Skip to contentSkip to conversation

crypto/ipsec_mb: add support for IPsecMB 3.0

PATCH In review Radu Nicolau 2 participants 5 messages Nov 10 Crypto API

lore
Share & tools
lore

Radu Nicolau

author
#0 lore raw

PATCH v6 1/4 crypto/ipsec_mb: add support for IPsecMB 3.0

Add support for IPsecMB release 3.0
- removed all _BITLEN enums, all lengths are in bytes
- removed feature flag
- use non const IMB_MGR
- use IMB API instead of function pointers in the GCM PMD
- remove ZUC 256 support

Signed-off-by Radu Nicolau <[email protected]>
Acked-by Kai Ji <[email protected]>
Acked-by Wathsala Vithanage <[email protected]>
---
 doc/guides/cryptodevs/aesni_gcm.rst          |   4 +-
 doc/guides/cryptodevs/aesni_mb.rst           |  11 +-
 doc/guides/cryptodevs/features/aesni_mb.ini  |   2 +-
 doc/guides/rel_notes/release_26_11.rst       |   4 +
 drivers/crypto/ipsec_mb/pmd_aesni_gcm.c      | 267 +++++++++++++++----
 drivers/crypto/ipsec_mb/pmd_aesni_gcm_priv.h |  31 +--
 drivers/crypto/ipsec_mb/pmd_aesni_mb.c       | 107 +++++---
 drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h  |  53 +++-
 8 files changed, 356 insertions(+), 123 deletions(-)
doc/guides/cryptodevs/aesni_gcm.rst +2 -2
index 4683e9dd86..5bcae20886 100644
@@ -40,8 +40,8 @@ Installation
 To build DPDK with the AESNI_GCM_PMD the user is required to download the multi-buffer
 library from `here <https://github.com/01org/intel-ipsec-mb>`_
 and compile it on their user system before building DPDK.
-The latest version of the library supported by this PMD is v1.5, which
-can be downloaded in `<https://github.com/01org/intel-ipsec-mb/archive/v1.5.zip>`_.
+The latest version of the library supported by this PMD is v3.0, which
+can be downloaded from `<https://github.com/intel/intel-ipsec-mb/archive/refs/tags/v3.0.0.zip>`_.
 
 For Arm system, ARM64 port of the multi-buffer library can be downloaded from
 https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main/.
doc/guides/cryptodevs/aesni_mb.rst +9 -2
index da37d54471..519f965731 100644
@@ -83,6 +83,13 @@ Protocol offloads:
 
 * RTE_SECURITY_PROTOCOL_DOCSIS
 
+Note
+----
+Version 3.0 of the multi-buffer library removed support for:
+
+* the 256 bit versions of ZUC EEA3 and ZUC EIA3 algorithms.
+* non byte aligned bit length (``RTE_CRYPTODEV_FF_NON_BYTE_ALIGNED_DATA`` removed).
+
 Limitations
 -----------
 

@@ -106,8 +113,8 @@ Installation
 To build DPDK with the AESNI_MB_PMD the user is required to download the multi-buffer
 library from `here <https://github.com/01org/intel-ipsec-mb>`_
 and compile it on their user system before building DPDK.
-The latest version of the library supported by this PMD is v1.5, which
-can be downloaded from `<https://github.com/01org/intel-ipsec-mb/archive/v1.5.zip>`_.
+The latest version of the library supported by this PMD is v3.0, which
+can be downloaded from `<https://github.com/intel/intel-ipsec-mb/archive/refs/tags/v3.0.0.zip>`_.
 
 For Arm system, ARM64 port of the multi-buffer library can be downloaded from
 https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main/.
doc/guides/cryptodevs/features/aesni_mb.ini +1 -1
index 18109ffe05..d27b96eb2d 100644
@@ -19,7 +19,7 @@ OOP LB  In SGL Out     = Y
 OOP LB  In LB  Out     = Y
 CPU crypto             = Y
 Symmetric sessionless  = Y
-Non-Byte aligned data  = Y
+Non-Byte aligned data  = N
 Digest encrypted       = Y
 
 ;
doc/guides/rel_notes/release_26_11.rst +4 -0
index b24019d34a..58c30ad173 100644
@@ -24,6 +24,10 @@ DPDK Release 26.11
 New Features
 ------------
 
+* **Updated AESNI_MB crypto driver.**
+
+  * Added support for version 3.0 of IPsec MB Library.
+
 .. This section should contain new features added in this release.
    Sample format:
drivers/crypto/ipsec_mb/pmd_aesni_gcm.c +208 -59

406 lines not on this page · raw message

drivers/crypto/ipsec_mb/pmd_aesni_gcm_priv.h +16 -15
index 8a5a41fb19..4074430d6e 100644
@@ -79,41 +79,41 @@ enum aesni_gcm_key_length {
 
 typedef void (*aesni_gcm_t)(const struct gcm_key_data *gcm_key_data,
 			    struct gcm_context_data *gcm_ctx_data,
-			    uint8_t *out, const uint8_t *in,
-			    uint64_t plaintext_len, const uint8_t *iv,
-			    const uint8_t *aad, uint64_t aad_len,
-			    uint8_t *auth_tag, uint64_t auth_tag_len);
+			    void *out, const void *in,
+			    uint64_t plaintext_len, const void *iv,
+			    const void *aad, uint64_t aad_len,
+			    void *auth_tag, uint64_t auth_tag_len, IMB_MGR *state);
 
 typedef void (*aesni_gcm_pre_t)(const void *key,
-				struct gcm_key_data *gcm_data);
+				struct gcm_key_data *gcm_data, IMB_MGR *state);
 
 typedef void (*aesni_gcm_init_t)(const struct gcm_key_data *gcm_key_data,
 				 struct gcm_context_data *gcm_ctx_data,
-				 const uint8_t *iv, uint8_t const *aad,
-				 uint64_t aad_len);
+				 const void *iv, const void *aad,
+				 uint64_t aad_len, IMB_MGR *state);
 
 typedef void (*aesni_gcm_update_t)(const struct gcm_key_data *gcm_key_data,
 				   struct gcm_context_data *gcm_ctx_data,
-				   uint8_t *out, const uint8_t *in,
-				   uint64_t plaintext_len);
+				   void *out, const void *in,
+				   uint64_t plaintext_len, IMB_MGR *state);
 
 typedef void (*aesni_gcm_finalize_t)(const struct gcm_key_data *gcm_key_data,
 				     struct gcm_context_data *gcm_ctx_data,
-				     uint8_t *auth_tag, uint64_t auth_tag_len);
+				     void *auth_tag, uint64_t auth_tag_len, IMB_MGR *state);
 
 typedef void (*aesni_gmac_init_t)(const struct gcm_key_data *gcm_key_data,
 				  struct gcm_context_data *gcm_ctx_data,
-				  const uint8_t *iv, const uint64_t iv_len);
+				  const void *iv, const uint64_t iv_len, IMB_MGR *state);
 
 typedef void (*aesni_gmac_update_t)(const struct gcm_key_data *gcm_key_data,
 				    struct gcm_context_data *gcm_ctx_data,
-				    const uint8_t *in,
-				    const uint64_t plaintext_len);
+				    const void *in,
+				    const uint64_t plaintext_len, IMB_MGR *state);
 
 typedef void (*aesni_gmac_finalize_t)(const struct gcm_key_data *gcm_key_data,
 				      struct gcm_context_data *gcm_ctx_data,
-				      uint8_t *auth_tag,
-				      const uint64_t auth_tag_len);
+				      void *auth_tag,
+				      const uint64_t auth_tag_len, IMB_MGR *state);
 
 /** GCM operation handlers */
 struct aesni_gcm_ops {

@@ -128,6 +128,7 @@ struct aesni_gcm_ops {
 	aesni_gmac_init_t gmac_init;
 	aesni_gmac_update_t gmac_update;
 	aesni_gmac_finalize_t gmac_finalize;
+	IMB_MGR *mb_mgr;
 };
 
 RTE_DEFINE_PER_LCORE(struct aesni_gcm_ops, gcm_ops[GCM_NUM_KEY_TYPES]);
drivers/crypto/ipsec_mb/pmd_aesni_mb.c +72 -35

242 lines not on this page · raw message

drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h +44 -9

108 lines not on this page · raw message

Signature · 1 line
2.52.0
author
#1 lore raw

PATCH v6 2/4 crypto/ipsec_mb: add support for 256-NxA4/5/6 algorithms

Add support for

NEA4, NIA4, NCA4: Snow 5G confidentiality, integrity and AEAD modes NEA5, NIA5, NCA5: AES 256 confidentiality, integrity and AEAD modes NEA6, NIA6, NCA6: ZUC 256 confidentiality, integrity and AEAD modes

IPsec MB library version 3.0 is required for the above algorithms.

Signed-off-by Radu Nicolau <[email protected]>
Acked-by Kai Ji <[email protected]>
Acked-by Wathsala Vithanage <[email protected]>
---
 doc/guides/cryptodevs/aesni_mb.rst          |   9 +
 doc/guides/cryptodevs/features/aesni_mb.ini |   9 +
 doc/guides/rel_notes/release_26_11.rst      |   5 +
 drivers/crypto/ipsec_mb/pmd_aesni_mb.c      | 226 +++++++++++++++++-
 drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h | 241 ++++++++++++++++++++
 5 files changed, 486 insertions(+), 4 deletions(-)
doc/guides/cryptodevs/aesni_mb.rst +9 -0
index 519f965731..d851a0f53a 100644
@@ -39,6 +39,9 @@ Cipher algorithms:
 * RTE_CRYPTO_CIPHER_SM4_CBC
 * RTE_CRYPTO_CIPHER_SM4_ECB
 * RTE_CRYPTO_CIPHER_SM4_CTR
+* RTE_CRYPTO_CIPHER_SNOW5G_NEA4
+* RTE_CRYPTO_CIPHER_AES_NEA5
+* RTE_CRYPTO_CIPHER_ZUC_NEA6
 
 Hash algorithms:
 

@@ -71,6 +74,9 @@ Hash algorithms:
 * RTE_CRYPTO_AUTH_SHA3_512 HMAC
 * RTE_CRYPTO_AUTH_SHAKE_128
 * RTE_CRYPTO_AUTH_SHAKE_256
+* RTE_CRYPTO_AUTH_SNOW5G_NIA4
+* RTE_CRYPTO_AUTH_AES_NIA5
+* RTE_CRYPTO_AUTH_ZUC_NIA6
 
 AEAD algorithms:
 

@@ -78,6 +84,9 @@ AEAD algorithms:
 * RTE_CRYPTO_AEAD_AES_GCM
 * RTE_CRYPTO_AEAD_CHACHA20_POLY1305
 * RTE_CRYPTO_AEAD_SM4_GCM
+* RTE_CRYPTO_AEAD_SNOW5G_NCA4
+* RTE_CRYPTO_AEAD_AES_NCA5
+* RTE_CRYPTO_AEAD_ZUC_NCA6
 
 Protocol offloads:
doc/guides/cryptodevs/features/aesni_mb.ini +9 -0
index d27b96eb2d..ad7f5048d2 100644
@@ -45,6 +45,9 @@ KASUMI F8      = Y
 SM4 CBC        = Y
 SM4 ECB        = Y
 SM4 CTR        = Y
+SNOW5G NEA4    = Y
+AES NEA5       = Y
+ZUC-256 NEA6   = Y
 
 ;
 ; Supported authentication algorithms of the 'aesni_mb' crypto driver.

@@ -79,6 +82,9 @@ SHA3_512     = Y
 SHA3_512 HMAC = Y
 SHAKE_128    = Y
 SHAKE_256    = Y
+SNOW5G NIA4     = Y
+AES NIA5        = Y
+ZUC-256 NIA6    = Y
 
 ;
 ; Supported AEAD algorithms of the 'aesni_mb' crypto driver.

@@ -91,6 +97,9 @@ AES GCM (192)     = Y
 AES GCM (256)     = Y
 CHACHA20-POLY1305 = Y
 SM4 GCM           = Y
+SNOW5G NCA4       = Y
+AES NCA5          = Y
+ZUC-256 NCA6      = Y
 
 ;
 ; Supported Asymmetric algorithms of the 'aesni_mb' crypto driver.
doc/guides/rel_notes/release_26_11.rst +5 -0
index 58c30ad173..d5c9c5b7f0 100644
@@ -27,8 +27,13 @@ New Features
 * **Updated AESNI_MB crypto driver.**
 
   * Added support for version 3.0 of IPsec MB Library.
+  * Added support for the following wireless algorithms:
+       - NEA4, NIA4, NCA4: Snow 5G confidentiality, integrity and AEAD modes.
+       - NEA5, NIA5, NCA5: AES 256 confidentiality, integrity and AEAD modes.
+       - NEA6, NIA6, NCA6: ZUC 256 confidentiality, integrity and AEAD modes.
 
 .. This section should contain new features added in this release.
+
    Sample format:
 
    * **Add a title in the past tense with a full stop.**
drivers/crypto/ipsec_mb/pmd_aesni_mb.c +222 -4

302 lines not on this page · raw message

drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h +241 -0

259 lines not on this page · raw message

Signature · 1 line
2.52.0
author
#2 lore raw

PATCH v6 3/4 crypto/ipsec_mb: add support for ML-KEM and ML-DSA

In reply to Radu Nicolau

Enable basic support for asymmetric crypto operations. Add support for ML-KEM and ML-DSA algorithms.

IPsecMB release 3.0 and newer required.

Signed-off-by Radu Nicolau <[email protected]>
Acked-by Kai Ji <[email protected]>
---
 doc/guides/cryptodevs/aesni_mb.rst          |   6 +
 doc/guides/cryptodevs/features/aesni_mb.ini |   3 +
 doc/guides/rel_notes/release_26_11.rst      |   3 +
 drivers/crypto/ipsec_mb/ipsec_mb_ops.c      |  49 +++
 drivers/crypto/ipsec_mb/ipsec_mb_private.h  |  20 ++
 drivers/crypto/ipsec_mb/pmd_aesni_mb.c      | 372 +++++++++++++++++++-
 drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h |  86 ++++-
 7 files changed, 523 insertions(+), 16 deletions(-)
doc/guides/cryptodevs/aesni_mb.rst +6 -0
index d851a0f53a..5ec440ac1b 100644
@@ -88,6 +88,12 @@ AEAD algorithms:
 * RTE_CRYPTO_AEAD_AES_NCA5
 * RTE_CRYPTO_AEAD_ZUC_NCA6
 
+PQC Asymmetric Crypto algorithms
+
+* RTE_CRYPTO_ASYM_XFORM_ML_KEM
+* RTE_CRYPTO_ASYM_XFORM_ML_DSA
+
+
 Protocol offloads:
 
 * RTE_SECURITY_PROTOCOL_DOCSIS
doc/guides/cryptodevs/features/aesni_mb.ini +3 -0
index ad7f5048d2..33696a5d65 100644
@@ -21,6 +21,7 @@ CPU crypto             = Y
 Symmetric sessionless  = Y
 Non-Byte aligned data  = N
 Digest encrypted       = Y
+Asymmetric crypto      = Y
 
 ;
 ; Supported crypto algorithms of the 'aesni_mb' crypto driver.

@@ -105,6 +106,8 @@ ZUC-256 NCA6      = Y
 ; Supported Asymmetric algorithms of the 'aesni_mb' crypto driver.
 ;
 [Asymmetric]
+ML-KEM = Y
+ML-DSA = Y
 
 ;
 ; Supported Operating systems of the 'aesni_mb' crypto driver.
doc/guides/rel_notes/release_26_11.rst +3 -0
index d5c9c5b7f0..f7710c3c43 100644
@@ -31,6 +31,9 @@ New Features
        - NEA4, NIA4, NCA4: Snow 5G confidentiality, integrity and AEAD modes.
        - NEA5, NIA5, NCA5: AES 256 confidentiality, integrity and AEAD modes.
        - NEA6, NIA6, NCA6: ZUC 256 confidentiality, integrity and AEAD modes.
+  * Added support for the following PQC asymmetric algorithms:
+       - ML-KEM: Module-Lattice-Based Key-Encapsulation Mechanism.
+       - ML-DSA: Module-Lattice-Based Digital Signature Algorithm.
 
 .. This section should contain new features added in this release.
drivers/crypto/ipsec_mb/ipsec_mb_ops.c +49 -0

52 lines not on this page · raw message

drivers/crypto/ipsec_mb/ipsec_mb_private.h +20 -0
index fc7d6f5f06..5509dc21f3 100644
@@ -356,6 +356,12 @@ typedef int (*ipsec_mb_session_configure_t)(IMB_MGR *mbr_mgr,
 		void *session_private,
 		const struct rte_crypto_sym_xform *xform);
 
+typedef int (*ipsec_mb_asym_session_configure_t)(IMB_MGR *mbr_mgr,
+		void *session_private,
+		const struct rte_crypto_asym_xform *xform);
+
+typedef void (*ipsec_mb_asym_session_clear_t)(void *session_private);
+
 /** Configure internals PMD type specific data */
 typedef int (*ipsec_mb_dev_configure_t)(struct rte_cryptodev *dev);
 

@@ -366,6 +372,9 @@ struct ipsec_mb_internals {
 	ipsec_mb_dev_configure_t dev_config;
 	ipsec_mb_queue_pair_configure_t queue_pair_configure;
 	ipsec_mb_session_configure_t session_configure;
+	ipsec_mb_asym_session_configure_t asym_session_configure;
+	ipsec_mb_asym_session_clear_t asym_session_clear;
+	bool asym_session_created;
 	const struct rte_cryptodev_capabilities *caps;
 	struct rte_cryptodev_ops *ops;
 	struct rte_security_ops *security_ops;

@@ -423,11 +432,22 @@ int ipsec_mb_sym_session_configure(
 	struct rte_crypto_sym_xform *xform,
 	struct rte_cryptodev_sym_session *sess);
 
+/** Configure an aesni multi-buffer asym session from a crypto xform chain */
+int ipsec_mb_asym_session_configure(
+	struct rte_cryptodev *dev,
+	struct rte_crypto_asym_xform *xform,
+	struct rte_cryptodev_asym_session *sess);
+
 /** Clear the memory of session so it does not leave key material behind */
 void
 ipsec_mb_sym_session_clear(struct rte_cryptodev *dev,
 				struct rte_cryptodev_sym_session *sess);
 
+/** Clear the asym session memory */
+void
+ipsec_mb_asym_session_clear(struct rte_cryptodev *dev,
+				struct rte_cryptodev_asym_session *sess);
+
 /** Get session from op. If sessionless create a session */
 static __rte_always_inline void *
 ipsec_mb_get_session_private(struct ipsec_mb_qp *qp, struct rte_crypto_op *op)
drivers/crypto/ipsec_mb/pmd_aesni_mb.c +368 -4

422 lines not on this page · raw message

drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h +74 -12

104 lines not on this page · raw message

Signature · 1 line
2.52.0
author
#3 lore raw

PATCH v6 4/4 test/crypto: add asym test suite for AESNI_MB

In reply to Radu Nicolau

Enable asymmetric crypto unit test suite for AESNI_MB PMD.

Signed-off-by Radu Nicolau <[email protected]>
Acked-by Kai Ji <[email protected]>
Acked-by Wathsala Vithanage <[email protected]>
---
 app/test/test_cryptodev_asym.c | 7 +++++++
 1 file changed, 7 insertions(+)
app/test/test_cryptodev_asym.c +7 -0
index d9807f34e0..0de312b0bf 100644
@@ -6182,6 +6182,12 @@ test_cryptodev_virtio_user_asym(void)
 	return run_cryptodev_asym_testsuite(RTE_STR(CRYPTODEV_NAME_VIRTIO_USER_PMD));
 }
 
+static int
+test_cryptodev_aesni_mb_asym(void)
+{
+	return run_cryptodev_asym_testsuite(RTE_STR(CRYPTODEV_NAME_AESNI_MB_PMD));
+}
+
 REGISTER_DRIVER_TEST(cryptodev_openssl_asym_autotest, test_cryptodev_openssl_asym);
 REGISTER_DRIVER_TEST(cryptodev_qat_asym_autotest, test_cryptodev_qat_asym);
 REGISTER_DRIVER_TEST(cryptodev_octeontx_asym_autotest, test_cryptodev_octeontx_asym);

@@ -6190,3 +6196,4 @@ REGISTER_DRIVER_TEST(cryptodev_cn10k_asym_autotest, test_cryptodev_cn10k_asym);
 REGISTER_DRIVER_TEST(cryptodev_cn20k_asym_autotest, test_cryptodev_cn20k_asym);
 REGISTER_DRIVER_TEST(cryptodev_virtio_asym_autotest, test_cryptodev_virtio_asym);
 REGISTER_DRIVER_TEST(cryptodev_virtio_user_asym_autotest, test_cryptodev_virtio_user_asym);
+REGISTER_DRIVER_TEST(cryptodev_aesni_mb_asym_autotest, test_cryptodev_aesni_mb_asym);
Signature · 1 line
2.52.0