE, "otx2_cpt_mb_%u:%u",
                 dev->data->dev_id, qp_id);
 
-       pool = rte_mempool_create_empty(mempool_name, nb_elements, max_mlen,
+       mb_pool_sz = nb_elements;
+
+       /* For poll mode, core that enqueues and core that dequeues can be
+        * different. For event mode, all cores are allowed to use same crypto
+        * queue pair.
+        */
+       mb_pool_sz += (RTE_MAX(2, lcore_cnt) * METABUF_POOL_CACHE_SIZE);
+
+       pool = rte_mempool_create_empty(mempool_name, mb_pool_sz, max_mlen,
                                        METABUF_POOL_CACHE_SIZE, 0,
                                        rte_socket_id(), 0);
 
@@ -182,7 +194,13 @@ otx2_cpt_qp_create(const struct rte_cryptodev *dev, uint16_t qp_id,
                return NULL;
        }
 
-       iq_len = OTX2_CPT_IQ_LEN;
+       /*
+        * Pending queue updates make assumption that queue size is a power
+        * of 2.
+        */
+       RTE_BUILD_BUG_ON(!RTE_IS_POWER_OF_2(OTX2_CPT_DEFAULT_CMD_QLEN));
+
+       iq_len = OTX2_CPT_DEFAULT_CMD_QLEN;
 
        /*
         * Queue size must be a multiple of 40 and effective queue size to
@@ -191,7 +209,7 @@ otx2_cpt_qp_create(const struct rte_cryptodev *dev, uint16_t qp_id,
        size_div40 = (iq_len + 40 - 1) / 40 + 1;
 
        /* For pending queue */
-       len = iq_len * RTE_ALIGN(sizeof(struct rid), 8);
+       len = iq_len * RTE_ALIGN(sizeof(qp->pend_q.rid_queue[0]), 8);
 
        /* Space for instruction group memory */
        len += size_div40 * 16;
@@ -200,7 +218,7 @@ otx2_cpt_qp_create(const struct rte_cryptodev *dev, uint16_t qp_id,
        len = RTE_ALIGN(len, pg_sz);
 
        /* For instruction queues */
-       len += OTX2_CPT_IQ_LEN * sizeof(union cpt_inst_s);
+       len += OTX2_CPT_DEFAULT_CMD_QLEN * sizeof(union cpt_inst_s);
 
        /* Wastage after instruction queues */
        len = RTE_ALIGN(len, pg_sz);
@@ -228,19 +246,19 @@ otx2_cpt_qp_create(const struct rte_cryptodev *dev, uint16_t qp_id,
        }
 
        /* Initialize pending queue */
-       qp->pend_q.rid_queue = (struct rid *)va;
-       qp->pend_q.enq_tail = 0;
-       qp->pend_q.deq_head = 0;
-       qp->pend_q.pending_count = 0;
+       qp->pend_q.rid_queue = (void **)va;
+       qp->pend_q.tail = 0;
+       qp->pend_q.head = 0;
 
-       used_len = iq_len * RTE_ALIGN(sizeof(struct rid), 8);
+       used_len = iq_len * RTE_ALIGN(sizeof(qp->pend_q.rid_queue[0]), 8);
        used_len += size_div40 * 16;
        used_len = RTE_ALIGN(used_len, pg_sz);
        iova += used_len;
 
        qp->iq_dma_addr = iova;
        qp->id = qp_id;
-       qp->base = OTX2_CPT_LF_BAR2(vf, qp_id);
+       qp->blkaddr = vf->lf_blkaddr[qp_id];
+       qp->base = OTX2_CPT_LF_BAR2(vf, qp->blkaddr, qp_id);
 
        lmtline = vf->otx2_dev.bar2 +
                  (RVU_BLOCK_ADDR_LMT << 20 | qp_id << 12) +
@@ -319,12 +337,16 @@ sym_xform_verify(struct rte_crypto_sym_xform *xform)
        if (xform->next) {
                if (xform->type == RTE_CRYPTO_SYM_XFORM_AUTH &&
                    xform->next->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
-                   xform->next->cipher.op == RTE_CRYPTO_CIPHER_OP_ENCRYPT)
+                   xform->next->cipher.op == RTE_CRYPTO_CIPHER_OP_ENCRYPT &&
+                   (xform->auth.algo != RTE_CRYPTO_AUTH_SHA1_HMAC ||
+                    xform->next->cipher.algo != RTE_CRYPTO_CIPHER_AES_CBC))
                        return -ENOTSUP;
 
                if (xform->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
                    xform->cipher.op == RTE_CRYPTO_CIPHER_OP_DECRYPT &&
-                   xform->next->type == RTE_CRYPTO_SYM_XFORM_AUTH)
+                   xform->next->type == RTE_CRYPTO_SYM_XFORM_AUTH &&
+                   (xform->cipher.algo != RTE_CRYPTO_CIPHER_AES_CBC ||
+                    xform->next->auth.algo != RTE_CRYPTO_AUTH_SHA1_HMAC))
                        return -ENOTSUP;
 
                if (xform->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
@@ -353,7 +375,9 @@ sym_session_configure(int driver_id, struct rte_crypto_sym_xform *xform,
                      struct rte_cryptodev_sym_session *sess,
                      struct rte_mempool *pool)
 {
+       struct rte_crypto_sym_xform *temp_xform = xform;
        struct cpt_sess_misc *misc;
+       vq_cmd_word3_t vq_cmd_w3;
        void *priv;
        int ret;
 
@@ -367,7 +391,7 @@ sym_session_configure(int driver_id, struct rte_crypto_sym_xform *xform,
        }
 
        memset(priv, 0, sizeof(struct cpt_sess_misc) +
-                       offsetof(struct cpt_ctx, fctx));
+                       offsetof(struct cpt_ctx, mc_ctx));
 
        misc = priv;
 
@@ -393,20 +417,38 @@ sym_session_configure(int driver_id, struct rte_crypto_sym_xform *xform,
                        goto priv_put;
        }
 
+       if ((GET_SESS_FC_TYPE(misc) == HASH_HMAC) &&
+                       cpt_mac_len_verify(&temp_xform->auth)) {
+               CPT_LOG_ERR("MAC length is not supported");
+               struct cpt_ctx *ctx = SESS_PRIV(misc);
+               if (ctx->auth_key != NULL) {
+                       rte_free(ctx->auth_key);
+                       ctx->auth_key = NULL;
+               }
+               ret = -ENOTSUP;
+               goto priv_put;
+       }
+
        set_sym_session_private_data(sess, driver_id, misc);
 
        misc->ctx_dma_addr = rte_mempool_virt2iova(misc) +
                             sizeof(struct cpt_sess_misc);
 
+       vq_cmd_w3.u64 = 0;
+       vq_cmd_w3.s.cptr = misc->ctx_dma_addr + offsetof(struct cpt_ctx,
+                                                        mc_ctx);
+
        /*
         * IE engines support IPsec operations
         * SE engines support IPsec operations, Chacha-Poly and
         * Air-Crypto operations
         */
        if (misc->zsk_flag || misc->chacha_poly)
-               misc->egrp = OTX2_CPT_EGRP_SE;
+               vq_cmd_w3.s.grp = OTX2_CPT_EGRP_SE;
        else
-               misc->egrp = OTX2_CPT_EGRP_SE_IE;
+               vq_cmd_w3.s.grp = OTX2_CPT_EGRP_SE_IE;
+
+       misc->cpt_inst_w7 = vq_cmd_w3.u64;
 
        return 0;
 
@@ -416,35 +458,83 @@ priv_put:
        return -ENOTSUP;
 }
 
-static void
-sym_session_clear(int driver_id, struct rte_cryptodev_sym_session *sess)
+static __rte_always_inline int32_t __rte_hot
+otx2_ca_enqueue_req(const struct otx2_cpt_qp *qp,
+                   struct cpt_request_info *req,
+                   void *lmtline,
+                   struct rte_crypto_op *op,
+                   uint64_t cpt_inst_w7)
 {
-       void *priv = get_sym_session_private_data(sess, driver_id);
-       struct rte_mempool *pool;
+       union rte_event_crypto_metadata *m_data;
+       union cpt_inst_s inst;
+       uint64_t lmt_status;
 
-       if (priv == NULL)
-               return;
+       if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION) {
+               m_data = rte_cryptodev_sym_session_get_user_data(
+                                               op->sym->session);
+               if (m_data == NULL) {
+                       rte_pktmbuf_free(op->sym->m_src);
+                       rte_crypto_op_free(op);
+                       rte_errno = EINVAL;
+                       return -EINVAL;
+               }
+       } else if (op->sess_type == RTE_CRYPTO_OP_SESSIONLESS &&
+                  op->private_data_offset) {
+               m_data = (union rte_event_crypto_metadata *)
+                        ((uint8_t *)op +
+                         op->private_data_offset);
+       } else {
+               return -EINVAL;
+       }
 
-       memset(priv, 0, cpt_get_session_size());
+       inst.u[0] = 0;
+       inst.s9x.res_addr = req->comp_baddr;
+       inst.u[2] = 0;
+       inst.u[3] = 0;
+
+       inst.s9x.ei0 = req->ist.ei0;
+       inst.s9x.ei1 = req->ist.ei1;
+       inst.s9x.ei2 = req->ist.ei2;
+       inst.s9x.ei3 = cpt_inst_w7;
 
-       pool = rte_mempool_from_obj(priv);
+       inst.u[2] = (((RTE_EVENT_TYPE_CRYPTODEV << 28) |
+                     m_data->response_info.flow_id) |
+                    ((uint64_t)m_data->response_info.sched_type << 32) |
+                    ((uint64_t)m_data->response_info.queue_id << 34));
+       inst.u[3] = 1 | (((uint64_t)req >> 3) << 3);
+       req->qp = qp;
 
-       set_sym_session_private_data(sess, driver_id, NULL);
+       do {
+               /* Copy CPT command to LMTLINE */
+               memcpy(lmtline, &inst, sizeof(inst));
 
-       rte_mempool_put(pool, priv);
+               /*
+                * Make sure compiler does not reorder memcpy and ldeor.
+                * LMTST transactions are always flushed from the write
+                * buffer immediately, a DMB is not required to push out
+                * LMTSTs.
+                */
+               rte_io_wmb();
+               lmt_status = otx2_lmt_submit(qp->lf_nq_reg);
+       } while (lmt_status == 0);
+
+       return 0;
 }
 
 static __rte_always_inline int32_t __rte_hot
 otx2_cpt_enqueue_req(const struct otx2_cpt_qp *qp,
                     struct pending_queue *pend_q,
-                    struct cpt_request_info *req)
+                    struct cpt_request_info *req,
+                    struct rte_crypto_op *op,
+                    uint64_t cpt_inst_w7,
+                    unsigned int burst_index)
 {
        void *lmtline = qp->lmtline;
        union cpt_inst_s inst;
        uint64_t lmt_status;
 
-       if (unlikely(pend_q->pending_count >= OTX2_CPT_DEFAULT_CMD_QLEN))
-               return -EAGAIN;
+       if (qp->ca_enable)
+               return otx2_ca_enqueue_req(qp, req, lmtline, op, cpt_inst_w7);
 
        inst.u[0] = 0;
        inst.s9x.res_addr = req->comp_baddr;
@@ -454,7 +544,7 @@ otx2_cpt_enqueue_req(const struct otx2_cpt_qp *qp,
        inst.s9x.ei0 = req->ist.ei0;
        inst.s9x.ei1 = req->ist.ei1;
        inst.s9x.ei2 = req->ist.ei2;
-       inst.s9x.ei3 = req->ist.ei3;
+       inst.s9x.ei3 = cpt_inst_w7;
 
        req->time_out = rte_get_timer_cycles() +
                        DEFAULT_COMMAND_TIMEOUT * rte_get_timer_hz();
@@ -469,15 +559,11 @@ otx2_cpt_enqueue_req(const struct otx2_cpt_qp *qp,
                 * buffer immediately, a DMB is not required to push out
                 * LMTSTs.
                 */
-               rte_cio_wmb();
+               rte_io_wmb();
                lmt_status = otx2_lmt_submit(qp->lf_nq_reg);
        } while (lmt_status == 0);
 
-       pend_q->rid_queue[pend_q->enq_tail].rid = (uintptr_t)req;
-
-       /* We will use soft queue length here to limit requests */
-       MOD_INC(pend_q->enq_tail, OTX2_CPT_DEFAULT_CMD_QLEN);
-       pend_q->pending_count += 1;
+       pending_queue_push(pend_q, req, burst_index, OTX2_CPT_DEFAULT_CMD_QLEN);
 
        return 0;
 }
@@ -485,13 +571,13 @@ otx2_cpt_enqueue_req(const struct otx2_cpt_qp *qp,
 static __rte_always_inline int32_t __rte_hot
 otx2_cpt_enqueue_asym(struct otx2_cpt_qp *qp,
                      struct rte_crypto_op *op,
-                     struct pending_queue *pend_q)
+                     struct pending_queue *pend_q,
+                     unsigned int burst_index)
 {
        struct cpt_qp_meta_info *minfo = &qp->meta_info;
        struct rte_crypto_asym_op *asym_op = op->asym;
        struct asym_op_params params = {0};
        struct cpt_asym_sess_misc *sess;
-       vq_cmd_word3_t *w3;
        uintptr_t *cop;
        void *mdata;
        int ret;
@@ -546,12 +632,8 @@ otx2_cpt_enqueue_asym(struct otx2_cpt_qp *qp,
                goto req_fail;
        }
 
-       /* Set engine group of AE */
-       w3 = (vq_cmd_word3_t *)&params.req->ist.ei3;
-       w3->s.grp = OTX2_CPT_EGRP_AE;
-
-       ret = otx2_cpt_enqueue_req(qp, pend_q, params.req);
-
+       ret = otx2_cpt_enqueue_req(qp, pend_q, params.req, op,
+                                  sess->cpt_inst_w7, burst_index);
        if (unlikely(ret)) {
                CPT_LOG_DP_ERR("Could not enqueue crypto req");
                goto req_fail;
@@ -567,12 +649,11 @@ req_fail:
 
 static __rte_always_inline int __rte_hot
 otx2_cpt_enqueue_sym(struct otx2_cpt_qp *qp, struct rte_crypto_op *op,
-                    struct pending_queue *pend_q)
+                    struct pending_queue *pend_q, unsigned int burst_index)
 {
        struct rte_crypto_sym_op *sym_op = op->sym;
        struct cpt_request_info *req;
        struct cpt_sess_misc *sess;
-       vq_cmd_word3_t *w3;
        uint64_t cpt_op;
        void *mdata;
        int ret;
@@ -595,11 +676,8 @@ otx2_cpt_enqueue_sym(struct otx2_cpt_qp *qp, struct rte_crypto_op *op,
                return ret;
        }
 
-       w3 = ((vq_cmd_word3_t *)(&req->ist.ei3));
-       w3->s.grp = sess->egrp;
-
-       ret = otx2_cpt_enqueue_req(qp, pend_q, req);
-
+       ret = otx2_cpt_enqueue_req(qp, pend_q, req, op, sess->cpt_inst_w7,
+                                   burst_index);
        if (unlikely(ret)) {
                /* Free buffer allocated by fill params routines */
                free_op_meta(mdata, qp->meta_info.pool);
@@ -610,37 +688,82 @@ otx2_cpt_enqueue_sym(struct otx2_cpt_qp *qp, struct rte_crypto_op *op,
 
 static __rte_always_inline int __rte_hot
 otx2_cpt_enqueue_sec(struct otx2_cpt_qp *qp, struct rte_crypto_op *op,
-                    struct pending_queue *pend_q)
+                    struct pending_queue *pend_q,
+                    const unsigned int burst_index)
 {
+       uint32_t winsz, esn_low = 0, esn_hi = 0, seql = 0, seqh = 0;
+       struct rte_mbuf *m_src = op->sym->m_src;
        struct otx2_sec_session_ipsec_lp *sess;
        struct otx2_ipsec_po_sa_ctl *ctl_wrd;
+       struct otx2_ipsec_po_in_sa *sa;
        struct otx2_sec_session *priv;
        struct cpt_request_info *req;
+       uint64_t seq_in_sa, seq = 0;
+       uint8_t esn;
        int ret;
 
        priv = get_sec_session_private_data(op->sym->sec_session);
        sess = &priv->ipsec.lp;
+       sa = &sess->in_sa;
 
-       ctl_wrd = &sess->in_sa.ctl;
+       ctl_wrd = &sa->ctl;
+       esn = ctl_wrd->esn_en;
+       winsz = sa->replay_win_sz;
 
        if (ctl_wrd->direction == OTX2_IPSEC_PO_SA_DIRECTION_OUTBOUND)
                ret = process_outb_sa(op, sess, &qp->meta_info, (void **)&req);
-       else
+       else {
+               if (winsz) {
+                       esn_low = rte_be_to_cpu_32(sa->esn_low);
+                       esn_hi = rte_be_to_cpu_32(sa->esn_hi);
+                       seql = *rte_pktmbuf_mtod_offset(m_src, uint32_t *,
+                               sizeof(struct rte_ipv4_hdr) + 4);
+                       seql = rte_be_to_cpu_32(seql);
+
+                       if (!esn)
+                               seq = (uint64_t)seql;
+                       else {
+                               seqh = anti_replay_get_seqh(winsz, seql, esn_hi,
+                                               esn_low);
+                               seq = ((uint64_t)seqh << 32) | seql;
+                       }
+
+                       if (unlikely(seq == 0))
+                               return IPSEC_ANTI_REPLAY_FAILED;
+
+                       ret = anti_replay_check(sa->replay, seq, winsz);
+                       if (unlikely(ret)) {
+                               otx2_err("Anti replay check failed");
+                               return IPSEC_ANTI_REPLAY_FAILED;
+                       }
+               }
+
                ret = process_inb_sa(op, sess, &qp->meta_info, (void **)&req);
+       }
 
        if (unlikely(ret)) {
                otx2_err("Crypto req : op %p, ret 0x%x", op, ret);
                return ret;
        }
 
-       ret = otx2_cpt_enqueue_req(qp, pend_q, req);
+       ret = otx2_cpt_enqueue_req(qp, pend_q, req, op, sess->cpt_inst_w7,
+                                   burst_index);
+
+       if (winsz && esn) {
+               seq_in_sa = ((uint64_t)esn_hi << 32) | esn_low;
+               if (seq > seq_in_sa) {
+                       sa->esn_low = rte_cpu_to_be_32(seql);
+                       sa->esn_hi = rte_cpu_to_be_32(seqh);
+               }
+       }
 
        return ret;
 }
 
 static __rte_always_inline int __rte_hot
 otx2_cpt_enqueue_sym_sessless(struct otx2_cpt_qp *qp, struct rte_crypto_op *op,
-                             struct pending_queue *pend_q)
+                             struct pending_queue *pend_q,
+                             unsigned int burst_index)
 {
        const int driver_id = otx2_cryptodev_driver_id;
        struct rte_crypto_sym_op *sym_op = op->sym;
@@ -648,8 +771,8 @@ otx2_cpt_enqueue_sym_sessless(struct otx2_cpt_qp *qp, struct rte_crypto_op *op,
        int ret;
 
        /* Create temporary session */
-
-       if (rte_mempool_get(qp->sess_mp, (void **)&sess))
+       sess = rte_cryptodev_sym_session_create(qp->sess_mp);
+       if (sess == NULL)
                return -ENOMEM;
 
        ret = sym_session_configure(driver_id, sym_op->xform, sess,
@@ -659,7 +782,7 @@ otx2_cpt_enqueue_sym_sessless(struct otx2_cpt_qp *qp, struct rte_crypto_op *op,
 
        sym_op->session = sess;
 
-       ret = otx2_cpt_enqueue_sym(qp, op, pend_q);
+       ret = otx2_cpt_enqueue_sym(qp, op, pend_q, burst_index);
 
        if (unlikely(ret))
                goto priv_put;
@@ -684,23 +807,26 @@ otx2_cpt_enqueue_burst(void *qptr, struct rte_crypto_op **ops, uint16_t nb_ops)
 
        pend_q = &qp->pend_q;
 
-       nb_allowed = OTX2_CPT_DEFAULT_CMD_QLEN - pend_q->pending_count;
-       if (nb_ops > nb_allowed)
-               nb_ops = nb_allowed;
+       nb_allowed = pending_queue_free_slots(pend_q,
+                               OTX2_CPT_DEFAULT_CMD_QLEN, 0);
+       nb_ops = RTE_MIN(nb_ops, nb_allowed);
 
        for (count = 0; count < nb_ops; count++) {
                op = ops[count];
                if (op->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC) {
                        if (op->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION)
-                               ret = otx2_cpt_enqueue_sec(qp, op, pend_q);
+                               ret = otx2_cpt_enqueue_sec(qp, op, pend_q,
+                                                          count);
                        else if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION)
-                               ret = otx2_cpt_enqueue_sym(qp, op, pend_q);
+                               ret = otx2_cpt_enqueue_sym(qp, op, pend_q,
+                                                          count);
                        else
                                ret = otx2_cpt_enqueue_sym_sessless(qp, op,
-                                                                   pend_q);
+                                               pend_q, count);
                } else if (op->type == RTE_CRYPTO_OP_TYPE_ASYMMETRIC) {
                        if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION)
-                               ret = otx2_cpt_enqueue_asym(qp, op, pend_q);
+                               ret = otx2_cpt_enqueue_asym(qp, op, pend_q,
+                                                               count);
                        else
                                break;
                } else
@@ -710,6 +836,9 @@ otx2_cpt_enqueue_burst(void *qptr, struct rte_crypto_op **ops, uint16_t nb_ops)
                        break;
        }
 
+       if (unlikely(!qp->ca_enable))
+               pending_queue_commit(pend_q, count, OTX2_CPT_DEFAULT_CMD_QLEN);
+
        return count;
 }
 
@@ -785,7 +914,8 @@ otx2_cpt_asym_dequeue_ecdsa_op(struct rte_crypto_ecdsa_op_param *ecdsa,
 
        /* Separate out sign r and s components */
        memcpy(ecdsa->r.data, req->rptr, prime_len);
-       memcpy(ecdsa->s.data, req->rptr + ROUNDUP8(prime_len), prime_len);
+       memcpy(ecdsa->s.data, req->rptr + RTE_ALIGN_CEIL(prime_len, 8),
+              prime_len);
        ecdsa->r.length = prime_len;
        ecdsa->s.length = prime_len;
 }
@@ -798,7 +928,8 @@ otx2_cpt_asym_dequeue_ecpm_op(struct rte_crypto_ecpm_op_param *ecpm,
        int prime_len = ec_grp[ec->curveid].prime.length;
 
        memcpy(ecpm->r.x.data, req->rptr, prime_len);
-       memcpy(ecpm->r.y.data, req->rptr + ROUNDUP8(prime_len), prime_len);
+       memcpy(ecpm->r.y.data, req->rptr + RTE_ALIGN_CEIL(prime_len, 8),
+              prime_len);
        ecpm->r.x.length = prime_len;
        ecpm->r.y.length = prime_len;
 }
@@ -842,19 +973,29 @@ otx2_cpt_sec_post_process(struct rte_crypto_op *cop, uintptr_t *rsp)
        vq_cmd_word0_t *word0 = (vq_cmd_word0_t *)&req->ist.ei0;
        struct rte_crypto_sym_op *sym_op = cop->sym;
        struct rte_mbuf *m = sym_op->m_src;
+       struct rte_ipv6_hdr *ip6;
        struct rte_ipv4_hdr *ip;
-       uint16_t m_len;
+       uint16_t m_len = 0;
        int mdata_len;
        char *data;
 
        mdata_len = (int)rsp[3];
        rte_pktmbuf_trim(m, mdata_len);
 
-       if ((word0->s.opcode & 0xff) == OTX2_IPSEC_PO_PROCESS_IPSEC_INB) {
+       if (word0->s.opcode.major == OTX2_IPSEC_PO_PROCESS_IPSEC_INB) {
                data = rte_pktmbuf_mtod(m, char *);
-               ip = (struct rte_ipv4_hdr *)(data + OTX2_IPSEC_PO_INB_RPTR_HDR);
 
-               m_len = rte_be_to_cpu_16(ip->total_length);
+               if (rsp[4] == OTX2_IPSEC_PO_TRANSPORT ||
+                   rsp[4] == OTX2_IPSEC_PO_TUNNEL_IPV4) {
+                       ip = (struct rte_ipv4_hdr *)(data +
+                               OTX2_IPSEC_PO_INB_RPTR_HDR);
+                       m_len = rte_be_to_cpu_16(ip->total_length);
+               } else if (rsp[4] == OTX2_IPSEC_PO_TUNNEL_IPV6) {
+                       ip6 = (struct rte_ipv6_hdr *)(data +
+                               OTX2_IPSEC_PO_INB_RPTR_HDR);
+                       m_len = rte_be_to_cpu_16(ip6->payload_len) +
+                               sizeof(struct rte_ipv6_hdr);
+               }
 
                m->data_len = m_len;
                m->pkt_len = m_len;
@@ -866,6 +1007,8 @@ static inline void
 otx2_cpt_dequeue_post_process(struct otx2_cpt_qp *qp, struct rte_crypto_op *cop,
                              uintptr_t *rsp, uint8_t cc)
 {
+       unsigned int sz;
+
        if (cop->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC) {
                if (cop->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) {
                        if (likely(cc == OTX2_IPSEC_PO_CC_SUCCESS)) {
@@ -894,6 +1037,9 @@ otx2_cpt_dequeue_post_process(struct otx2_cpt_qp *qp, struct rte_crypto_op *cop,
                if (unlikely(cop->sess_type == RTE_CRYPTO_OP_SESSIONLESS)) {
                        sym_session_clear(otx2_cryptodev_driver_id,
                                          cop->sym->session);
+                       sz = rte_cryptodev_sym_get_existing_header_session_size(
+                                       cop->sym->session);
+                       memset(cop->sym->session, 0, sz);
                        rte_mempool_put(qp->sess_mp, cop->sym->session);
                        cop->sym->session = NULL;
                }
@@ -914,52 +1060,6 @@ otx2_cpt_dequeue_post_process(struct otx2_cpt_qp *qp, struct rte_crypto_op *cop,
        }
 }
 
-static __rte_always_inline uint8_t
-otx2_cpt_compcode_get(struct cpt_request_info *req)
-{
-       volatile struct cpt_res_s_9s *res;
-       uint8_t ret;
-
-       res = (volatile struct cpt_res_s_9s *)req->completion_addr;
-
-       if (unlikely(res->compcode == CPT_9X_COMP_E_NOTDONE)) {
-               if (rte_get_timer_cycles() < req->time_out)
-                       return ERR_REQ_PENDING;
-
-               CPT_LOG_DP_ERR("Request timed out");
-               return ERR_REQ_TIMEOUT;
-       }
-
-       if (likely(res->compcode == CPT_9X_COMP_E_GOOD)) {
-               ret = NO_ERR;
-               if (unlikely(res->uc_compcode)) {
-                       ret = res->uc_compcode;
-                       CPT_LOG_DP_DEBUG("Request failed with microcode error");
-                       CPT_LOG_DP_DEBUG("MC completion code 0x%x",
-                                        res->uc_compcode);
-               }
-       } else {
-               CPT_LOG_DP_DEBUG("HW completion code 0x%x", res->compcode);
-
-               ret = res->compcode;
-               switch (res->compcode) {
-               case CPT_9X_COMP_E_INSTERR:
-                       CPT_LOG_DP_ERR("Request failed with instruction error");
-                       break;
-               case CPT_9X_COMP_E_FAULT:
-                       CPT_LOG_DP_ERR("Request failed with DMA fault");
-                       break;
-               case CPT_9X_COMP_E_HWERR:
-                       CPT_LOG_DP_ERR("Request failed with hardware error");
-                       break;
-               default:
-                       CPT_LOG_DP_ERR("Request failed with unknown completion code");
-               }
-       }
-
-       return ret;
-}
-
 static uint16_t
 otx2_cpt_dequeue_burst(void *qptr, struct rte_crypto_op **ops, uint16_t nb_ops)
 {
@@ -969,20 +1069,21 @@ otx2_cpt_dequeue_burst(void *qptr, struct rte_crypto_op **ops, uint16_t nb_ops)
        struct cpt_request_info *req;
        struct rte_crypto_op *cop;
        uint8_t cc[nb_ops];
-       struct rid *rid;
        uintptr_t *rsp;
        void *metabuf;
 
        pend_q = &qp->pend_q;
 
-       nb_pending = pend_q->pending_count;
+       nb_pending = pending_queue_level(pend_q, OTX2_CPT_DEFAULT_CMD_QLEN);
+
+       /* Ensure pcount isn't read before data lands */
+       rte_atomic_thread_fence(__ATOMIC_ACQUIRE);
 
-       if (nb_ops > nb_pending)
-               nb_ops = nb_pending;
+       nb_ops = RTE_MIN(nb_ops, nb_pending);
 
        for (i = 0; i < nb_ops; i++) {
-               rid = &pend_q->rid_queue[pend_q->deq_head];
-               req = (struct cpt_request_info *)(rid->rid);
+               pending_queue_peek(pend_q, (void **)&req,
+                       OTX2_CPT_DEFAULT_CMD_QLEN, 0);
 
                cc[i] = otx2_cpt_compcode_get(req);
 
@@ -991,8 +1092,7 @@ otx2_cpt_dequeue_burst(void *qptr, struct rte_crypto_op **ops, uint16_t nb_ops)
 
                ops[i] = req->op;
 
-               MOD_INC(pend_q->deq_head, OTX2_CPT_DEFAULT_CMD_QLEN);
-               pend_q->pending_count -= 1;
+               pending_queue_pop(pend_q, OTX2_CPT_DEFAULT_CMD_QLEN);
        }
 
        nb_completed = i;
@@ -1013,6 +1113,15 @@ otx2_cpt_dequeue_burst(void *qptr, struct rte_crypto_op **ops, uint16_t nb_ops)
        return nb_completed;
 }
 
+void
+otx2_cpt_set_enqdeq_fns(struct rte_cryptodev *dev)
+{
+       dev->enqueue_burst = otx2_cpt_enqueue_burst;
+       dev->dequeue_burst = otx2_cpt_dequeue_burst;
+
+       rte_mb();
+}
+
 /* PMD ops */
 
 static int
@@ -1027,7 +1136,7 @@ otx2_cpt_dev_config(struct rte_cryptodev *dev,
                return -EINVAL;
        }
 
-       dev->feature_flags &= ~conf->ff_disable;
+       dev->feature_flags = otx2_cpt_default_ff_get() & ~conf->ff_disable;
 
        if (dev->feature_flags & RTE_CRYPTODEV_FF_ASYMMETRIC_CRYPTO) {
                /* Initialize shared FPM table */
@@ -1075,10 +1184,8 @@ otx2_cpt_dev_config(struct rte_cryptodev *dev,
                goto intr_unregister;
        }
 
-       dev->enqueue_burst = otx2_cpt_enqueue_burst;
-       dev->dequeue_burst = otx2_cpt_dequeue_burst;
+       otx2_cpt_set_enqdeq_fns(dev);
 
-       rte_mb();
        return 0;
 
 intr_unregister:
@@ -1141,7 +1248,7 @@ otx2_cpt_dev_info_get(struct rte_cryptodev *dev,
 
        if (info != NULL) {
                info->max_nb_queue_pairs = vf->max_queues;
-               info->feature_flags = dev->feature_flags;
+               info->feature_flags = otx2_cpt_default_ff_get();
                info->capabilities = otx2_cpt_capabilities_get();
                info->sym.max_nb_sessions = 0;
                info->driver_id = otx2_cryptodev_driver_id;
@@ -1253,6 +1360,7 @@ otx2_cpt_asym_session_cfg(struct rte_cryptodev *dev,
                          struct rte_mempool *pool)
 {
        struct cpt_asym_sess_misc *priv;
+       vq_cmd_word3_t vq_cmd_w3;
        int ret;
 
        CPT_PMD_INIT_FUNC_TRACE();
@@ -1273,7 +1381,12 @@ otx2_cpt_asym_session_cfg(struct rte_cryptodev *dev,
                return ret;
        }
 
+       vq_cmd_w3.u64 = 0;
+       vq_cmd_w3.s.grp = OTX2_CPT_EGRP_AE;
+       priv->cpt_inst_w7 = vq_cmd_w3.u64;
+
        set_asym_session_private_data(sess, dev->driver_id, priv);
+
        return 0;
 }