/*++

Copyright (c) 1997-2001  Microsoft Corporation

Module Name:

    offload.c

Abstract:

    This module contains the code that handles offload.

Author:

    ChunYe

Environment:

    Kernel mode

Revision History:

--*/


#include    "precomp.h"


VOID
IPSecFillHwAddSA(
    IN  PSA_TABLE_ENTRY pSA,
    IN  PUCHAR          Buf,
    IN  ULONG           Len
    )
/*++

Routine Description:

    Fills in the ADD_SA hw request from pSA

Arguments:

    pSA - the SA
    Buf - buffer to set info
    Len - length

Return Value:

    status of the operation

--*/
{
    POFFLOAD_IPSEC_ADD_SA           pAddSA = (POFFLOAD_IPSEC_ADD_SA)Buf;
    POFFLOAD_SECURITY_ASSOCIATION   pSAInfo;
    LONG    Index;
    ULONG   Offset = 0;

    pAddSA->NumSAs = (SHORT)pSA->sa_NumOps;
    pAddSA->SrcAddr = pSA->SA_SRC_ADDR;
    pAddSA->SrcMask = pSA->SA_SRC_MASK;
    pAddSA->DestAddr = pSA->SA_DEST_ADDR;
    pAddSA->DestMask = pSA->SA_DEST_MASK;
    pAddSA->Protocol = pSA->SA_PROTO;
    pAddSA->SrcPort = SA_SRC_PORT(pSA);
    pAddSA->DestPort = SA_DEST_PORT(pSA);

    if (pSA->sa_Flags & FLAGS_SA_OUTBOUND) {
        pAddSA->Flags |= OFFLOAD_OUTBOUND_SA;
    } else {
        pAddSA->Flags |= OFFLOAD_INBOUND_SA;
    }

    if (pSA->sa_Flags & FLAGS_SA_TUNNEL) {
        pAddSA->DestTunnelAddr = pSA->sa_TunnelAddr;
        pAddSA->SrcTunnelAddr = pSA->sa_SrcTunnelAddr;
    }

    for (Index = 0; Index < pSA->sa_NumOps; Index++) {
        pSAInfo = &pAddSA->SecAssoc[Index];

        pSAInfo->Operation = pSA->sa_Operation[Index];
        pSAInfo->SPI = pSA->sa_OtherSPIs[Index];
        pSAInfo->EXT_INT_ALGO = pSA->INT_ALGO(Index);
        pSAInfo->EXT_INT_KEYLEN = pSA->INT_KEYLEN(Index);
        pSAInfo->EXT_INT_ROUNDS = pSA->INT_ROUNDS(Index);

        pSAInfo->EXT_CONF_ALGO = pSA->CONF_ALGO(Index);
        pSAInfo->EXT_CONF_KEYLEN = pSA->CONF_KEYLEN(Index);
        pSAInfo->EXT_CONF_ROUNDS = pSA->CONF_ROUNDS(Index);

        //
        // now get the keys in
        //
        ASSERT(Len >= sizeof(OFFLOAD_IPSEC_ADD_SA) + pSA->INT_KEYLEN(Index) + pSA->CONF_KEYLEN(Index));

        RtlCopyMemory(  pAddSA->KeyMat + Offset,
                        pSA->CONF_KEY(Index),
                        pSA->CONF_KEYLEN(Index));

        RtlCopyMemory(  pAddSA->KeyMat + Offset + pSA->CONF_KEYLEN(Index),
                        pSA->INT_KEY(Index),
                        pSA->INT_KEYLEN(Index));

        Offset = pSA->INT_KEYLEN(Index) + pSA->CONF_KEYLEN(Index);
        pAddSA->KeyLen += Offset;

        IPSEC_DEBUG(HW, ("pAddSA: %lx, keylen: %lx, KeyMat: %lx\n", pAddSA, pAddSA->KeyLen, pAddSA->KeyMat));
    }
}


NDIS_STATUS
IPSecPlumbHw(
    IN  PVOID           DestIF,
    IN  PVOID           Buf,
    IN  ULONG           Len,
    IN  NDIS_OID        Oid
    )
/*++

Routine Description:

    Plumbs the input outbound and its corresponding inbound SA
    into the hw accelerator.

Arguments:

    DestIF - the IP Interface
    Buf - buffer to set info
    Len - length

Return Value:

    status of the operation

--*/
{
#if DBG
    NTSTATUS    status;

    if (Oid == OID_TCP_TASK_IPSEC_ADD_SA) {
        IPSEC_INCREMENT(NumAddSA);
    }
    if (Oid == OID_TCP_TASK_IPSEC_DELETE_SA) {
        IPSEC_INCREMENT(NumDelSA);
    }

    status = TCPIP_NDIS_REQUEST(DestIF,
                                NdisRequestSetInformation,
                                Oid,
                                Buf,
                                Len,
                                NULL);

    if (status == STATUS_SUCCESS) {
        if (Oid == OID_TCP_TASK_IPSEC_ADD_SA) {
            IPSEC_INCREMENT(NumAddSU);
        }
        if (Oid == OID_TCP_TASK_IPSEC_DELETE_SA) {
            IPSEC_INCREMENT(NumDelSU);
        }
    } else {
        if (Oid == OID_TCP_TASK_IPSEC_ADD_SA) {
            IPSEC_INCREMENT(NumAddFA);
        }
        if (Oid == OID_TCP_TASK_IPSEC_DELETE_SA) {
            IPSEC_INCREMENT(NumDelFA);
        }
    }

    return  status;
#else
    return TCPIP_NDIS_REQUEST(  DestIF,
                                NdisRequestSetInformation,
                                Oid,
                                Buf,
                                Len,
                                NULL);
#endif
}


NTSTATUS
IPSecSendOffload(
    IN  IPHeader UNALIGNED  *pIPHeader,
    IN  PNDIS_PACKET        Packet,
    IN  Interface           *DestIF,
    IN  PSA_TABLE_ENTRY     pSA,
    IN  PSA_TABLE_ENTRY     pNextSA,
    IN  PVOID               *ppSCContext,
    IN  BOOLEAN             *pfCryptoOnly
    )
{
    KIRQL                           kIrql;
    BOOLEAN                         fRefBumped = FALSE;
    NTSTATUS                        status = STATUS_UNSUCCESSFUL;
    PSA_TABLE_ENTRY                 pSaveSA = NULL;
    PIPSEC_SEND_COMPLETE_CONTEXT    pContext = NULL;
    PNDIS_IPSEC_PACKET_INFO         IPSecPktInfo = NULL;
    PNDIS_PACKET_EXTENSION          PktExt = NDIS_PACKET_EXTENSION_FROM_PACKET(Packet);

    IPSEC_DEBUG(HW, ("IPSecSendOffload: DestIF: %lx, DestIF->Flags: %lx\n", DestIF, DestIF->if_OffloadFlags));

    *pfCryptoOnly = FALSE;

    //
    // See if options are supported.
    //
    if (((pIPHeader->iph_verlen & (UCHAR)~IP_VER_FLAG) << 2) > sizeof(IPHeader) &&
        !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_V4_OPTIONS)) {
        status = STATUS_UNSUCCESSFUL;
        IPSEC_DEBUG(HW, ("Options present - not offloading the packet. HdrLen %d\n",
                    ((pIPHeader->iph_verlen & (UCHAR)~IP_VER_FLAG) << 2)));
        return (status);
    }

    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    do {
        if ((pSA->sa_Flags & FLAGS_SA_HW_PLUMBED) &&
            pSA->sa_IPIF == DestIF) {

            if (*ppSCContext == NULL) {
                pContext = IPSecAllocateSendCompleteCtx(IPSEC_TAG_HW);

                if (!pContext) {
                    IPSEC_DEBUG(HW, ("Failed to alloc. SendCtx\n"));
                    status = STATUS_INSUFFICIENT_RESOURCES;
                    IPSecFreePktInfo(IPSecPktInfo);
                    *ppSCContext = NULL;
                    break;
                }

                IPSEC_INCREMENT(g_ipsec.NumSends);

                IPSecZeroMemory(pContext, sizeof(IPSEC_SEND_COMPLETE_CONTEXT));

#if DBG
                RtlCopyMemory(pContext->Signature, "ISC5", 4);
#endif
                *ppSCContext = pContext;
            } else {
                pContext = *ppSCContext;
            }

            if (IPSecPktInfo == NULL) {
                if (IPSecPktInfo = IPSecAllocatePktInfo(IPSEC_TAG_HW_PKTINFO)) {
                    IPSecZeroMemory(IPSecPktInfo, sizeof(NDIS_IPSEC_PACKET_INFO));

                    pContext->Flags |= SCF_PKTINFO;
                    pContext->PktInfo = IPSecPktInfo;
                } else {
                    IPSEC_DEBUG(HW, ("Failed to alloc. PktInfo\n"));
                    status = STATUS_UNSUCCESSFUL;
                    break;
                }
            }

            PktExt->NdisPacketInfo[IpSecPacketInfo] = IPSecPktInfo;

            //
            // if this is the nextOperationSA
            //
            if (fRefBumped) {
                IPSEC_DEBUG(HW, ("Offloading... pSA: %lx, NextOffloadHandle %lx\n", pSA, pSA->sa_OffloadHandle));
                IPSecPktInfo->Transmit.NextOffloadHandle = pSA->sa_OffloadHandle;
            } else {
                IPSEC_DEBUG(HW, ("Offloading... pSA: %lx, OffloadHandle %lx\n", pSA, pSA->sa_OffloadHandle));
                IPSecPktInfo->Transmit.OffloadHandle = pSA->sa_OffloadHandle;
            }

            *pfCryptoOnly = TRUE;

            IPSEC_DEBUG(HW, ("Using Hw for SA->handle: %lx on IF: %lx IPSecPktInfo: %lx *pfCryptoOnly %d\n", pSA->sa_OffloadHandle, DestIF, IPSecPktInfo, *pfCryptoOnly));

            status = STATUS_SUCCESS;
        } else if (!(pSA->sa_Flags & FLAGS_SA_HW_PLUMB_FAILED) && !pSA->sa_IPIF) {
            PUCHAR  outBuf;
            ULONG   outLen;
            LONG    Index;

            pSA->sa_Flags |= FLAGS_SA_HW_PLUMB_FAILED;

            //
            // See if CryptoOnly mode is supported.
            //
            if (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_CRYPTO_ONLY)) {
                status = STATUS_UNSUCCESSFUL;
                break;
            }

            //
            // See if transport over tunnel mode is supported.
            //
            if (pNextSA &&
                !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_TPT_TUNNEL)) {
                status = STATUS_UNSUCCESSFUL;
                break;
            }

            //
            // No need to offload soft SAs.
            //
            if (pSA->sa_Operation[0] == None) {
                status = STATUS_UNSUCCESSFUL;
                break;
            }

            //
            // Tunnel required, but not supported, don't plumb.
            //
            if ((pSA->sa_Flags & FLAGS_SA_TUNNEL) &&
                ((IS_AH_SA(pSA) &&
                  !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_TUNNEL)) ||
                 (IS_ESP_SA(pSA) &&
                  !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_TUNNEL)))) {
                status = STATUS_UNSUCCESSFUL;
                break;
            }

            //
            // AH + ESP required, but not supported, don't plumb.
            //
            if (pSA->sa_NumOps > 1 &&
                !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_ESP)) {
                status = STATUS_UNSUCCESSFUL;
                break;
            }

            //
            // Check XMT capabilities.
            //
            if ((IS_AH_SA(pSA) &&
                !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_XMT)) ||
                (IS_ESP_SA(pSA) &&
                !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_XMT))) {
                status = STATUS_UNSUCCESSFUL;
                break;
            }

            outLen = sizeof(OFFLOAD_IPSEC_ADD_SA);

            for (Index = 0; Index < pSA->sa_NumOps; Index++) {
                //
                // Check offload capability bits with those in the SA.
                //
                if ((pSA->INT_ALGO(Index) == IPSEC_AH_MD5) &&
                    (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_MD5)) ||
                    ((pSA->INT_ALGO(Index) == IPSEC_AH_SHA) &&
                    (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_SHA_1))) ||
                    ((pSA->CONF_ALGO(Index) == IPSEC_ESP_NONE) &&
                    (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_NONE))) ||
                    ((pSA->CONF_ALGO(Index) == IPSEC_ESP_DES) &&
                    (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_DES))) ||
                    ((pSA->CONF_ALGO(Index) == IPSEC_ESP_3_DES) &&
                    (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_3_DES)))) {
                    status = STATUS_UNSUCCESSFUL;
                    goto out;
                }

                outLen += pSA->INT_KEYLEN(Index) + pSA->CONF_KEYLEN(Index);
            }

            //
            // This SA can be offloaded.
            //
            pSA->sa_Flags |= FLAGS_SA_OFFLOADABLE;

            IPSEC_DEBUG(HW, ("outLen: %lx\n", outLen));

            outBuf = IPSecAllocateMemory(outLen, IPSEC_TAG_HW_ADDSA);

            if (outBuf) {
                IPSecZeroMemory(outBuf, outLen);

                IPSecFillHwAddSA(pSA, outBuf, outLen);

                //
                // Bump the SA reference count to make sure they won't 
                // go away during the processing of the work item.
                //
                IPSecRefSA(pSA);

                //
                // Plumb the SA by scheduling a work item; the SA will
                // not be used for offload until plumbing succeeds.
                //
                IPSecBufferPlumbSA( DestIF,
                                    pSA,
                                    outBuf,
                                    outLen);

                //
                // Return failure here so the caller does it in software.
                //
                status = STATUS_UNSUCCESSFUL;
                break;
            } else {
                IPSEC_DEBUG(HW, ("Memory: Failed to plumb outboundSA: %lx on IF: %lx\n", pSA, DestIF));
                status = STATUS_UNSUCCESSFUL;
                break;
            }
        } else {
            status = STATUS_UNSUCCESSFUL;
            break;
        }

        if (pNextSA && !fRefBumped) {
            IPSEC_DEBUG(HW, ("RefBumped on SA: %lx\n", pSA));
            pSaveSA = pSA;
            pSA = pNextSA;
            fRefBumped = TRUE;
        } else {
            break;
        }
    } while (TRUE);

out:
    if (status == STATUS_SUCCESS && (*pfCryptoOnly)) {
        ASSERT(pContext);
        ASSERT(pContext->Flags & SCF_PKTINFO);

        if (fRefBumped) {
            IPSecRefSA(pSaveSA);
            IPSecRefSA(pNextSA);
            IPSEC_INCREMENT(pSaveSA->sa_NumSends);
            IPSEC_INCREMENT(pNextSA->sa_NumSends);
            pContext->pSA = pSaveSA;
            pContext->pNextSA = pNextSA;
        } else {
            IPSecRefSA(pSA);
            IPSEC_INCREMENT(pSA->sa_NumSends);
            pContext->pSA = pSA;
        }
    } else {
        if (IPSecPktInfo) {
            ASSERT(pContext);
            ASSERT(pContext->Flags & SCF_PKTINFO);

            IPSecFreePktInfo(pContext->PktInfo);

            pContext->Flags &= ~SCF_PKTINFO;
            pContext->PktInfo = NULL;

            PktExt->NdisPacketInfo[IpSecPacketInfo] = NULL;
        }

        status = STATUS_UNSUCCESSFUL;
        *pfCryptoOnly = FALSE;
    }

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);

    return  status;
}


NTSTATUS
IPSecRecvOffload(
    IN  IPHeader UNALIGNED  *pIPHeader,
    IN  Interface           *DestIF,
    IN  PSA_TABLE_ENTRY     pSA
    )
{
    KIRQL       kIrql;
    NTSTATUS    status = STATUS_UNSUCCESSFUL;

    IPSEC_DEBUG(HW, ("IPSecRecvOffload: DestIF: %lx, DestIF->Flags: %lx\n", DestIF, DestIF->if_OffloadFlags));

    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    if (!(pSA->sa_Flags & FLAGS_SA_HW_PLUMB_FAILED) &&
        !(pSA->sa_Flags & FLAGS_SA_HW_PLUMBED) &&
        !pSA->sa_IPIF) {
        PUCHAR  inBuf;
        ULONG   inLen;
        LONG    Index;

        pSA->sa_Flags |= FLAGS_SA_HW_PLUMB_FAILED;

        //
        // See if CryptoOnly mode is supported.
        //
        if (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_CRYPTO_ONLY)) {
            status = STATUS_UNSUCCESSFUL;
            goto out;
        }

        //
        // No need to offload soft SAs.
        //
        if (pSA->sa_Operation[0] == None) {
            status = STATUS_UNSUCCESSFUL;
            goto out;
        }

        //
        // Tunnel required, but not supported, don't plumb.
        //
        if ((pSA->sa_Flags & FLAGS_SA_TUNNEL) &&
            ((IS_AH_SA(pSA) &&
              !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_TUNNEL)) ||
             (IS_ESP_SA(pSA) &&
              !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_TUNNEL)))) {
            status = STATUS_UNSUCCESSFUL;
            goto out;
        }

        //
        // AH + ESP required, but not supported, don't plumb.
        //
        if (pSA->sa_NumOps > 1 &&
            !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_ESP)) {
            status = STATUS_UNSUCCESSFUL;
            goto out;
        }

        //
        // Check RCV capabilities.
        //
        if ((IS_AH_SA(pSA) &&
            !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_RCV)) ||
            (IS_ESP_SA(pSA) &&
            !(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_RCV))) {
            status = STATUS_UNSUCCESSFUL;
            goto out;
        }

        inLen = sizeof(OFFLOAD_IPSEC_ADD_SA);

        for (Index = 0; Index < pSA->sa_NumOps; Index++) {
            //
            // Check offload capability bits with those in the SA
            //
            if ((pSA->INT_ALGO(Index) == IPSEC_AH_MD5) &&
                (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_MD5)) ||
                ((pSA->INT_ALGO(Index) == IPSEC_AH_SHA) &&
                (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_AH_SHA_1))) ||
                ((pSA->CONF_ALGO(Index) == IPSEC_ESP_NONE) &&
                (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_NONE))) ||
                ((pSA->CONF_ALGO(Index) == IPSEC_ESP_DES) &&
                (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_DES))) ||
                ((pSA->CONF_ALGO(Index) == IPSEC_ESP_3_DES) &&
                (!(DestIF->if_OffloadFlags & IPSEC_OFFLOAD_ESP_3_DES)))) {
                status = STATUS_UNSUCCESSFUL;
                goto out;
            }

            inLen += pSA->INT_KEYLEN(Index) + pSA->CONF_KEYLEN(Index);
        }

        IPSEC_DEBUG(HW, ("inLen: %lx\n", inLen));

        inBuf = IPSecAllocateMemory(inLen, IPSEC_TAG_HW_ADDSA);

        if (inBuf) {
            IPSecZeroMemory(inBuf, inLen);

            IPSecFillHwAddSA(pSA, inBuf, inLen);

            //
            // Bump the SA reference count to make sure they won't 
            // go away during the processing of the work item.
            //
            IPSecRefSA(pSA);

            //
            // Plumb the SA by scheduling a work item; the SA will
            // not be used for offload until plumbing succeeds.
            //
            status = IPSecBufferPlumbSA(DestIF,
                                        pSA,
                                        inBuf,
                                        inLen);

            //
            // Return failure here so the caller does it in software.
            //
            status = STATUS_UNSUCCESSFUL;
            goto out;
        } else {
            IPSEC_DEBUG(HW, ("Memory: Failed to plumb inboundSA: %lx on IF: %lx\n", pSA, DestIF));
            status = STATUS_UNSUCCESSFUL;
            goto out;
        }
    }

out:
    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);

    return  status;
}


NTSTATUS
IPSecDelHWSA(
    IN  PSA_TABLE_ENTRY pSA
    )
{
    NTSTATUS    status = STATUS_SUCCESS;

    ASSERT(pSA->sa_Flags & FLAGS_SA_HW_PLUMBED);

    pSA->sa_Flags &= ~FLAGS_SA_HW_PLUMBED;
    pSA->sa_Flags |= FLAGS_SA_HW_PLUMB_FAILED;

    if ((pSA->sa_Flags & FLAGS_SA_OUTBOUND) &&
        IPSEC_GET_VALUE(pSA->sa_NumSends) > 0) {
        pSA->sa_Flags |= FLAGS_SA_HW_DELETE_SA;
        return  STATUS_PENDING;
    }

    pSA->sa_Flags &= ~FLAGS_SA_HW_DELETE_SA;
    pSA->sa_Flags |= FLAGS_SA_HW_DELETE_QUEUED;

    ASSERT(pSA->sa_IPIF);

    if (pSA->sa_IPIF) {
        status = IPSecPlumbHw(  pSA->sa_IPIF,
                                &pSA->sa_OffloadHandle,
                                sizeof(OFFLOAD_IPSEC_DELETE_SA),
                                OID_TCP_TASK_IPSEC_DELETE_SA);

        IPSEC_DEBUG(HWAPI, ("DelHWSA %s: %lx, handle: %lx, status: %lx\n",
                    (pSA->sa_Flags & FLAGS_SA_OUTBOUND)? "outbound": "inbound",
                    pSA,
                    pSA->sa_OffloadHandle,
                    status));

        IPSEC_DEC_STATISTIC(dwNumOffloadedSAs);

        IPSecDerefSA(pSA);
    }

    return status;
}


NTSTATUS
IPSecDelHWSAAtDpc(
    IN  PSA_TABLE_ENTRY pSA
    )
{
    ASSERT(pSA->sa_Flags & (FLAGS_SA_HW_PLUMBED | FLAGS_SA_HW_DELETE_SA));

    pSA->sa_Flags &= ~FLAGS_SA_HW_PLUMBED;
    pSA->sa_Flags |= FLAGS_SA_HW_PLUMB_FAILED;

    if ((pSA->sa_Flags & FLAGS_SA_OUTBOUND) &&
        IPSEC_GET_VALUE(pSA->sa_NumSends) > 0) {
        pSA->sa_Flags |= FLAGS_SA_HW_DELETE_SA;
        return  STATUS_PENDING;
    }

    pSA->sa_Flags &= ~FLAGS_SA_HW_DELETE_SA;
    pSA->sa_Flags |= FLAGS_SA_HW_DELETE_QUEUED;

    ASSERT(pSA->sa_IPIF);

    ExInitializeWorkItem(   &pSA->sa_QueueItem,
                            IPSecProcessDeleteSA,
                            (PVOID)pSA);

    ExQueueWorkItem(&pSA->sa_QueueItem, DelayedWorkQueue);
    
    IPSEC_INCREMENT(g_ipsec.NumWorkers);

    return STATUS_SUCCESS;
}


NTSTATUS
IPSecBufferPlumbSA(
    IN  Interface       *DestIF,
    IN  PSA_TABLE_ENTRY pSA,
    IN  PUCHAR          Buf,
    IN  ULONG           Len
    )
{
    PIPSEC_PLUMB_SA pPlumbSA;

    pPlumbSA = IPSecAllocateMemory(sizeof(IPSEC_PLUMB_SA), IPSEC_TAG_HW_PLUMB);
    if (pPlumbSA == NULL) {
        IPSecFreeMemory(Buf);

        if (pSA) {
            IPSecDerefSA(pSA);
        }

        return  STATUS_INSUFFICIENT_RESOURCES;
    }

    pPlumbSA->pSA = pSA;
    pPlumbSA->DestIF = DestIF;
    pPlumbSA->Buf = Buf;
    pPlumbSA->Len = Len;

    ExInitializeWorkItem(   &pPlumbSA->PlumbQueueItem,
                            IPSecProcessPlumbSA,
                            (PVOID)pPlumbSA);

    ExQueueWorkItem(&pPlumbSA->PlumbQueueItem, DelayedWorkQueue);
    
    IPSEC_INCREMENT(g_ipsec.NumWorkers);

    return STATUS_SUCCESS;
}


NTSTATUS
IPSecProcessPlumbSA(
    IN  PVOID   Context
    )
{
    PIPSEC_PLUMB_SA pPlumbSA = (PIPSEC_PLUMB_SA)Context;
    NTSTATUS        status = STATUS_SUCCESS;
    KIRQL           kIrql;
    Interface       *DestIF = pPlumbSA->DestIF;
    PSA_TABLE_ENTRY pSA = pPlumbSA->pSA;
    PUCHAR          Buf = pPlumbSA->Buf;
    ULONG           Len = pPlumbSA->Len;

    //
    // Plumb this SA into the hw if acceleration is enabled
    // on this card and it has not been plumbed already.
    //
    if (pSA) {
        IPSEC_DEBUG(HW, ("About to plumb outbound\n"));

        status = IPSecPlumbHw(  DestIF,
                                Buf,
                                Len,
                                OID_TCP_TASK_IPSEC_ADD_SA);

        IPSEC_DEBUG(HWAPI, ("AddHWSA %s: %lx, handle: %lx, status: %lx\n",
                    (pSA->sa_Flags & FLAGS_SA_OUTBOUND)? "outbound": "inbound",
                    pSA,
                    ((POFFLOAD_IPSEC_ADD_SA)Buf)->OffloadHandle,
                    status));

        AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

        pSA->sa_IPIF = DestIF;

        if (status != STATUS_SUCCESS) {
            IPSEC_DEBUG(HW, ("Failed to plumb SA: %lx on IF: %lx, status: %lx\n", pSA, DestIF, status));
            pSA->sa_Flags |= FLAGS_SA_HW_PLUMB_FAILED;
            IPSecDerefSA(pSA);
        } else {
            pSA->sa_OffloadHandle = ((POFFLOAD_IPSEC_ADD_SA)Buf)->OffloadHandle;

            IPSEC_DEBUG(HW, ("Success plumb SA: %lx, pSA->sa_OffloadHandle %lx\n", pSA, pSA->sa_OffloadHandle));

            pSA->sa_Flags |= FLAGS_SA_HW_PLUMBED;
            pSA->sa_Flags &= ~FLAGS_SA_HW_PLUMB_FAILED;

            IPSEC_INC_STATISTIC(dwNumOffloadedSAs);
        }

        if (status == STATUS_SUCCESS &&
            !(pSA->sa_State == STATE_SA_ACTIVE &&
             (pSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST) &&
             pSA->sa_AssociatedSA)) {
            //
            // SA got deleted before we plumb, call DelHWSA now since
            // HW_PLUMBED wasn't set when the SA was deleted.
            //
            IPSecDelHWSAAtDpc(pSA);
        }

        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);
    }

    IPSecFreeMemory(Buf);
    IPSecFreeMemory(pPlumbSA);

    IPSEC_DECREMENT(g_ipsec.NumWorkers);

    return status;
}


NTSTATUS
IPSecProcessDeleteSA(
    IN  PVOID   Context
    )
{
    PSA_TABLE_ENTRY pSA = (PSA_TABLE_ENTRY)Context;
    NTSTATUS        status;

    ASSERT(IPSEC_GET_VALUE(pSA->sa_NumSends) == 0);

    status = IPSecPlumbHw(  pSA->sa_IPIF,
                            &pSA->sa_OffloadHandle,
                            sizeof(OFFLOAD_IPSEC_DELETE_SA),
                            OID_TCP_TASK_IPSEC_DELETE_SA);

    IPSEC_DEBUG(HWAPI, ("ProcessDeleteSA %s: %lx, handle: %lx, status: %lx\n",
                (pSA->sa_Flags & FLAGS_SA_OUTBOUND)? "outbound": "inbound",
                pSA,
                pSA->sa_OffloadHandle,
                status));

    IPSEC_DEC_STATISTIC(dwNumOffloadedSAs);

    IPSecDerefSA(pSA);

    IPSEC_DECREMENT(g_ipsec.NumWorkers);

    return status;
}


NTSTATUS
IPSecNdisStatus(
    IN  PVOID       IPContext,
    IN  UINT        Status
    )
/*++

Routine Description:

    Notify Interface has a NDIS status change.

Arguments:

    IPContext   - This is the Interface notified of status change.

Return Value:

--*/
{
    IPSEC_DEBUG(HWAPI, ("IPSecNdisStatus %lx called for interface %lx\n", Status, IPContext));

    switch (Status) {
        case NDIS_STATUS_NETWORK_UNREACHABLE:
            IPSecDeleteIF(IPContext);
            break;

        case NDIS_STATUS_RESET_START:
            IPSecResetStart(IPContext);
            break;

        case NDIS_STATUS_RESET_END:
            IPSecResetEnd(IPContext);
            break;

        case NDIS_STATUS_INTERFACE_UP:
            IPSecWakeUp(IPContext);
            break;

        default:
            ASSERT(FALSE);
            break;
    }

    return  STATUS_SUCCESS;
}


VOID
IPSecDeleteIF(
    IN  PVOID       IPContext
    )
/*++

Routine Description:

    Notify Interface is deleted so need to clean up SA's that are offloaded
    on the deleted interface.

Arguments:

    IPContext   - This is the Interface being deleted.

Return Value:

--*/
{
    Interface       *DestIF = (Interface *)IPContext;
    PLIST_ENTRY     pFilterEntry;
    PLIST_ENTRY     pSAEntry;
    PFILTER         pFilter;
    PSA_TABLE_ENTRY pSA;
    KIRQL           kIrql;
    LONG            Index;
    LONG            SAIndex;

    IPSEC_DEBUG(HWAPI, ("IPSecDeleteIF called for interface %lx\n", DestIF));

    //
    // Go through all SA's and unmark the offload bits.
    //
    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    for (   Index = MIN_FILTER;
            Index <= MAX_FILTER;
            Index++) {

        for (   pFilterEntry = g_ipsec.FilterList[Index].Flink;
                pFilterEntry != &g_ipsec.FilterList[Index];
                pFilterEntry = pFilterEntry->Flink) {

            pFilter = CONTAINING_RECORD(pFilterEntry,
                                        FILTER,
                                        MaskedLinkage);

            for (   SAIndex = 0;
                    SAIndex < pFilter->SAChainSize;
                    SAIndex++) {

                for (   pSAEntry = pFilter->SAChain[SAIndex].Flink;
                        pSAEntry != &pFilter->SAChain[SAIndex];
                        pSAEntry = pSAEntry->Flink) {

                    pSA = CONTAINING_RECORD(pSAEntry,
                                            SA_TABLE_ENTRY,
                                            sa_FilterLinkage);

                    if ((pSA->sa_Flags & FLAGS_SA_HW_PLUMBED) &&
                        (DestIF == pSA->sa_IPIF)) {

                        pSA->sa_Flags &= ~FLAGS_SA_HW_PLUMBED;
                        pSA->sa_Flags |= FLAGS_SA_HW_PLUMB_FAILED;
                        pSA->sa_Flags &= ~FLAGS_SA_HW_DELETE_SA;

                        IPSEC_DEC_STATISTIC(dwNumOffloadedSAs);

#if DBG
                        NumReset++;
#endif

                        IPSecDerefSA(pSA);
                    }
                }
            }
        }
    }

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);
}


VOID
IPSecResetStart(
    IN  PVOID       IPContext
    )
/*++

Routine Description:

    Notify Interface is being reset.

Arguments:

    IPContext   - This is the Interface being reset.

Return Value:

--*/
{
    Interface       *DestIF = (Interface *)IPContext;
    PLIST_ENTRY     pFilterEntry;
    PLIST_ENTRY     pSAEntry;
    PFILTER         pFilter;
    PSA_TABLE_ENTRY pSA;
    KIRQL           kIrql;
    LONG            Index;
    LONG            SAIndex;

    IPSEC_DEBUG(HWAPI, ("IPSecResetStart called for interface %lx\n", DestIF));

    //
    // Go through all SA's and unmark the offload bits.
    //
    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    for (   Index = MIN_FILTER;
            Index <= MAX_FILTER;
            Index++) {

        for (   pFilterEntry = g_ipsec.FilterList[Index].Flink;
                pFilterEntry != &g_ipsec.FilterList[Index];
                pFilterEntry = pFilterEntry->Flink) {

            pFilter = CONTAINING_RECORD(pFilterEntry,
                                        FILTER,
                                        MaskedLinkage);

            for (   SAIndex = 0;
                    SAIndex < pFilter->SAChainSize;
                    SAIndex++) {

                for (   pSAEntry = pFilter->SAChain[SAIndex].Flink;
                        pSAEntry != &pFilter->SAChain[SAIndex];
                        pSAEntry = pSAEntry->Flink) {

                    pSA = CONTAINING_RECORD(pSAEntry,
                                            SA_TABLE_ENTRY,
                                            sa_FilterLinkage);

                    if ((pSA->sa_Flags & FLAGS_SA_HW_PLUMBED) &&
                        (DestIF == pSA->sa_IPIF)) {

                        pSA->sa_Flags &= ~FLAGS_SA_HW_PLUMBED;
                        pSA->sa_Flags |= FLAGS_SA_HW_PLUMB_FAILED;
                        pSA->sa_Flags &= ~FLAGS_SA_HW_DELETE_SA;
                        pSA->sa_Flags |= FLAGS_SA_HW_RESET;

                        IPSEC_DEC_STATISTIC(dwNumOffloadedSAs);

#if DBG
                        NumReset++;
#endif

                        IPSecDerefSA(pSA);
                    }
                }
            }
        }
    }

    IPSecNumResets++;

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);
}


VOID
IPSecResetEnd(
    IN  PVOID       IPContext
    )
/*++

Routine Description:

    Notify Interface reset is completed.

Arguments:

    IPContext   - This is the Interface being reset.

Return Value:

--*/
{
    Interface       *DestIF = (Interface *)IPContext;
    PLIST_ENTRY     pFilterEntry;
    PLIST_ENTRY     pSAEntry;
    PFILTER         pFilter;
    PSA_TABLE_ENTRY pSA;
    KIRQL           kIrql;
    LONG            Index;
    LONG            SAIndex;

    IPSEC_DEBUG(HWAPI, ("IPSecResetEnd called for interface %lx\n", DestIF));

    //
    // Go through all SA's and unmark the offload bits.
    //
    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    for (   Index = MIN_FILTER;
            Index <= MAX_FILTER;
            Index++) {

        for (   pFilterEntry = g_ipsec.FilterList[Index].Flink;
                pFilterEntry != &g_ipsec.FilterList[Index];
                pFilterEntry = pFilterEntry->Flink) {

            pFilter = CONTAINING_RECORD(pFilterEntry,
                                        FILTER,
                                        MaskedLinkage);

            for (   SAIndex = 0;
                    SAIndex < pFilter->SAChainSize;
                    SAIndex++) {

                for (   pSAEntry = pFilter->SAChain[SAIndex].Flink;
                        pSAEntry != &pFilter->SAChain[SAIndex];
                        pSAEntry = pSAEntry->Flink) {

                    pSA = CONTAINING_RECORD(pSAEntry,
                                            SA_TABLE_ENTRY,
                                            sa_FilterLinkage);

                    if ((pSA->sa_Flags & FLAGS_SA_HW_PLUMB_FAILED) &&
                        !(pSA->sa_Flags & FLAGS_SA_HW_DELETE_QUEUED) &&
                        (DestIF == pSA->sa_IPIF)) {

                        pSA->sa_Flags &= ~FLAGS_SA_HW_PLUMB_FAILED;
                        pSA->sa_IPIF = NULL;
                    }
                }
            }
        }
    }

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);
}


VOID
IPSecWakeUp(
    IN  PVOID       IPContext
    )
/*++

Routine Description:

    Notify Interface has waken up from hibernate.

Arguments:

    IPContext   - This is the Interface that wakes up.

Return Value:

--*/
{
    Interface       *DestIF = (Interface *)IPContext;
    PLIST_ENTRY     pFilterEntry;
    PLIST_ENTRY     pSAEntry;
    PFILTER         pFilter;
    PSA_TABLE_ENTRY pSA;
    KIRQL           kIrql;
    LONG            Index;
    LONG            SAIndex;

    IPSEC_DEBUG(HWAPI, ("IPSecWakeUp called for interface %lx\n", DestIF));

    //
    // Go through all SA's and unmark the offload bits.
    //
    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    for (   Index = MIN_FILTER;
            Index <= MAX_FILTER;
            Index++) {

        for (   pFilterEntry = g_ipsec.FilterList[Index].Flink;
                pFilterEntry != &g_ipsec.FilterList[Index];
                pFilterEntry = pFilterEntry->Flink) {

            pFilter = CONTAINING_RECORD(pFilterEntry,
                                        FILTER,
                                        MaskedLinkage);

            for (   SAIndex = 0;
                    SAIndex < pFilter->SAChainSize;
                    SAIndex++) {

                for (   pSAEntry = pFilter->SAChain[SAIndex].Flink;
                        pSAEntry != &pFilter->SAChain[SAIndex];
                        pSAEntry = pSAEntry->Flink) {

                    pSA = CONTAINING_RECORD(pSAEntry,
                                            SA_TABLE_ENTRY,
                                            sa_FilterLinkage);

                    if ((pSA->sa_Flags & FLAGS_SA_HW_PLUMBED) &&
                        (DestIF == pSA->sa_IPIF)) {

                        pSA->sa_Flags &= ~FLAGS_SA_HW_PLUMBED;
                        pSA->sa_IPIF = NULL;
                        pSA->sa_Flags |= FLAGS_SA_HIBERNATED;

                        IPSEC_DEC_STATISTIC(dwNumOffloadedSAs);

                        IPSecDerefSA(pSA);
                    }
                }
            }
        }
    }

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);
}


VOID
IPSecBufferOffloadEvent(
    IN  IPHeader UNALIGNED      *pIPH,
    IN  PNDIS_IPSEC_PACKET_INFO IPSecPktInfo
    )
/*++

Routine Description:

    Log an event for offload failures.

Arguments:

    pIPH            - The IP header of the problem packet.
    IPSecPktInfo    - The per-packet IPSec offload info.

Return Value:

    None

--*/
{
    switch (IPSecPktInfo->Receive.CryptoStatus) {
        case CRYPTO_TRANSPORT_AH_AUTH_FAILED:
            IPSEC_INC_STATISTIC(dwNumPacketsNotAuthenticated);
            IPSecBufferEvent(   pIPH->iph_src,
                                EVENT_IPSEC_AUTH_FAILURE,
                                3,
                                TRUE);
            break;

        case CRYPTO_TRANSPORT_ESP_AUTH_FAILED:
            IPSEC_INC_STATISTIC(dwNumPacketsNotAuthenticated);
            IPSecBufferEvent(   pIPH->iph_src,
                                EVENT_IPSEC_AUTH_FAILURE,
                                4,
                                TRUE);
            break;

        case CRYPTO_TUNNEL_AH_AUTH_FAILED:
            IPSEC_INC_STATISTIC(dwNumPacketsNotAuthenticated);
            IPSecBufferEvent(   pIPH->iph_src,
                                EVENT_IPSEC_AUTH_FAILURE,
                                5,
                                TRUE);
            break;

        case CRYPTO_TUNNEL_ESP_AUTH_FAILED:
            IPSEC_INC_STATISTIC(dwNumPacketsNotAuthenticated);
            IPSecBufferEvent(   pIPH->iph_src,
                                EVENT_IPSEC_AUTH_FAILURE,
                                6,
                                TRUE);
            break;

        case CRYPTO_INVALID_PACKET_SYNTAX:
            IPSecBufferEvent(   pIPH->iph_src,
                                EVENT_IPSEC_BAD_PACKET_SYNTAX,
                                1,
                                TRUE);
            break;

        case CRYPTO_INVALID_PROTOCOL:
            IPSecBufferEvent(   pIPH->iph_src,
                                EVENT_IPSEC_BAD_PROTOCOL_RECEIVED,
                                3,
                                TRUE);
            break;

        case CRYPTO_GENERIC_ERROR:
        default:
            IPSecBufferEvent(   pIPH->iph_src,
                                EVENT_IPSEC_GENERIC_FAILURE,
                                1,
                                TRUE);
            break;
    }
}