* [PATCH v2 1/8] common/cnxk: get context ilen as devarg
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
@ 2025-08-21 6:13 ` Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 2/8] crypto/cnxk: fix compilation error and warnings Tejasree Kondoj
` (7 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Tejasree Kondoj @ 2025-08-21 6:13 UTC (permalink / raw)
To: Akhil Goyal
Cc: Nithinsen Kaithakadan, Anoob Joseph, Aakash Sasidharan,
Rupesh Chiluka, Sucharitha Sarananaga, Vidya Sagar Velumuri, dev
From: Nithinsen Kaithakadan <nkaithakadan@marvell.com>
Receive cpt context ilen as devarg parameter
and configure lf.
Signed-off-by: Nithinsen Kaithakadan <nkaithakadan@marvell.com>
---
doc/guides/cryptodevs/cnxk.rst | 11 +++++
drivers/common/cnxk/cnxk_security.c | 20 ++++++--
drivers/common/cnxk/cnxk_security.h | 25 +++++-----
drivers/common/cnxk/roc_cpt.c | 8 +++-
drivers/common/cnxk/roc_cpt.h | 1 +
drivers/crypto/cnxk/cn10k_ipsec.c | 4 +-
drivers/crypto/cnxk/cn10k_tls.c | 16 +++++--
drivers/crypto/cnxk/cn20k_ipsec.c | 4 +-
drivers/crypto/cnxk/cnxk_cryptodev.h | 1 +
drivers/crypto/cnxk/cnxk_cryptodev_devargs.c | 49 ++++++++++++++++++++
drivers/crypto/cnxk/cnxk_cryptodev_ops.c | 3 ++
drivers/net/cnxk/cn10k_ethdev_sec.c | 14 +++---
drivers/net/cnxk/cn20k_ethdev_sec.c | 8 ++--
13 files changed, 126 insertions(+), 38 deletions(-)
diff --git a/doc/guides/cryptodevs/cnxk.rst b/doc/guides/cryptodevs/cnxk.rst
index 77e6a8e68d..c29a2cbb92 100644
--- a/doc/guides/cryptodevs/cnxk.rst
+++ b/doc/guides/cryptodevs/cnxk.rst
@@ -200,6 +200,17 @@ Runtime Config Options
With the above configuration, QP 20 will be used by the device for Rx injection
in security in fallback mechanism scenario.
+- ``Context ilen value`` (default ``0``)
+
+ Initial context fetch length value for CPT context.
+
+ For example::
+
+ -a 0002:20:00.1,ctx_ilen=4
+
+ With the above configuration, CPT initial context fetch size will be set to
+ 4+1 128 bytes blocks.
+
Debugging Options
-----------------
diff --git a/drivers/common/cnxk/cnxk_security.c b/drivers/common/cnxk/cnxk_security.c
index 0e6777e6ca..600098ae1c 100644
--- a/drivers/common/cnxk/cnxk_security.c
+++ b/drivers/common/cnxk/cnxk_security.c
@@ -309,7 +309,7 @@ RTE_EXPORT_INTERNAL_SYMBOL(cnxk_ot_ipsec_inb_sa_fill)
int
cnxk_ot_ipsec_inb_sa_fill(struct roc_ot_ipsec_inb_sa *sa,
struct rte_security_ipsec_xform *ipsec_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm)
+ struct rte_crypto_sym_xform *crypto_xfrm, uint8_t ctx_ilen)
{
uint16_t sport = 4500, dport = 4500;
union roc_ot_ipsec_sa_word2 w2;
@@ -383,6 +383,9 @@ cnxk_ot_ipsec_inb_sa_fill(struct roc_ot_ipsec_inb_sa *sa,
ROC_CTX_UNIT_128B) -
1;
+ if (sa->w0.s.ctx_size < ctx_ilen)
+ sa->w0.s.ctx_size = ctx_ilen;
+
/**
* CPT MC triggers expiry when counter value changes from 2 to 1. To
* mitigate this behaviour add 1 to the life counter values provided.
@@ -419,7 +422,7 @@ RTE_EXPORT_INTERNAL_SYMBOL(cnxk_ot_ipsec_outb_sa_fill)
int
cnxk_ot_ipsec_outb_sa_fill(struct roc_ot_ipsec_outb_sa *sa,
struct rte_security_ipsec_xform *ipsec_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm)
+ struct rte_crypto_sym_xform *crypto_xfrm, uint8_t ctx_ilen)
{
struct rte_security_ipsec_tunnel_param *tunnel = &ipsec_xfrm->tunnel;
uint16_t sport = 4500, dport = 4500;
@@ -541,6 +544,9 @@ cnxk_ot_ipsec_outb_sa_fill(struct roc_ot_ipsec_outb_sa *sa,
ROC_CTX_UNIT_128B) -
1;
+ if (sa->w0.s.ctx_size < ctx_ilen)
+ sa->w0.s.ctx_size = ctx_ilen;
+
/* IPID gen */
sa->w2.s.ipid_gen = 1;
@@ -1488,7 +1494,7 @@ RTE_EXPORT_INTERNAL_SYMBOL(cnxk_ow_ipsec_inb_sa_fill)
int
cnxk_ow_ipsec_inb_sa_fill(struct roc_ow_ipsec_inb_sa *sa,
struct rte_security_ipsec_xform *ipsec_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm)
+ struct rte_crypto_sym_xform *crypto_xfrm, uint8_t ctx_ilen)
{
uint16_t sport = 4500, dport = 4500;
union roc_ow_ipsec_sa_word2 w2;
@@ -1559,6 +1565,9 @@ cnxk_ow_ipsec_inb_sa_fill(struct roc_ow_ipsec_inb_sa *sa,
(PLT_ALIGN_CEIL(ow_ipsec_inb_ctx_size(sa), ROC_CTX_UNIT_128B) / ROC_CTX_UNIT_128B) -
1;
+ if (sa->w0.s.ctx_size < ctx_ilen)
+ sa->w0.s.ctx_size = ctx_ilen;
+
/**
* CPT MC triggers expiry when counter value changes from 2 to 1. To
* mitigate this behaviour add 1 to the life counter values provided.
@@ -1595,7 +1604,7 @@ RTE_EXPORT_INTERNAL_SYMBOL(cnxk_ow_ipsec_outb_sa_fill)
int
cnxk_ow_ipsec_outb_sa_fill(struct roc_ow_ipsec_outb_sa *sa,
struct rte_security_ipsec_xform *ipsec_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm)
+ struct rte_crypto_sym_xform *crypto_xfrm, uint8_t ctx_ilen)
{
struct rte_security_ipsec_tunnel_param *tunnel = &ipsec_xfrm->tunnel;
uint16_t sport = 4500, dport = 4500;
@@ -1711,6 +1720,9 @@ cnxk_ow_ipsec_outb_sa_fill(struct roc_ow_ipsec_outb_sa *sa,
/* IPID gen */
sa->w2.s.ipid_gen = 1;
+ if (sa->w0.s.ctx_size < ctx_ilen)
+ sa->w0.s.ctx_size = ctx_ilen;
+
/**
* CPT MC triggers expiry when counter value changes from 2 to 1. To
* mitigate this behaviour add 1 to the life counter values provided.
diff --git a/drivers/common/cnxk/cnxk_security.h b/drivers/common/cnxk/cnxk_security.h
index e324fa2cb9..3912c8d376 100644
--- a/drivers/common/cnxk/cnxk_security.h
+++ b/drivers/common/cnxk/cnxk_security.h
@@ -33,19 +33,17 @@ cnxk_ipsec_icvlen_get(enum rte_crypto_cipher_algorithm c_algo,
enum rte_crypto_auth_algorithm a_algo,
enum rte_crypto_aead_algorithm aead_algo);
-uint8_t __roc_api
-cnxk_ipsec_outb_roundup_byte(enum rte_crypto_cipher_algorithm c_algo,
- enum rte_crypto_aead_algorithm aead_algo);
+uint8_t __roc_api cnxk_ipsec_outb_roundup_byte(enum rte_crypto_cipher_algorithm c_algo,
+ enum rte_crypto_aead_algorithm aead_algo);
/* [CN10K] */
-int __roc_api
-cnxk_ot_ipsec_inb_sa_fill(struct roc_ot_ipsec_inb_sa *sa,
- struct rte_security_ipsec_xform *ipsec_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm);
-int __roc_api
-cnxk_ot_ipsec_outb_sa_fill(struct roc_ot_ipsec_outb_sa *sa,
- struct rte_security_ipsec_xform *ipsec_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm);
+int __roc_api cnxk_ot_ipsec_inb_sa_fill(struct roc_ot_ipsec_inb_sa *sa,
+ struct rte_security_ipsec_xform *ipsec_xfrm,
+ struct rte_crypto_sym_xform *crypto_xfrm, uint8_t ctx_ilen);
+int __roc_api cnxk_ot_ipsec_outb_sa_fill(struct roc_ot_ipsec_outb_sa *sa,
+ struct rte_security_ipsec_xform *ipsec_xfrm,
+ struct rte_crypto_sym_xform *crypto_xfrm,
+ uint8_t ctx_ilen);
bool __roc_api cnxk_ot_ipsec_inb_sa_valid(struct roc_ot_ipsec_inb_sa *sa);
bool __roc_api cnxk_ot_ipsec_outb_sa_valid(struct roc_ot_ipsec_outb_sa *sa);
@@ -60,10 +58,11 @@ int __roc_api cnxk_on_ipsec_outb_sa_create(struct rte_security_ipsec_xform *ipse
/* [CN20K, .) */
int __roc_api cnxk_ow_ipsec_inb_sa_fill(struct roc_ow_ipsec_inb_sa *sa,
struct rte_security_ipsec_xform *ipsec_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm);
+ struct rte_crypto_sym_xform *crypto_xfrm, uint8_t ctx_ilen);
int __roc_api cnxk_ow_ipsec_outb_sa_fill(struct roc_ow_ipsec_outb_sa *sa,
struct rte_security_ipsec_xform *ipsec_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm);
+ struct rte_crypto_sym_xform *crypto_xfrm,
+ uint8_t ctx_ilen);
bool __roc_api cnxk_ow_ipsec_inb_sa_valid(struct roc_ow_ipsec_inb_sa *sa);
bool __roc_api cnxk_ow_ipsec_outb_sa_valid(struct roc_ow_ipsec_outb_sa *sa);
#endif /* _CNXK_SECURITY_H__ */
diff --git a/drivers/common/cnxk/roc_cpt.c b/drivers/common/cnxk/roc_cpt.c
index d1ba2b8858..fa040b5f4f 100644
--- a/drivers/common/cnxk/roc_cpt.c
+++ b/drivers/common/cnxk/roc_cpt.c
@@ -632,10 +632,16 @@ roc_cpt_dev_configure(struct roc_cpt *roc_cpt, int nb_lf, bool rxc_ena, uint16_t
eng_grpmsk = (1 << roc_cpt->eng_grp[CPT_ENG_TYPE_AE]) |
(1 << roc_cpt->eng_grp[CPT_ENG_TYPE_SE]);
- if (roc_errata_cpt_has_ctx_fetch_issue()) {
+ if (roc_cpt->ctx_ilen != 0) {
+ ctx_ilen = roc_cpt->ctx_ilen;
+ ctx_ilen_valid = true;
+ } else if (roc_errata_cpt_has_ctx_fetch_issue()) {
ctx_ilen_valid = true;
/* Inbound SA size is max context size */
ctx_ilen = (PLT_ALIGN(ROC_OT_IPSEC_SA_SZ_MAX, ROC_ALIGN) / 128) - 1;
+ } else if (roc_cpt->ctx_ilen != 0) {
+ ctx_ilen = roc_cpt->ctx_ilen;
+ ctx_ilen_valid = true;
}
rc = cpt_lfs_alloc(&cpt->dev, eng_grpmsk, blkaddr[blknum], false, ctx_ilen_valid, ctx_ilen,
diff --git a/drivers/common/cnxk/roc_cpt.h b/drivers/common/cnxk/roc_cpt.h
index 02f49c06b7..aa30f46f04 100644
--- a/drivers/common/cnxk/roc_cpt.h
+++ b/drivers/common/cnxk/roc_cpt.h
@@ -169,6 +169,7 @@ struct roc_cpt {
uint16_t nb_lf;
uint16_t nb_lf_avail;
uintptr_t lmt_base;
+ uint8_t ctx_ilen;
/**< CPT device capabilities */
union cpt_eng_caps hw_caps[CPT_MAX_ENG_TYPES];
uint8_t eng_grp[CPT_MAX_ENG_TYPES];
diff --git a/drivers/crypto/cnxk/cn10k_ipsec.c b/drivers/crypto/cnxk/cn10k_ipsec.c
index 5cd4f5257a..a1207aa7c4 100644
--- a/drivers/crypto/cnxk/cn10k_ipsec.c
+++ b/drivers/crypto/cnxk/cn10k_ipsec.c
@@ -45,7 +45,7 @@ cn10k_ipsec_outb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
}
/* Translate security parameters to SA */
- ret = cnxk_ot_ipsec_outb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm);
+ ret = cnxk_ot_ipsec_outb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm, roc_cpt->ctx_ilen);
if (ret) {
plt_err("Could not fill outbound session parameters");
goto sa_dptr_free;
@@ -176,7 +176,7 @@ cn10k_ipsec_inb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
}
/* Translate security parameters to SA */
- ret = cnxk_ot_ipsec_inb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm);
+ ret = cnxk_ot_ipsec_inb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm, roc_cpt->ctx_ilen);
if (ret) {
plt_err("Could not fill inbound session parameters");
goto sa_dptr_free;
diff --git a/drivers/crypto/cnxk/cn10k_tls.c b/drivers/crypto/cnxk/cn10k_tls.c
index 49edac8cd6..1a7b87e400 100644
--- a/drivers/crypto/cnxk/cn10k_tls.c
+++ b/drivers/crypto/cnxk/cn10k_tls.c
@@ -327,7 +327,8 @@ tls_read_ctx_size(struct roc_ie_ot_tls_read_sa *sa, enum rte_security_tls_versio
static int
tls_read_sa_fill(struct roc_ie_ot_tls_read_sa *read_sa,
struct rte_security_tls_record_xform *tls_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm, struct cn10k_tls_opt *tls_opt)
+ struct rte_crypto_sym_xform *crypto_xfrm, struct cn10k_tls_opt *tls_opt,
+ uint8_t ctx_ilen)
{
enum rte_security_tls_version tls_ver = tls_xfrm->ver;
struct rte_crypto_sym_xform *auth_xfrm, *cipher_xfrm;
@@ -470,6 +471,9 @@ tls_read_sa_fill(struct roc_ie_ot_tls_read_sa *read_sa,
ROC_CTX_UNIT_128B) -
1;
+ if (read_sa->w0.s.ctx_size < ctx_ilen)
+ read_sa->w0.s.ctx_size = ctx_ilen;
+
/* Word offset for HW managed CTX field */
read_sa->w0.s.hw_ctx_off = offset / 8;
read_sa->w0.s.ctx_push_size = read_sa->w0.s.hw_ctx_off;
@@ -482,7 +486,7 @@ tls_read_sa_fill(struct roc_ie_ot_tls_read_sa *read_sa,
static int
tls_write_sa_fill(struct roc_ie_ot_tls_write_sa *write_sa,
struct rte_security_tls_record_xform *tls_xfrm,
- struct rte_crypto_sym_xform *crypto_xfrm)
+ struct rte_crypto_sym_xform *crypto_xfrm, uint8_t ctx_ilen)
{
enum rte_security_tls_version tls_ver = tls_xfrm->ver;
struct rte_crypto_sym_xform *auth_xfrm, *cipher_xfrm;
@@ -606,6 +610,9 @@ tls_write_sa_fill(struct roc_ie_ot_tls_write_sa *write_sa,
write_sa->w0.s.ctx_size -= 1;
}
+ if (write_sa->w0.s.ctx_size < ctx_ilen)
+ write_sa->w0.s.ctx_size = ctx_ilen;
+
/* Word offset for HW managed CTX field */
write_sa->w0.s.hw_ctx_off = offset / 8;
write_sa->w0.s.ctx_push_size = write_sa->w0.s.hw_ctx_off;
@@ -655,7 +662,8 @@ cn10k_tls_read_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
}
/* Translate security parameters to SA */
- ret = tls_read_sa_fill(sa_dptr, tls_xfrm, crypto_xfrm, &sec_sess->tls_opt);
+ ret = tls_read_sa_fill(sa_dptr, tls_xfrm, crypto_xfrm, &sec_sess->tls_opt,
+ roc_cpt->ctx_ilen);
if (ret) {
plt_err("Could not fill read session parameters");
goto sa_dptr_free;
@@ -745,7 +753,7 @@ cn10k_tls_write_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
}
/* Translate security parameters to SA */
- ret = tls_write_sa_fill(sa_dptr, tls_xfrm, crypto_xfrm);
+ ret = tls_write_sa_fill(sa_dptr, tls_xfrm, crypto_xfrm, roc_cpt->ctx_ilen);
if (ret) {
plt_err("Could not fill write session parameters");
goto sa_dptr_free;
diff --git a/drivers/crypto/cnxk/cn20k_ipsec.c b/drivers/crypto/cnxk/cn20k_ipsec.c
index 1a65438646..8f79033ccc 100644
--- a/drivers/crypto/cnxk/cn20k_ipsec.c
+++ b/drivers/crypto/cnxk/cn20k_ipsec.c
@@ -45,7 +45,7 @@ cn20k_ipsec_outb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
}
/* Translate security parameters to SA */
- ret = cnxk_ow_ipsec_outb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm);
+ ret = cnxk_ow_ipsec_outb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm, roc_cpt->ctx_ilen);
if (ret) {
plt_err("Could not fill outbound session parameters");
goto sa_dptr_free;
@@ -171,7 +171,7 @@ cn20k_ipsec_inb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
}
/* Translate security parameters to SA */
- ret = cnxk_ow_ipsec_inb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm);
+ ret = cnxk_ow_ipsec_inb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm, roc_cpt->ctx_ilen);
if (ret) {
plt_err("Could not fill inbound session parameters");
goto sa_dptr_free;
diff --git a/drivers/crypto/cnxk/cnxk_cryptodev.h b/drivers/crypto/cnxk/cnxk_cryptodev.h
index 5cec64c2e1..088149badb 100644
--- a/drivers/crypto/cnxk/cnxk_cryptodev.h
+++ b/drivers/crypto/cnxk/cnxk_cryptodev.h
@@ -36,6 +36,7 @@ struct cnxk_cpt_vf {
struct roc_ae_ec_group *ec_grp[ROC_AE_EC_ID_PMAX];
uint16_t max_qps_limit;
uint16_t rx_inject_qp;
+ uint8_t ctx_ilen;
};
uint64_t cnxk_cpt_default_ff_get(void);
diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_devargs.c b/drivers/crypto/cnxk/cnxk_cryptodev_devargs.c
index adf1ba0543..3623e5aa76 100644
--- a/drivers/crypto/cnxk/cnxk_cryptodev_devargs.c
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_devargs.c
@@ -4,12 +4,16 @@
#include <rte_devargs.h>
+#include "cn10k_tls.h"
#include "cnxk_cryptodev.h"
+#include "cnxk_security.h"
#define CNXK_MAX_QPS_LIMIT "max_qps_limit"
#define CNXK_MAX_QPS_LIMIT_MIN 1
#define CNXK_MAX_QPS_LIMIT_MAX (ROC_CPT_MAX_LFS - 1)
#define CNXK_RX_INJECT_QP "rx_inject_qp"
+#define CNXK_CPT_CTX_ILEN "ctx_ilen"
+#define CNXK_MAX_CPT_CTX_ILEN 7
static int
parse_rx_inject_qp(const char *key, const char *value, void *extra_args)
@@ -43,12 +47,48 @@ parse_max_qps_limit(const char *key, const char *value, void *extra_args)
return 0;
}
+static uint32_t
+find_max_ctx_value(void)
+{
+ uint32_t val;
+
+ val = RTE_MAX(offsetof(struct roc_ot_ipsec_inb_sa, ctx),
+ offsetof(struct roc_ot_ipsec_outb_sa, ctx));
+
+ val = RTE_MAX(val, offsetof(struct roc_ie_ot_tls_read_sa, tls_12.ctx));
+ val = RTE_MAX(val, offsetof(struct roc_ie_ot_tls_read_sa, tls_13.ctx));
+ val = RTE_MAX(val, offsetof(struct roc_ie_ot_tls_write_sa, tls_12.w26_rsvd7));
+ val = RTE_MAX(val, offsetof(struct roc_ie_ot_tls_write_sa, tls_13.w10_rsvd7));
+
+ return val / 128 + 1;
+}
+
+static int
+parse_cpt_ctx_ilen(const char *key, const char *value, void *extra_args)
+{
+ RTE_SET_USED(key);
+ uint32_t val, min_val;
+
+ val = atoi(value);
+ if (val > CNXK_MAX_CPT_CTX_ILEN)
+ return -EINVAL;
+
+ min_val = find_max_ctx_value();
+ if (val < min_val)
+ return -EINVAL;
+
+ *(uint16_t *)extra_args = val;
+
+ return 0;
+}
+
int
cnxk_cpt_parse_devargs(struct rte_devargs *devargs, struct cnxk_cpt_vf *vf)
{
uint16_t max_qps_limit = CNXK_MAX_QPS_LIMIT_MAX;
struct rte_kvargs *kvlist;
uint16_t rx_inject_qp;
+ uint16_t ctx_ilen = 0;
int rc;
/* Set to max value as default so that the feature is disabled by default. */
@@ -78,11 +118,20 @@ cnxk_cpt_parse_devargs(struct rte_devargs *devargs, struct cnxk_cpt_vf *vf)
goto exit;
}
+ rc = rte_kvargs_process(kvlist, CNXK_CPT_CTX_ILEN, parse_cpt_ctx_ilen, &ctx_ilen);
+ if (rc < 0) {
+ plt_err("ctx_ilen should in the range <%d-%d>", find_max_ctx_value(),
+ CNXK_MAX_CPT_CTX_ILEN);
+ rte_kvargs_free(kvlist);
+ goto exit;
+ }
+
rte_kvargs_free(kvlist);
null_devargs:
vf->max_qps_limit = max_qps_limit;
vf->rx_inject_qp = rx_inject_qp;
+ vf->cpt.ctx_ilen = ctx_ilen;
return 0;
exit:
diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_ops.c b/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
index 261e14b418..2bf156bddb 100644
--- a/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
@@ -819,6 +819,9 @@ sym_session_configure(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *xfor
if (hw_ctx_cache_enable())
roc_se_ctx_init(&sess_priv->roc_se_ctx);
+ if (sess_priv->roc_se_ctx.se_ctx.w0.s.ctx_size < roc_cpt->ctx_ilen)
+ sess_priv->roc_se_ctx.se_ctx.w0.s.ctx_size = roc_cpt->ctx_ilen;
+
return 0;
priv_put:
diff --git a/drivers/net/cnxk/cn10k_ethdev_sec.c b/drivers/net/cnxk/cn10k_ethdev_sec.c
index 110630596e..c477b12a30 100644
--- a/drivers/net/cnxk/cn10k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn10k_ethdev_sec.c
@@ -845,10 +845,9 @@ cn10k_eth_sec_session_create(void *device,
memset(inb_sa_dptr, 0, sizeof(struct roc_ot_ipsec_inb_sa));
/* Fill inbound sa params */
- rc = cnxk_ot_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto);
+ rc = cnxk_ot_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto, 0);
if (rc) {
- snprintf(tbuf, sizeof(tbuf),
- "Failed to init inbound sa, rc=%d", rc);
+ snprintf(tbuf, sizeof(tbuf), "Failed to init inbound sa, rc=%d", rc);
goto err;
}
@@ -936,10 +935,9 @@ cn10k_eth_sec_session_create(void *device,
memset(outb_sa_dptr, 0, sizeof(struct roc_ot_ipsec_outb_sa));
/* Fill outbound sa params */
- rc = cnxk_ot_ipsec_outb_sa_fill(outb_sa_dptr, ipsec, crypto);
+ rc = cnxk_ot_ipsec_outb_sa_fill(outb_sa_dptr, ipsec, crypto, 0);
if (rc) {
- snprintf(tbuf, sizeof(tbuf),
- "Failed to init outbound sa, rc=%d", rc);
+ snprintf(tbuf, sizeof(tbuf), "Failed to init outbound sa, rc=%d", rc);
rc |= cnxk_eth_outb_sa_idx_put(dev, sa_idx);
goto err;
}
@@ -1148,7 +1146,7 @@ cn10k_eth_sec_session_update(void *device, struct rte_security_session *sess,
inb_sa_dptr = (struct roc_ot_ipsec_inb_sa *)dev->inb.sa_dptr;
memset(inb_sa_dptr, 0, sizeof(struct roc_ot_ipsec_inb_sa));
- rc = cnxk_ot_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto);
+ rc = cnxk_ot_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto, 0);
if (rc)
goto err;
/* Use cookie for original data */
@@ -1183,7 +1181,7 @@ cn10k_eth_sec_session_update(void *device, struct rte_security_session *sess,
outb_sa_dptr = (struct roc_ot_ipsec_outb_sa *)dev->outb.sa_dptr;
memset(outb_sa_dptr, 0, sizeof(struct roc_ot_ipsec_outb_sa));
- rc = cnxk_ot_ipsec_outb_sa_fill(outb_sa_dptr, ipsec, crypto);
+ rc = cnxk_ot_ipsec_outb_sa_fill(outb_sa_dptr, ipsec, crypto, 0);
if (rc)
goto err;
diff --git a/drivers/net/cnxk/cn20k_ethdev_sec.c b/drivers/net/cnxk/cn20k_ethdev_sec.c
index 4284b726ee..5bf7917345 100644
--- a/drivers/net/cnxk/cn20k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn20k_ethdev_sec.c
@@ -736,7 +736,7 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con
memset(inb_sa_dptr, 0, sizeof(struct roc_ow_ipsec_inb_sa));
/* Fill inbound sa params */
- rc = cnxk_ow_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto);
+ rc = cnxk_ow_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto, 0);
if (rc) {
snprintf(tbuf, sizeof(tbuf), "Failed to init inbound sa, rc=%d", rc);
goto err;
@@ -814,7 +814,7 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con
memset(outb_sa_dptr, 0, sizeof(struct roc_ow_ipsec_outb_sa));
/* Fill outbound sa params */
- rc = cnxk_ow_ipsec_outb_sa_fill(outb_sa_dptr, ipsec, crypto);
+ rc = cnxk_ow_ipsec_outb_sa_fill(outb_sa_dptr, ipsec, crypto, 0);
if (rc) {
snprintf(tbuf, sizeof(tbuf), "Failed to init outbound sa, rc=%d", rc);
rc |= cnxk_eth_outb_sa_idx_put(dev, sa_idx);
@@ -1000,7 +1000,7 @@ cn20k_eth_sec_session_update(void *device, struct rte_security_session *sess,
inb_sa_dptr = (struct roc_ow_ipsec_inb_sa *)dev->inb.sa_dptr;
memset(inb_sa_dptr, 0, sizeof(struct roc_ow_ipsec_inb_sa));
- rc = cnxk_ow_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto);
+ rc = cnxk_ow_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto, 0);
if (rc)
return -EINVAL;
/* Use cookie for original data */
@@ -1034,7 +1034,7 @@ cn20k_eth_sec_session_update(void *device, struct rte_security_session *sess,
outb_sa_dptr = (struct roc_ow_ipsec_outb_sa *)dev->outb.sa_dptr;
memset(outb_sa_dptr, 0, sizeof(struct roc_ow_ipsec_outb_sa));
- rc = cnxk_ow_ipsec_outb_sa_fill(outb_sa_dptr, ipsec, crypto);
+ rc = cnxk_ow_ipsec_outb_sa_fill(outb_sa_dptr, ipsec, crypto, 0);
if (rc)
return -EINVAL;
--
2.25.1
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v2 2/8] crypto/cnxk: fix compilation error and warnings
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 1/8] common/cnxk: get context ilen as devarg Tejasree Kondoj
@ 2025-08-21 6:13 ` Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 3/8] crypto/cnxk: add new API to get fpm tbl address Tejasree Kondoj
` (6 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Tejasree Kondoj @ 2025-08-21 6:13 UTC (permalink / raw)
To: Akhil Goyal
Cc: Nithinsen Kaithakadan, Anoob Joseph, Aakash Sasidharan,
Rupesh Chiluka, Sucharitha Sarananaga, Vidya Sagar Velumuri, dev,
stable
From: Nithinsen Kaithakadan <nkaithakadan@marvell.com>
Remove multiple return statements.
Fix compilation error in debug mode.
Fixes: 8fc370ee0208 ("crypto/cnxk: add CN20K security skeleton")
Cc: stable@dpdk.org
Signed-off-by: Nithinsen Kaithakadan <nkaithakadan@marvell.com>
---
drivers/crypto/cnxk/cn20k_ipsec.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/crypto/cnxk/cn20k_ipsec.c b/drivers/crypto/cnxk/cn20k_ipsec.c
index 8f79033ccc..0bca863492 100644
--- a/drivers/crypto/cnxk/cn20k_ipsec.c
+++ b/drivers/crypto/cnxk/cn20k_ipsec.c
@@ -373,6 +373,4 @@ cn20k_ipsec_session_update(struct cnxk_cpt_vf *vf, struct cnxk_cpt_qp *qp,
return cn20k_ipsec_outb_sa_create(roc_cpt, &qp->lf, &conf->ipsec, conf->crypto_xform,
(struct cn20k_sec_session *)sess);
-
- return 0;
}
--
2.25.1
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v2 3/8] crypto/cnxk: add new API to get fpm tbl address
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 1/8] common/cnxk: get context ilen as devarg Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 2/8] crypto/cnxk: fix compilation error and warnings Tejasree Kondoj
@ 2025-08-21 6:13 ` Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 4/8] crypto/cnxk: add new API to get EC grp " Tejasree Kondoj
` (5 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Tejasree Kondoj @ 2025-08-21 6:13 UTC (permalink / raw)
To: Akhil Goyal
Cc: Sucharitha Sarananaga, Anoob Joseph, Aakash Sasidharan,
Nithinsen Kaithakadan, Rupesh Chiluka, Vidya Sagar Velumuri, dev
From: Sucharitha Sarananaga <ssarananaga@marvell.com>
This patch introduces a new API to get FPM table host address.
Signed-off-by: Sucharitha Sarananaga <ssarananaga@marvell.com>
---
drivers/crypto/cnxk/cnxk_cryptodev_ops.c | 23 +++++++++++++++++++++++
drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h | 18 ++++++++++++++++++
2 files changed, 41 insertions(+)
diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_ops.c b/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
index 2bf156bddb..97c12c6087 100644
--- a/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
@@ -12,6 +12,7 @@
#endif
#include <rte_security_driver.h>
+#include "roc_ae.h"
#include "roc_ae_fpm_tables.h"
#include "roc_cpt.h"
#include "roc_errata.h"
@@ -995,6 +996,28 @@ rte_pmd_cnxk_crypto_qptr_get(uint8_t dev_id, uint16_t qp_id)
return qptr;
}
+RTE_EXPORT_EXPERIMENTAL_SYMBOL(rte_pmd_cnxk_ae_fpm_table_get, 25.07)
+const uint64_t *
+rte_pmd_cnxk_ae_fpm_table_get(uint8_t dev_id)
+{
+ struct rte_cryptodev *dev;
+ struct cnxk_cpt_vf *vf;
+
+ dev = rte_cryptodev_pmd_get_dev(dev_id);
+ if (dev == NULL) {
+ plt_err("Invalid dev_id %u", dev_id);
+ return NULL;
+ }
+
+ vf = dev->data->dev_private;
+ if (vf == NULL) {
+ plt_err("VF is not initialized");
+ return NULL;
+ }
+
+ return vf->cnxk_fpm_iova;
+}
+
static inline void
cnxk_crypto_cn10k_submit(struct rte_pmd_cnxk_crypto_qptr *qptr, void *inst, uint16_t nb_inst)
{
diff --git a/drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h b/drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h
index 46861ab2cf..cd3ddc9dd1 100644
--- a/drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h
+++ b/drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h
@@ -213,4 +213,22 @@ __rte_experimental
int rte_pmd_cnxk_crypto_qp_stats_get(struct rte_pmd_cnxk_crypto_qptr *qptr,
struct rte_pmd_cnxk_crypto_qp_stats *stats);
+/**
+ * Retrieves the addresses of the AE FPM (Finite Precision Math) tables.
+ *
+ * This API should be called only after the cryptodev device has been
+ * successfully configured. The returned pointer reference memory that is
+ * valid as long as the device remains configured and is not destroyed or
+ * reconfigured. If the device is reconfigured or destroyed, the memory
+ * referenced by the returned pointer becomes invalid and must not be used.
+ *
+ * @param dev_id
+ * Device identifier of cryptodev device.
+ * @return
+ * - On success pointer to the AE FPM table addresses.
+ * - NULL on error.
+ */
+__rte_experimental
+const uint64_t *rte_pmd_cnxk_ae_fpm_table_get(uint8_t dev_id);
+
#endif /* _PMD_CNXK_CRYPTO_H_ */
--
2.25.1
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v2 4/8] crypto/cnxk: add new API to get EC grp tbl address
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
` (2 preceding siblings ...)
2025-08-21 6:13 ` [PATCH v2 3/8] crypto/cnxk: add new API to get fpm tbl address Tejasree Kondoj
@ 2025-08-21 6:13 ` Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 5/8] crypto/cnxk: align cptr to 256B in cn20k Tejasree Kondoj
` (4 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Tejasree Kondoj @ 2025-08-21 6:13 UTC (permalink / raw)
To: Akhil Goyal
Cc: Sucharitha Sarananaga, Anoob Joseph, Aakash Sasidharan,
Nithinsen Kaithakadan, Rupesh Chiluka, Vidya Sagar Velumuri, dev
From: Sucharitha Sarananaga <ssarananaga@marvell.com>
This patch introduces a new API to get AE EC group table
address and added static_assert checks to ensure that each
enum value in roc_ae_ec_id matches its expected constant.
This helps catch accidental changes or reordering of enum
values at compile time.
Signed-off-by: Sucharitha Sarananaga <ssarananaga@marvell.com>
---
drivers/crypto/cnxk/cnxk_cryptodev_ops.c | 47 ++++++++++++++
drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h | 78 +++++++++++++++++++++++
2 files changed, 125 insertions(+)
diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_ops.c b/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
index 97c12c6087..8bc7b2c345 100644
--- a/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
@@ -43,6 +43,29 @@
#define CNXK_CPT_MAX_ASYM_OP_MOD_LEN 1024
#define CNXK_CPT_META_BUF_MAX_CACHE_SIZE 128
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_P192 == (uint16_t)ROC_AE_EC_ID_P192,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_P224 == (uint16_t)ROC_AE_EC_ID_P224,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_P256 == (uint16_t)ROC_AE_EC_ID_P256,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_P384 == (uint16_t)ROC_AE_EC_ID_P384,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_P521 == (uint16_t)ROC_AE_EC_ID_P521,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_P160 == (uint16_t)ROC_AE_EC_ID_P160,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_P320 == (uint16_t)ROC_AE_EC_ID_P320,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_P512 == (uint16_t)ROC_AE_EC_ID_P512,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_SM2 == (uint16_t)ROC_AE_EC_ID_SM2,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_ED25519 == (uint16_t)ROC_AE_EC_ID_ED25519,
+ "Enum value mismatch");
+static_assert((uint16_t)RTE_PMD_CNXK_AE_EC_ID_ED448 == (uint16_t)ROC_AE_EC_ID_ED448,
+ "Enum value mismatch");
+
static int
cnxk_cpt_get_mlen(void)
{
@@ -1018,6 +1041,30 @@ rte_pmd_cnxk_ae_fpm_table_get(uint8_t dev_id)
return vf->cnxk_fpm_iova;
}
+RTE_EXPORT_EXPERIMENTAL_SYMBOL(rte_pmd_cnxk_ae_ec_grp_table_get, 25.07)
+const struct rte_pmd_cnxk_crypto_ae_ec_group_params **
+rte_pmd_cnxk_ae_ec_grp_table_get(uint8_t dev_id, uint16_t *nb_max_entries)
+{
+ struct rte_cryptodev *dev;
+ struct cnxk_cpt_vf *vf;
+
+ dev = rte_cryptodev_pmd_get_dev(dev_id);
+ if (dev == NULL) {
+ plt_err("Invalid dev_id %u", dev_id);
+ return NULL;
+ }
+
+ vf = dev->data->dev_private;
+ if (vf == NULL) {
+ plt_err("VF is not initialized");
+ return NULL;
+ }
+
+ *nb_max_entries = ROC_AE_EC_ID_PMAX;
+
+ return (const struct rte_pmd_cnxk_crypto_ae_ec_group_params **)(void *)vf->ec_grp;
+}
+
static inline void
cnxk_crypto_cn10k_submit(struct rte_pmd_cnxk_crypto_qptr *qptr, void *inst, uint16_t nb_inst)
{
diff --git a/drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h b/drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h
index cd3ddc9dd1..3d43c77b8c 100644
--- a/drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h
+++ b/drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h
@@ -16,6 +16,26 @@
#include <rte_crypto.h>
#include <rte_security.h>
+#define AE_EC_DATA_MAX 66
+
+/**
+ * Enumerates supported elliptic curves
+ */
+typedef enum {
+ RTE_PMD_CNXK_AE_EC_ID_P192 = 0,
+ RTE_PMD_CNXK_AE_EC_ID_P224 = 1,
+ RTE_PMD_CNXK_AE_EC_ID_P256 = 2,
+ RTE_PMD_CNXK_AE_EC_ID_P384 = 3,
+ RTE_PMD_CNXK_AE_EC_ID_P521 = 4,
+ RTE_PMD_CNXK_AE_EC_ID_P160 = 5,
+ RTE_PMD_CNXK_AE_EC_ID_P320 = 6,
+ RTE_PMD_CNXK_AE_EC_ID_P512 = 7,
+ RTE_PMD_CNXK_AE_EC_ID_SM2 = 8,
+ RTE_PMD_CNXK_AE_EC_ID_ED25519 = 9,
+ RTE_PMD_CNXK_AE_EC_ID_ED448 = 10,
+ RTE_PMD_CNXK_AE_EC_ID_PMAX
+} rte_pmd_cnxk_ae_ec_id;
+
/* Forward declarations */
/**
@@ -72,6 +92,41 @@ struct rte_pmd_cnxk_crypto_sess {
};
};
+/**
+ * @brief AE EC (Elliptic Curve) group parameters structure.
+ *
+ * This structure holds the parameters for an elliptic curve group used in
+ * AE (Asymmetric Encryption) operations. It contains the prime, order,
+ * and curve constants (consta and constb), each represented as a byte array
+ * with an associated length. The maximum length is set to accommodate the
+ * largest supported curve (e.g., P521).
+ */
+struct rte_pmd_cnxk_crypto_ae_ec_group_params {
+ struct {
+ /* P521 maximum length */
+ uint8_t data[AE_EC_DATA_MAX];
+ unsigned int length;
+ } prime;
+
+ struct {
+ /* P521 maximum length */
+ uint8_t data[AE_EC_DATA_MAX];
+ unsigned int length;
+ } order;
+
+ struct {
+ /* P521 maximum length */
+ uint8_t data[AE_EC_DATA_MAX];
+ unsigned int length;
+ } consta;
+
+ struct {
+ /* P521 maximum length */
+ uint8_t data[AE_EC_DATA_MAX];
+ unsigned int length;
+ } constb;
+};
+
/**
* Get queue pointer of a specific queue in a cryptodev.
*
@@ -231,4 +286,27 @@ int rte_pmd_cnxk_crypto_qp_stats_get(struct rte_pmd_cnxk_crypto_qptr *qptr,
__rte_experimental
const uint64_t *rte_pmd_cnxk_ae_fpm_table_get(uint8_t dev_id);
+/**
+ * Retrieves the addresses of the AE EC group table.
+ *
+ * This API should be called only after the cryptodev device has been
+ * successfully configured. The returned pointer reference memory that is
+ * valid as long as the device remains configured and is not destroyed or
+ * reconfigured. If the device is reconfigured or destroyed, the memory
+ * referenced by the returned pointer becomes invalid and must not be used.
+ *
+ * @param dev_id
+ * Device identifier of cryptodev device.
+ * @param nb_max_entries
+ * Pointer to store the maximum number of entries in the EC group table.
+ * This value is set by the function to indicate how many entries can be
+ * retrieved from the table.
+ * @return
+ * - On success, pointer to the AE EC group table structure address.
+ * - NULL on error.
+ */
+__rte_experimental
+const struct rte_pmd_cnxk_crypto_ae_ec_group_params **
+rte_pmd_cnxk_ae_ec_grp_table_get(uint8_t dev_id, uint16_t *nb_max_entries);
+
#endif /* _PMD_CNXK_CRYPTO_H_ */
--
2.25.1
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v2 5/8] crypto/cnxk: align cptr to 256B in cn20k
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
` (3 preceding siblings ...)
2025-08-21 6:13 ` [PATCH v2 4/8] crypto/cnxk: add new API to get EC grp " Tejasree Kondoj
@ 2025-08-21 6:13 ` Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 6/8] crypto/cnxk: refactor rsa verification Tejasree Kondoj
` (3 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Tejasree Kondoj @ 2025-08-21 6:13 UTC (permalink / raw)
To: Akhil Goyal
Cc: Nithinsen Kaithakadan, Anoob Joseph, Aakash Sasidharan,
Rupesh Chiluka, Sucharitha Sarananaga, Vidya Sagar Velumuri, dev
From: Nithinsen Kaithakadan <nkaithakadan@marvell.com>
Change the alignment of cptr to 256 bytes from
128 bytes in cn20k.
Signed-off-by: Nithinsen Kaithakadan <nkaithakadan@marvell.com>
---
drivers/common/cnxk/roc_cpt.h | 4 +
drivers/common/cnxk/roc_se.h | 37 +++----
drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 8 +-
drivers/crypto/cnxk/cn20k_cryptodev_ops.c | 8 +-
drivers/crypto/cnxk/cn20k_ipsec.c | 74 +++++++++----
drivers/crypto/cnxk/cn20k_ipsec.h | 15 ++-
drivers/crypto/cnxk/cn20k_ipsec_la_ops.h | 41 +++++---
drivers/crypto/cnxk/cnxk_cryptodev_ops.c | 61 ++++++++---
drivers/crypto/cnxk/cnxk_se.h | 121 ++++++++++++++++------
9 files changed, 253 insertions(+), 116 deletions(-)
diff --git a/drivers/common/cnxk/roc_cpt.h b/drivers/common/cnxk/roc_cpt.h
index aa30f46f04..37bca8d183 100644
--- a/drivers/common/cnxk/roc_cpt.h
+++ b/drivers/common/cnxk/roc_cpt.h
@@ -129,6 +129,10 @@
(PLT_ALIGN_CEIL(ROC_AR_WIN_SIZE_MAX, BITS_PER_LONG_LONG) / \
BITS_PER_LONG_LONG)
+/* ROC CPTR Cache */
+#define ROC_CPTR_CACHE_LINE_SZ 256
+#define ROC_CPTR_ALIGN ROC_CPTR_CACHE_LINE_SZ
+
enum {
ROC_CPT_REVISION_ID_83XX = 0,
ROC_CPT_REVISION_ID_96XX_B0 = 1,
diff --git a/drivers/common/cnxk/roc_se.h b/drivers/common/cnxk/roc_se.h
index f2c4056169..9afcda8ba4 100644
--- a/drivers/common/cnxk/roc_se.h
+++ b/drivers/common/cnxk/roc_se.h
@@ -314,24 +314,6 @@ struct roc_se_iov_ptr {
#define ROC_SE_PDCP_CHAIN_CTX_KEY_IV 1
struct roc_se_ctx {
- /* Below fields are accessed by sw */
- uint64_t enc_cipher : 8;
- uint64_t hash_type : 8;
- uint64_t mac_len : 8;
- uint64_t auth_key_len : 16;
- uint64_t fc_type : 4;
- uint64_t hmac : 1;
- uint64_t zsk_flags : 3;
- uint64_t k_ecb : 1;
- uint64_t pdcp_ci_alg : 2;
- uint64_t pdcp_auth_alg : 2;
- uint64_t ciph_then_auth : 1;
- uint64_t auth_then_ciph : 1;
- uint64_t eia2 : 1;
- /* auth_iv_offset passed to PDCP_CHAIN opcode based on FVC bit */
- uint8_t pdcp_iv_offset;
- union cpt_inst_w4 template_w4;
- uint8_t *auth_key;
/* Below fields are accessed by hardware */
struct se_ctx_s {
/* Word0 */
@@ -356,6 +338,25 @@ struct roc_se_ctx {
struct roc_se_sm_context sm_ctx;
};
} se_ctx __plt_aligned(ROC_ALIGN);
+
+ /* Below fields are accessed by sw */
+ uint64_t enc_cipher : 8;
+ uint64_t hash_type : 8;
+ uint64_t mac_len : 8;
+ uint64_t auth_key_len : 16;
+ uint64_t fc_type : 4;
+ uint64_t hmac : 1;
+ uint64_t zsk_flags : 3;
+ uint64_t k_ecb : 1;
+ uint64_t pdcp_ci_alg : 2;
+ uint64_t pdcp_auth_alg : 2;
+ uint64_t ciph_then_auth : 1;
+ uint64_t auth_then_ciph : 1;
+ uint64_t eia2 : 1;
+ /* auth_iv_offset passed to PDCP_CHAIN opcode based on FVC bit */
+ uint8_t pdcp_iv_offset;
+ union cpt_inst_w4 template_w4;
+ uint8_t *auth_key;
} __plt_aligned(ROC_ALIGN);
struct roc_se_fc_params {
diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
index 31ec88c7d6..17edf636da 100644
--- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
@@ -1928,7 +1928,7 @@ cn10k_sym_configure_raw_dp_ctx(struct rte_cryptodev *dev, uint16_t qp_id,
if (sess_type != RTE_CRYPTO_OP_WITH_SESSION)
return -ENOTSUP;
- if (sess == NULL)
+ if (sess == NULL || sess->roc_se_ctx == NULL)
return -EINVAL;
if ((sess->dp_thr_type == CPT_DP_THREAD_TYPE_PDCP) ||
@@ -1938,11 +1938,11 @@ cn10k_sym_configure_raw_dp_ctx(struct rte_cryptodev *dev, uint16_t qp_id,
return -ENOTSUP;
if ((sess->dp_thr_type == CPT_DP_THREAD_AUTH_ONLY) &&
- ((sess->roc_se_ctx.fc_type == ROC_SE_KASUMI) ||
- (sess->roc_se_ctx.fc_type == ROC_SE_PDCP)))
+ ((sess->roc_se_ctx->fc_type == ROC_SE_KASUMI) ||
+ (sess->roc_se_ctx->fc_type == ROC_SE_PDCP)))
return -ENOTSUP;
- if (sess->roc_se_ctx.hash_type == ROC_SE_SHA1_TYPE)
+ if (sess->roc_se_ctx->hash_type == ROC_SE_SHA1_TYPE)
return -ENOTSUP;
dp_ctx = (struct cnxk_sym_dp_ctx *)raw_dp_ctx->drv_ctx_data;
diff --git a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
index 6ef7c5bb22..86d02ba5ca 100644
--- a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
@@ -1675,7 +1675,7 @@ cn20k_sym_configure_raw_dp_ctx(struct rte_cryptodev *dev, uint16_t qp_id,
if (sess_type != RTE_CRYPTO_OP_WITH_SESSION)
return -ENOTSUP;
- if (sess == NULL)
+ if (sess == NULL || sess->roc_se_ctx == NULL)
return -EINVAL;
if ((sess->dp_thr_type == CPT_DP_THREAD_TYPE_PDCP) ||
@@ -1685,11 +1685,11 @@ cn20k_sym_configure_raw_dp_ctx(struct rte_cryptodev *dev, uint16_t qp_id,
return -ENOTSUP;
if ((sess->dp_thr_type == CPT_DP_THREAD_AUTH_ONLY) &&
- ((sess->roc_se_ctx.fc_type == ROC_SE_KASUMI) ||
- (sess->roc_se_ctx.fc_type == ROC_SE_PDCP)))
+ ((sess->roc_se_ctx->fc_type == ROC_SE_KASUMI) ||
+ (sess->roc_se_ctx->fc_type == ROC_SE_PDCP)))
return -ENOTSUP;
- if (sess->roc_se_ctx.hash_type == ROC_SE_SHA1_TYPE)
+ if (sess->roc_se_ctx->hash_type == ROC_SE_SHA1_TYPE)
return -ENOTSUP;
dp_ctx = (struct cnxk_sym_dp_ctx *)raw_dp_ctx->drv_ctx_data;
diff --git a/drivers/crypto/cnxk/cn20k_ipsec.c b/drivers/crypto/cnxk/cn20k_ipsec.c
index 0bca863492..785bee02d4 100644
--- a/drivers/crypto/cnxk/cn20k_ipsec.c
+++ b/drivers/crypto/cnxk/cn20k_ipsec.c
@@ -35,20 +35,27 @@ cn20k_ipsec_outb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
int ret = 0;
sa = &sec_sess->sa;
- out_sa = &sa->out_sa;
+
+ out_sa = rte_zmalloc("cn20k_cpt", sizeof(struct roc_ow_ipsec_outb_sa), ROC_CPTR_ALIGN);
+ if (out_sa == NULL) {
+ plt_err("Couldn't allocate memory for outbound SA");
+ return -ENOMEM;
+ }
+ sa->out_sa = out_sa;
/* Allocate memory to be used as dptr for CPT ucode WRITE_SA op */
sa_dptr = plt_zmalloc(sizeof(struct roc_ow_ipsec_outb_sa), 8);
if (sa_dptr == NULL) {
plt_err("Could not allocate memory for SA dptr");
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto sa_cptr_free;
}
/* Translate security parameters to SA */
ret = cnxk_ow_ipsec_outb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm, roc_cpt->ctx_ilen);
if (ret) {
plt_err("Could not fill outbound session parameters");
- goto sa_dptr_free;
+ goto sa_free;
}
sec_sess->inst.w7 = cnxk_cpt_sec_inst_w7_get(roc_cpt, out_sa);
@@ -72,7 +79,7 @@ cn20k_ipsec_outb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
if (ipsec_xfrm->options.iv_gen_disable != 0) {
plt_err("Application provided IV not supported");
ret = -ENOTSUP;
- goto sa_dptr_free;
+ goto sa_free;
}
#endif
@@ -81,7 +88,7 @@ cn20k_ipsec_outb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
/* Get Rlen calculation data */
ret = cnxk_ipsec_outb_rlens_get(&rlens, ipsec_xfrm, crypto_xfrm);
if (ret)
- goto sa_dptr_free;
+ goto sa_free;
sec_sess->max_extended_len = rlens.max_extended_len;
@@ -128,21 +135,26 @@ cn20k_ipsec_outb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
ret = roc_cpt_ctx_write(lf, sa_dptr, out_sa, sizeof(struct roc_ow_ipsec_outb_sa));
if (ret) {
plt_err("Could not write outbound session to hardware");
- goto sa_dptr_free;
+ goto sa_free;
}
/* Trigger CTX flush so that data is written back to DRAM */
ret = roc_cpt_lf_ctx_flush(lf, out_sa, false);
if (ret == -EFAULT) {
plt_err("Could not flush outbound session");
- goto sa_dptr_free;
+ goto sa_free;
}
sec_sess->proto = RTE_SECURITY_PROTOCOL_IPSEC;
rte_atomic_thread_fence(rte_memory_order_seq_cst);
-sa_dptr_free:
+sa_free:
plt_free(sa_dptr);
+sa_cptr_free:
+ if (ret != 0) {
+ rte_free(out_sa);
+ out_sa = NULL;
+ }
return ret;
}
@@ -161,20 +173,27 @@ cn20k_ipsec_inb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
int ret = 0;
sa = &sec_sess->sa;
- in_sa = &sa->in_sa;
+
+ in_sa = rte_zmalloc("cn20k_cpt", sizeof(struct roc_ow_ipsec_inb_sa), ROC_CPTR_ALIGN);
+ if (in_sa == NULL) {
+ plt_err("Couldn't allocate memory for inbound SA");
+ return -ENOMEM;
+ }
+ sa->in_sa = in_sa;
/* Allocate memory to be used as dptr for CPT ucode WRITE_SA op */
sa_dptr = plt_zmalloc(sizeof(struct roc_ow_ipsec_inb_sa), 8);
if (sa_dptr == NULL) {
plt_err("Could not allocate memory for SA dptr");
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto sa_cptr_free;
}
/* Translate security parameters to SA */
ret = cnxk_ow_ipsec_inb_sa_fill(sa_dptr, ipsec_xfrm, crypto_xfrm, roc_cpt->ctx_ilen);
if (ret) {
plt_err("Could not fill inbound session parameters");
- goto sa_dptr_free;
+ goto sa_free;
}
sec_sess->ipsec.is_outbound = 0;
@@ -231,21 +250,26 @@ cn20k_ipsec_inb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
ret = roc_cpt_ctx_write(lf, sa_dptr, in_sa, sizeof(struct roc_ow_ipsec_inb_sa));
if (ret) {
plt_err("Could not write inbound session to hardware");
- goto sa_dptr_free;
+ goto sa_free;
}
/* Trigger CTX flush so that data is written back to DRAM */
ret = roc_cpt_lf_ctx_flush(lf, in_sa, true);
if (ret == -EFAULT) {
plt_err("Could not flush inbound session");
- goto sa_dptr_free;
+ goto sa_free;
}
sec_sess->proto = RTE_SECURITY_PROTOCOL_IPSEC;
rte_atomic_thread_fence(rte_memory_order_seq_cst);
-sa_dptr_free:
+sa_free:
plt_free(sa_dptr);
+sa_cptr_free:
+ if (ret != 0) {
+ rte_free(in_sa);
+ in_sa = NULL;
+ }
return ret;
}
@@ -286,8 +310,11 @@ cn20k_sec_ipsec_session_destroy(struct cnxk_cpt_qp *qp, struct cn20k_sec_session
sa = &sess->sa;
+ if (sa->sa_ptr == NULL)
+ return -EINVAL;
+
/* Trigger CTX flush to write dirty data back to DRAM */
- roc_cpt_lf_ctx_flush(lf, &sa->in_sa, false);
+ roc_cpt_lf_ctx_flush(lf, sa->in_sa, false);
ret = -1;
@@ -296,7 +323,7 @@ cn20k_sec_ipsec_session_destroy(struct cnxk_cpt_qp *qp, struct cn20k_sec_session
if (sa_dptr != NULL) {
roc_ow_ipsec_outb_sa_init(sa_dptr);
- ret = roc_cpt_ctx_write(lf, sa_dptr, &sa->out_sa,
+ ret = roc_cpt_ctx_write(lf, sa_dptr, sa->out_sa,
sizeof(struct roc_ow_ipsec_outb_sa));
}
} else {
@@ -304,7 +331,7 @@ cn20k_sec_ipsec_session_destroy(struct cnxk_cpt_qp *qp, struct cn20k_sec_session
if (sa_dptr != NULL) {
roc_ow_ipsec_inb_sa_init(sa_dptr);
- ret = roc_cpt_ctx_write(lf, sa_dptr, &sa->in_sa,
+ ret = roc_cpt_ctx_write(lf, sa_dptr, sa->in_sa,
sizeof(struct roc_ow_ipsec_inb_sa));
}
}
@@ -317,15 +344,17 @@ cn20k_sec_ipsec_session_destroy(struct cnxk_cpt_qp *qp, struct cn20k_sec_session
/* Wait for 1 ms so that flush is complete */
rte_delay_ms(1);
- w2 = (union roc_ow_ipsec_sa_word2 *)&sa->in_sa.w2;
+ w2 = (union roc_ow_ipsec_sa_word2 *)&sa->in_sa->w2;
w2->s.valid = 0;
rte_atomic_thread_fence(rte_memory_order_seq_cst);
/* Trigger CTX reload to fetch new data from DRAM */
- roc_cpt_lf_ctx_reload(lf, &sa->in_sa);
+ roc_cpt_lf_ctx_reload(lf, sa->in_sa);
}
+ rte_free(sa->sa_ptr);
+
return 0;
}
@@ -340,13 +369,16 @@ cn20k_ipsec_stats_get(struct cnxk_cpt_qp *qp, struct cn20k_sec_session *sess,
stats->protocol = RTE_SECURITY_PROTOCOL_IPSEC;
sa = &sess->sa;
+ if (sa->sa_ptr == NULL)
+ return -EINVAL;
+
if (sess->ipsec.is_outbound) {
- out_sa = &sa->out_sa;
+ out_sa = sa->out_sa;
roc_cpt_lf_ctx_flush(&qp->lf, out_sa, false);
stats->ipsec.opackets = out_sa->ctx.mib_pkts;
stats->ipsec.obytes = out_sa->ctx.mib_octs;
} else {
- in_sa = &sa->in_sa;
+ in_sa = sa->in_sa;
roc_cpt_lf_ctx_flush(&qp->lf, in_sa, false);
stats->ipsec.ipackets = in_sa->ctx.mib_pkts;
stats->ipsec.ibytes = in_sa->ctx.mib_octs;
diff --git a/drivers/crypto/cnxk/cn20k_ipsec.h b/drivers/crypto/cnxk/cn20k_ipsec.h
index 202d52405d..069142fbc6 100644
--- a/drivers/crypto/cnxk/cn20k_ipsec.h
+++ b/drivers/crypto/cnxk/cn20k_ipsec.h
@@ -18,13 +18,18 @@
/* Forward declaration */
struct cn20k_sec_session;
-struct __rte_aligned(ROC_ALIGN) cn20k_ipsec_sa
+struct __rte_aligned(ROC_CPTR_ALIGN) cn20k_ipsec_sa
{
union {
- /** Inbound SA */
- struct roc_ow_ipsec_inb_sa in_sa;
- /** Outbound SA */
- struct roc_ow_ipsec_outb_sa out_sa;
+ void *sa_ptr;
+ struct {
+ union {
+ /** Inbound SA */
+ struct roc_ow_ipsec_inb_sa *in_sa;
+ /** Outbound SA */
+ struct roc_ow_ipsec_outb_sa *out_sa;
+ };
+ };
};
};
diff --git a/drivers/crypto/cnxk/cn20k_ipsec_la_ops.h b/drivers/crypto/cnxk/cn20k_ipsec_la_ops.h
index 2f860c1855..10afa666e0 100644
--- a/drivers/crypto/cnxk/cn20k_ipsec_la_ops.h
+++ b/drivers/crypto/cnxk/cn20k_ipsec_la_ops.h
@@ -19,9 +19,12 @@
static inline void
ipsec_po_sa_iv_set(struct cn20k_sec_session *sess, struct rte_crypto_op *cop)
{
- uint64_t *iv = &sess->sa.out_sa.iv.u64[0];
- uint64_t *tmp_iv;
+ uint64_t *iv, *tmp_iv;
+ if (sess->sa.out_sa == NULL)
+ return;
+
+ iv = &sess->sa.out_sa->iv.u64[0];
memcpy(iv, rte_crypto_op_ctod_offset(cop, uint8_t *, sess->iv_offset), 16);
tmp_iv = (uint64_t *)iv;
*tmp_iv = rte_be_to_cpu_64(*tmp_iv);
@@ -33,14 +36,18 @@ ipsec_po_sa_iv_set(struct cn20k_sec_session *sess, struct rte_crypto_op *cop)
static inline void
ipsec_po_sa_aes_8b_iv_set(struct cn20k_sec_session *sess, struct rte_crypto_op *cop)
{
- uint8_t *iv = &sess->sa.out_sa.iv.s.iv_dbg1[0];
+ uint8_t *iv;
uint32_t *tmp_iv;
+ if (sess->sa.out_sa == NULL)
+ return;
+
+ iv = &sess->sa.out_sa->iv.s.iv_dbg1[0];
memcpy(iv, rte_crypto_op_ctod_offset(cop, uint8_t *, sess->iv_offset), 4);
tmp_iv = (uint32_t *)iv;
*tmp_iv = rte_be_to_cpu_32(*tmp_iv);
- iv = &sess->sa.out_sa.iv.s.iv_dbg2[0];
+ iv = &sess->sa.out_sa->iv.s.iv_dbg2[0];
memcpy(iv, rte_crypto_op_ctod_offset(cop, uint8_t *, sess->iv_offset + 4), 4);
tmp_iv = (uint32_t *)iv;
*tmp_iv = rte_be_to_cpu_32(*tmp_iv);
@@ -59,19 +66,21 @@ process_outb_sa(struct roc_cpt_lf *lf, struct rte_crypto_op *cop, struct cn20k_s
RTE_SET_USED(lf);
#ifdef LA_IPSEC_DEBUG
- if (sess->sa.out_sa.w2.s.iv_src == ROC_IE_OW_SA_IV_SRC_FROM_SA) {
- if (sess->sa.out_sa.w2.s.enc_type == ROC_IE_SA_ENC_AES_GCM ||
- sess->sa.out_sa.w2.s.enc_type == ROC_IE_SA_ENC_AES_CCM ||
- sess->sa.out_sa.w2.s.auth_type == ROC_IE_SA_AUTH_AES_GMAC ||
- sess->sa.out_sa.w2.s.enc_type == ROC_IE_SA_ENC_AES_CTR)
- ipsec_po_sa_aes_8b_iv_set(sess, cop);
- else
- ipsec_po_sa_iv_set(sess, cop);
- }
+ if (sess->sa.out_sa) {
+ if (sess->sa.out_sa->w2.s.iv_src == ROC_IE_OW_SA_IV_SRC_FROM_SA) {
+ if (sess->sa.out_sa->w2.s.enc_type == ROC_IE_SA_ENC_AES_GCM ||
+ sess->sa.out_sa->w2.s.enc_type == ROC_IE_SA_ENC_AES_CCM ||
+ sess->sa.out_sa->w2.s.auth_type == ROC_IE_SA_AUTH_AES_GMAC ||
+ sess->sa.out_sa->w2.s.enc_type == ROC_IE_SA_ENC_AES_CTR)
+ ipsec_po_sa_aes_8b_iv_set(sess, cop);
+ else
+ ipsec_po_sa_iv_set(sess, cop);
+ }
- /* Trigger CTX reload to fetch new data from DRAM */
- roc_cpt_lf_ctx_reload(lf, &sess->sa.out_sa);
- rte_delay_ms(1);
+ /* Trigger CTX reload to fetch new data from DRAM */
+ roc_cpt_lf_ctx_reload(lf, sess->sa.out_sa);
+ rte_delay_ms(1);
+ }
#endif
const uint64_t ol_flags = m_src->ol_flags;
diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_ops.c b/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
index 8bc7b2c345..7dc4c684cc 100644
--- a/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_ops.c
@@ -600,9 +600,9 @@ cnxk_sess_fill(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *xform,
bool ciph_then_auth = false;
if (roc_cpt->hw_caps[CPT_ENG_TYPE_SE].pdcp_chain_zuc256)
- sess->roc_se_ctx.pdcp_iv_offset = 24;
+ sess->roc_se_ctx->pdcp_iv_offset = 24;
else
- sess->roc_se_ctx.pdcp_iv_offset = 16;
+ sess->roc_se_ctx->pdcp_iv_offset = 16;
if (xform == NULL)
return -EINVAL;
@@ -706,7 +706,7 @@ cnxk_sess_fill(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *xform,
return -ENOTSUP;
}
}
- sess->roc_se_ctx.ciph_then_auth = 1;
+ sess->roc_se_ctx->ciph_then_auth = 1;
sess->chained_op = 1;
if (fill_sess_cipher(c_xfrm, sess))
return -ENOTSUP;
@@ -742,7 +742,7 @@ cnxk_sess_fill(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *xform,
}
}
- sess->roc_se_ctx.auth_then_ciph = 1;
+ sess->roc_se_ctx->auth_then_ciph = 1;
sess->chained_op = 1;
if (fill_sess_auth(a_xfrm, sess))
return -ENOTSUP;
@@ -757,7 +757,12 @@ cnxk_cpt_inst_w7_get(struct cnxk_se_sess *sess, struct roc_cpt *roc_cpt)
{
union cpt_inst_w7 inst_w7;
- inst_w7.s.cptr = (uint64_t)&sess->roc_se_ctx.se_ctx;
+ if (sess->roc_se_ctx == NULL) {
+ plt_err("Invalid se context");
+ return 0;
+ }
+
+ inst_w7.s.cptr = (uint64_t)&sess->roc_se_ctx->se_ctx;
if (hw_ctx_cache_enable())
inst_w7.s.ctx_val = 1;
@@ -787,6 +792,13 @@ sym_session_configure(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *xfor
if (is_session_less)
memset(sess_priv, 0, sizeof(struct cnxk_se_sess));
+ sess_priv->roc_se_ctx =
+ rte_zmalloc("roc_se_ctx", sizeof(struct roc_se_ctx), ROC_CPTR_ALIGN);
+ if (sess_priv->roc_se_ctx == NULL) {
+ plt_err("Couldn't allocate memory for se context");
+ return -ENOMEM;
+ }
+
ret = cnxk_sess_fill(roc_cpt, xform, sess_priv);
if (ret)
goto priv_put;
@@ -796,7 +808,7 @@ sym_session_configure(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *xfor
if (sess_priv->passthrough)
thr_type = CPT_DP_THREAD_TYPE_PT;
else if (sess_priv->cpt_op & ROC_SE_OP_CIPHER_MASK) {
- switch (sess_priv->roc_se_ctx.fc_type) {
+ switch (sess_priv->roc_se_ctx->fc_type) {
case ROC_SE_FC_GEN:
if (sess_priv->aes_gcm || sess_priv->aes_ccm || sess_priv->chacha_poly)
thr_type = CPT_DP_THREAD_TYPE_FC_AEAD;
@@ -826,12 +838,12 @@ sym_session_configure(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *xfor
sess_priv->dp_thr_type = thr_type;
- if ((sess_priv->roc_se_ctx.fc_type == ROC_SE_HASH_HMAC) &&
+ if ((sess_priv->roc_se_ctx->fc_type == ROC_SE_HASH_HMAC) &&
cpt_mac_len_verify(&xform->auth)) {
plt_dp_err("MAC length is not supported");
- if (sess_priv->roc_se_ctx.auth_key != NULL) {
- plt_free(sess_priv->roc_se_ctx.auth_key);
- sess_priv->roc_se_ctx.auth_key = NULL;
+ if (sess_priv->roc_se_ctx->auth_key != NULL) {
+ plt_free(sess_priv->roc_se_ctx->auth_key);
+ sess_priv->roc_se_ctx->auth_key = NULL;
}
ret = -ENOTSUP;
@@ -841,14 +853,18 @@ sym_session_configure(struct roc_cpt *roc_cpt, struct rte_crypto_sym_xform *xfor
sess_priv->cpt_inst_w7 = cnxk_cpt_inst_w7_get(sess_priv, roc_cpt);
if (hw_ctx_cache_enable())
- roc_se_ctx_init(&sess_priv->roc_se_ctx);
+ roc_se_ctx_init(sess_priv->roc_se_ctx);
- if (sess_priv->roc_se_ctx.se_ctx.w0.s.ctx_size < roc_cpt->ctx_ilen)
- sess_priv->roc_se_ctx.se_ctx.w0.s.ctx_size = roc_cpt->ctx_ilen;
+ if (sess_priv->roc_se_ctx->se_ctx.w0.s.ctx_size < roc_cpt->ctx_ilen)
+ sess_priv->roc_se_ctx->se_ctx.w0.s.ctx_size = roc_cpt->ctx_ilen;
return 0;
priv_put:
+ if (sess_priv->roc_se_ctx != NULL) {
+ rte_free(sess_priv->roc_se_ctx);
+ sess_priv->roc_se_ctx = NULL;
+ }
return ret;
}
@@ -868,12 +884,19 @@ sym_session_clear(struct rte_cryptodev_sym_session *sess, bool is_session_less)
{
struct cnxk_se_sess *sess_priv = (struct cnxk_se_sess *)sess;
+ if (sess_priv->roc_se_ctx == NULL)
+ return;
+
/* Trigger CTX flush + invalidate to remove from CTX_CACHE */
if (hw_ctx_cache_enable())
- roc_cpt_lf_ctx_flush(sess_priv->lf, &sess_priv->roc_se_ctx.se_ctx, true);
+ roc_cpt_lf_ctx_flush(sess_priv->lf, &sess_priv->roc_se_ctx->se_ctx, true);
- if (sess_priv->roc_se_ctx.auth_key != NULL)
- plt_free(sess_priv->roc_se_ctx.auth_key);
+ if (sess_priv->roc_se_ctx->auth_key != NULL)
+ plt_free(sess_priv->roc_se_ctx->auth_key);
+
+ /* Free the allocated roc_se_ctx memory */
+ rte_free(sess_priv->roc_se_ctx);
+ sess_priv->roc_se_ctx = NULL;
if (is_session_less)
memset(sess_priv, 0, cnxk_cpt_sym_session_get_size(NULL));
@@ -1178,7 +1201,11 @@ rte_pmd_cnxk_crypto_cptr_get(struct rte_pmd_cnxk_crypto_sess *rte_sess)
if (rte_sess->sess_type == RTE_CRYPTO_OP_WITH_SESSION) {
struct cnxk_se_sess *se_sess = PLT_PTR_CAST(rte_sess->crypto_sym_sess);
- return PLT_PTR_CAST(&se_sess->roc_se_ctx.se_ctx);
+ if (se_sess->roc_se_ctx == NULL) {
+ plt_err("Invalid roc_se_ctx pointer");
+ return NULL;
+ }
+ return PLT_PTR_CAST(&se_sess->roc_se_ctx->se_ctx);
}
if (rte_sess->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) {
diff --git a/drivers/crypto/cnxk/cnxk_se.h b/drivers/crypto/cnxk/cnxk_se.h
index 649e38c495..1838140727 100644
--- a/drivers/crypto/cnxk/cnxk_se.h
+++ b/drivers/crypto/cnxk/cnxk_se.h
@@ -65,7 +65,7 @@ struct __rte_aligned(ROC_ALIGN) cnxk_se_sess {
uint64_t cpt_inst_w7;
uint64_t cpt_inst_w2;
struct cnxk_cpt_qp *qp;
- struct roc_se_ctx roc_se_ctx;
+ struct roc_se_ctx *roc_se_ctx;
struct roc_cpt_lf *lf;
};
@@ -1945,6 +1945,11 @@ fill_sess_aead(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
uint32_t cipher_key_len = 0;
aead_form = &xform->aead;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
if (aead_form->op == RTE_CRYPTO_AEAD_OP_ENCRYPT) {
sess->cpt_op |= ROC_SE_OP_CIPHER_ENCRYPT;
sess->cpt_op |= ROC_SE_OP_AUTH_GENERATE;
@@ -2007,34 +2012,39 @@ fill_sess_aead(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
}
}
- if (unlikely(roc_se_ciph_key_set(&sess->roc_se_ctx, enc_type, aead_form->key.data,
+ if (unlikely(roc_se_ciph_key_set(sess->roc_se_ctx, enc_type, aead_form->key.data,
aead_form->key.length)))
return -1;
- if (unlikely(roc_se_auth_key_set(&sess->roc_se_ctx, auth_type, NULL, 0,
+ if (unlikely(roc_se_auth_key_set(sess->roc_se_ctx, auth_type, NULL, 0,
aead_form->digest_length)))
return -1;
if (enc_type == ROC_SE_CHACHA20)
- sess->roc_se_ctx.template_w4.s.opcode_minor |= BIT(5);
+ sess->roc_se_ctx->template_w4.s.opcode_minor |= BIT(5);
return 0;
}
static __rte_always_inline int
fill_sm_sess_cipher(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
{
- struct roc_se_sm_context *sm_ctx = &sess->roc_se_ctx.se_ctx.sm_ctx;
+ struct roc_se_sm_context *sm_ctx = &sess->roc_se_ctx->se_ctx.sm_ctx;
struct rte_crypto_cipher_xform *c_form;
roc_sm_cipher_type enc_type = 0;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
c_form = &xform->cipher;
if (c_form->op == RTE_CRYPTO_CIPHER_OP_ENCRYPT) {
sess->cpt_op |= ROC_SE_OP_CIPHER_ENCRYPT;
- sess->roc_se_ctx.template_w4.s.opcode_minor = ROC_SE_FC_MINOR_OP_ENCRYPT;
+ sess->roc_se_ctx->template_w4.s.opcode_minor = ROC_SE_FC_MINOR_OP_ENCRYPT;
} else if (c_form->op == RTE_CRYPTO_CIPHER_OP_DECRYPT) {
sess->cpt_op |= ROC_SE_OP_CIPHER_DECRYPT;
- sess->roc_se_ctx.template_w4.s.opcode_minor = ROC_SE_FC_MINOR_OP_DECRYPT;
+ sess->roc_se_ctx->template_w4.s.opcode_minor = ROC_SE_FC_MINOR_OP_DECRYPT;
} else {
plt_dp_err("Unknown cipher operation");
return -1;
@@ -2075,9 +2085,9 @@ fill_sm_sess_cipher(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *ses
sess->aes_ctr = 0;
sess->is_null = 0;
sess->is_sm4 = 1;
- sess->roc_se_ctx.fc_type = ROC_SE_SM;
+ sess->roc_se_ctx->fc_type = ROC_SE_SM;
- sess->roc_se_ctx.template_w4.s.opcode_major = ROC_SE_MAJOR_OP_SM;
+ sess->roc_se_ctx->template_w4.s.opcode_major = ROC_SE_MAJOR_OP_SM;
memcpy(sm_ctx->encr_key, c_form->key.data, ROC_SE_SM4_KEY_LEN);
sm_ctx->enc_cipher = enc_type;
@@ -2093,6 +2103,11 @@ fill_sess_cipher(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
roc_se_cipher_type enc_type = 0; /* NULL Cipher type */
uint32_t cipher_key_len = 0;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
c_form = &xform->cipher;
if ((c_form->algo == RTE_CRYPTO_CIPHER_SM4_CBC) ||
@@ -2109,7 +2124,7 @@ fill_sess_cipher(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
if (xform->next != NULL &&
xform->next->type == RTE_CRYPTO_SYM_XFORM_AUTH) {
/* Perform decryption followed by auth verify */
- sess->roc_se_ctx.template_w4.s.opcode_minor =
+ sess->roc_se_ctx->template_w4.s.opcode_minor =
ROC_SE_FC_MINOR_OP_HMAC_FIRST;
}
} else {
@@ -2180,13 +2195,13 @@ fill_sess_cipher(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
break;
case RTE_CRYPTO_CIPHER_AES_DOCSISBPI:
/* Set DOCSIS flag */
- sess->roc_se_ctx.template_w4.s.opcode_minor |= ROC_SE_FC_MINOR_OP_DOCSIS;
+ sess->roc_se_ctx->template_w4.s.opcode_minor |= ROC_SE_FC_MINOR_OP_DOCSIS;
enc_type = ROC_SE_AES_DOCSISBPI;
cipher_key_len = 16;
break;
case RTE_CRYPTO_CIPHER_DES_DOCSISBPI:
/* Set DOCSIS flag */
- sess->roc_se_ctx.template_w4.s.opcode_minor |= ROC_SE_FC_MINOR_OP_DOCSIS;
+ sess->roc_se_ctx->template_w4.s.opcode_minor |= ROC_SE_FC_MINOR_OP_DOCSIS;
enc_type = ROC_SE_DES_DOCSISBPI;
cipher_key_len = 8;
break;
@@ -2207,7 +2222,7 @@ fill_sess_cipher(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
return -1;
}
- if (zsk_flag && sess->roc_se_ctx.ciph_then_auth) {
+ if (zsk_flag && sess->roc_se_ctx->ciph_then_auth) {
struct rte_crypto_auth_xform *a_form;
a_form = &xform->next->auth;
if (c_form->op != RTE_CRYPTO_CIPHER_OP_DECRYPT &&
@@ -2239,7 +2254,7 @@ fill_sess_cipher(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
return -1;
}
- if (unlikely(roc_se_ciph_key_set(&sess->roc_se_ctx, enc_type, c_form->key.data,
+ if (unlikely(roc_se_ciph_key_set(sess->roc_se_ctx, enc_type, c_form->key.data,
c_form->key.length)))
return -1;
@@ -2254,6 +2269,11 @@ fill_sess_auth(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
roc_se_auth_type auth_type = 0; /* NULL Auth type */
uint8_t is_sm3 = 0;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
if (xform->auth.algo == RTE_CRYPTO_AUTH_AES_GMAC)
return fill_sess_gmac(xform, sess);
@@ -2261,8 +2281,7 @@ fill_sess_auth(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
xform->next->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
xform->next->cipher.op == RTE_CRYPTO_CIPHER_OP_ENCRYPT) {
/* Perform auth followed by encryption */
- sess->roc_se_ctx.template_w4.s.opcode_minor =
- ROC_SE_FC_MINOR_OP_HMAC_FIRST;
+ sess->roc_se_ctx->template_w4.s.opcode_minor = ROC_SE_FC_MINOR_OP_HMAC_FIRST;
}
a_form = &xform->auth;
@@ -2377,7 +2396,7 @@ fill_sess_auth(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
return -1;
}
- if (zsk_flag && sess->roc_se_ctx.auth_then_ciph) {
+ if (zsk_flag && sess->roc_se_ctx->auth_then_ciph) {
struct rte_crypto_cipher_xform *c_form;
if (xform->next != NULL) {
c_form = &xform->next->cipher;
@@ -2401,7 +2420,7 @@ fill_sess_auth(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
sess->auth_iv_offset = a_form->iv.offset;
sess->auth_iv_length = a_form->iv.length;
}
- if (unlikely(roc_se_auth_key_set(&sess->roc_se_ctx, auth_type, a_form->key.data,
+ if (unlikely(roc_se_auth_key_set(sess->roc_se_ctx, auth_type, a_form->key.data,
a_form->key.length, a_form->digest_length)))
return -1;
@@ -2415,6 +2434,11 @@ fill_sess_gmac(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
roc_se_cipher_type enc_type = 0; /* NULL Cipher type */
roc_se_auth_type auth_type = 0; /* NULL Auth type */
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
a_form = &xform->auth;
if (a_form->op == RTE_CRYPTO_AUTH_OP_GENERATE)
@@ -2454,11 +2478,11 @@ fill_sess_gmac(struct rte_crypto_sym_xform *xform, struct cnxk_se_sess *sess)
return -1;
}
- if (unlikely(roc_se_ciph_key_set(&sess->roc_se_ctx, enc_type, a_form->key.data,
+ if (unlikely(roc_se_ciph_key_set(sess->roc_se_ctx, enc_type, a_form->key.data,
a_form->key.length)))
return -1;
- if (unlikely(roc_se_auth_key_set(&sess->roc_se_ctx, auth_type, NULL, 0,
+ if (unlikely(roc_se_auth_key_set(sess->roc_se_ctx, auth_type, NULL, 0,
a_form->digest_length)))
return -1;
@@ -2586,6 +2610,11 @@ fill_sm_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
uint32_t ci_data_length = sym_op->cipher.data.length;
uint32_t ci_data_offset = sym_op->cipher.data.offset;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
fc_params.cipher_iv_len = sess->iv_length;
fc_params.auth_iv_len = 0;
fc_params.auth_iv_buf = NULL;
@@ -2607,7 +2636,7 @@ fill_sm_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
d_lens = ci_data_length;
d_lens = (d_lens << 32);
- fc_params.ctx = &sess->roc_se_ctx;
+ fc_params.ctx = sess->roc_se_ctx;
if (m_dst == NULL) {
fc_params.dst_iov = fc_params.src_iov = (void *)src;
@@ -2685,6 +2714,11 @@ fill_fc_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
uint32_t iv_buf[4];
int ret;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
fc_params.cipher_iv_len = sess->iv_length;
fc_params.auth_iv_len = 0;
fc_params.auth_iv_buf = NULL;
@@ -2762,7 +2796,7 @@ fill_fc_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
uint32_t ci_data_offset = sym_op->cipher.data.offset;
uint32_t a_data_length = sym_op->auth.data.length;
uint32_t a_data_offset = sym_op->auth.data.offset;
- struct roc_se_ctx *ctx = &sess->roc_se_ctx;
+ struct roc_se_ctx *ctx = sess->roc_se_ctx;
const uint8_t op_minor = ctx->template_w4.s.opcode_minor;
@@ -2795,7 +2829,7 @@ fill_fc_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
}
}
}
- fc_params.ctx = &sess->roc_se_ctx;
+ fc_params.ctx = sess->roc_se_ctx;
if (!(sess->auth_first) && unlikely(sess->is_null || sess->cpt_op == ROC_SE_OP_DECODE))
inplace = 0;
@@ -2925,13 +2959,18 @@ fill_pdcp_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
uint32_t flags = 0;
int ret;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
/* Cipher only */
fc_params.cipher_iv_len = sess->iv_length;
fc_params.auth_iv_len = 0;
fc_params.iv_buf = NULL;
fc_params.auth_iv_buf = NULL;
- fc_params.pdcp_iv_offset = sess->roc_se_ctx.pdcp_iv_offset;
+ fc_params.pdcp_iv_offset = sess->roc_se_ctx->pdcp_iv_offset;
if (likely(sess->iv_length))
fc_params.iv_buf = rte_crypto_op_ctod_offset(cop, uint8_t *, sess->iv_offset);
@@ -2945,7 +2984,7 @@ fill_pdcp_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
d_offs = (uint64_t)c_data_off << 16;
d_lens = (uint64_t)c_data_len << 32;
- fc_params.ctx = &sess->roc_se_ctx;
+ fc_params.ctx = sess->roc_se_ctx;
if (likely(m_dst == NULL || m_src == m_dst)) {
fc_params.dst_iov = fc_params.src_iov = (void *)src;
@@ -3016,11 +3055,16 @@ fill_pdcp_chain_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
void *mdata;
int ret;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
fc_params.cipher_iv_len = sess->iv_length;
fc_params.auth_iv_len = sess->auth_iv_length;
fc_params.iv_buf = NULL;
fc_params.auth_iv_buf = NULL;
- fc_params.pdcp_iv_offset = sess->roc_se_ctx.pdcp_iv_offset;
+ fc_params.pdcp_iv_offset = sess->roc_se_ctx->pdcp_iv_offset;
m_src = sym_op->m_src;
m_dst = sym_op->m_dst;
@@ -3071,7 +3115,7 @@ fill_pdcp_chain_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
ci_data_length, true);
}
- fc_params.ctx = &sess->roc_se_ctx;
+ fc_params.ctx = sess->roc_se_ctx;
if (likely((m_dst == NULL || m_dst == m_src)) && inplace) {
fc_params.dst_iov = fc_params.src_iov = (void *)src;
@@ -3201,6 +3245,11 @@ fill_digest_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
uint8_t iv_buf[16];
int ret;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
memset(¶ms, 0, sizeof(struct roc_se_fc_params));
m_src = sym_op->m_src;
@@ -3227,7 +3276,7 @@ fill_digest_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
params.auth_iv_len = sess->auth_iv_length;
params.auth_iv_buf =
rte_crypto_op_ctod_offset(cop, uint8_t *, sess->auth_iv_offset);
- params.pdcp_iv_offset = sess->roc_se_ctx.pdcp_iv_offset;
+ params.pdcp_iv_offset = sess->roc_se_ctx->pdcp_iv_offset;
if (sess->zsk_flag == ROC_SE_K_F9) {
uint32_t length_in_bits, num_bytes;
uint8_t *src, direction = 0;
@@ -3257,7 +3306,7 @@ fill_digest_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
d_lens = sym_op->auth.data.length;
- params.ctx = &sess->roc_se_ctx;
+ params.ctx = sess->roc_se_ctx;
if (auth_op == ROC_SE_OP_AUTH_GENERATE) {
if (sym_op->auth.digest.data) {
@@ -3497,8 +3546,13 @@ fill_raw_fc_params(struct cnxk_iov *iov, struct cnxk_se_sess *sess, struct cpt_q
uint32_t iv_buf[4];
int ret;
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
+
fc_params.cipher_iv_len = sess->iv_length;
- fc_params.ctx = &sess->roc_se_ctx;
+ fc_params.ctx = sess->roc_se_ctx;
fc_params.auth_iv_buf = NULL;
fc_params.auth_iv_len = 0;
fc_params.mac_buf.size = 0;
@@ -3618,7 +3672,12 @@ fill_raw_digest_params(struct cnxk_iov *iov, struct cnxk_se_sess *sess,
memset(&fc_params, 0, sizeof(struct roc_se_fc_params));
fc_params.cipher_iv_len = sess->iv_length;
- fc_params.ctx = &sess->roc_se_ctx;
+ fc_params.ctx = sess->roc_se_ctx;
+
+ if (unlikely(sess->roc_se_ctx == NULL)) {
+ plt_dp_err("Session crypto context is NULL");
+ return -EINVAL;
+ }
mdata = alloc_op_meta(&fc_params.meta_buf, m_info->mlen, m_info->pool, infl_req);
if (mdata == NULL) {
--
2.25.1
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v2 6/8] crypto/cnxk: refactor rsa verification
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
` (4 preceding siblings ...)
2025-08-21 6:13 ` [PATCH v2 5/8] crypto/cnxk: align cptr to 256B in cn20k Tejasree Kondoj
@ 2025-08-21 6:13 ` Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 7/8] crypto/cnxk: align PDCP API with latest firmware Tejasree Kondoj
` (2 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: Tejasree Kondoj @ 2025-08-21 6:13 UTC (permalink / raw)
To: Akhil Goyal
Cc: Sucharitha Sarananaga, Anoob Joseph, Aakash Sasidharan,
Nithinsen Kaithakadan, Rupesh Chiluka, Vidya Sagar Velumuri, dev,
stable
From: Sucharitha Sarananaga <ssarananaga@marvell.com>
This patch avoid copying the decrypted message into
the signature buffer, which is actually an input to the
verify operation. This prevents overwriting the input
buffer unnecessarily.
Fixes: 6661bedf1605 ("crypto/cnxk: add asymmetric datapath")
Cc: stable@dpdk.org
Signed-off-by: Sucharitha Sarananaga <ssarananaga@marvell.com>
---
drivers/crypto/cnxk/cnxk_ae.h | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/crypto/cnxk/cnxk_ae.h b/drivers/crypto/cnxk/cnxk_ae.h
index 8508ab8736..912a2a9496 100644
--- a/drivers/crypto/cnxk/cnxk_ae.h
+++ b/drivers/crypto/cnxk/cnxk_ae.h
@@ -1592,20 +1592,17 @@ cnxk_ae_dequeue_rsa_op(struct rte_crypto_op *cop, uint8_t *rptr,
case RTE_CRYPTO_ASYM_OP_VERIFY:
if (rsa_ctx->padding.type == RTE_CRYPTO_RSA_PADDING_NONE) {
rsa->sign.length = rsa_ctx->n.length;
- memcpy(rsa->sign.data, rptr, rsa->sign.length);
+ if (memcmp(rptr, rsa->message.data, rsa->message.length))
+ cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
} else {
/* Get length of signed output */
- rsa->sign.length =
- rte_cpu_to_be_16(*((uint16_t *)rptr));
+ rsa->sign.length = rte_cpu_to_be_16(*((uint16_t *)rptr));
/*
* Offset output data pointer by length field
- * (2 bytes) and copy signed data.
+ * (2 bytes) and compare signed data.
*/
- memcpy(rsa->sign.data, rptr + 2, rsa->sign.length);
- }
- if (memcmp(rsa->sign.data, rsa->message.data,
- rsa->message.length)) {
- cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
+ if (memcmp(rptr + 2, rsa->message.data, rsa->message.length))
+ cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
}
break;
default:
--
2.25.1
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v2 7/8] crypto/cnxk: align PDCP API with latest firmware
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
` (5 preceding siblings ...)
2025-08-21 6:13 ` [PATCH v2 6/8] crypto/cnxk: refactor rsa verification Tejasree Kondoj
@ 2025-08-21 6:13 ` Tejasree Kondoj
2025-08-21 6:13 ` [PATCH v2 8/8] crypto/cnxk: support custom metadata with CN20K Tejasree Kondoj
2025-08-21 15:35 ` [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Stephen Hemminger
8 siblings, 0 replies; 10+ messages in thread
From: Tejasree Kondoj @ 2025-08-21 6:13 UTC (permalink / raw)
To: Akhil Goyal
Cc: Anoob Joseph, Aakash Sasidharan, Nithinsen Kaithakadan,
Rupesh Chiluka, Sucharitha Sarananaga, Vidya Sagar Velumuri, dev
Aligning PDCP API with latest firmware.
Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 8 +-
drivers/crypto/cnxk/cn20k_cryptodev_ops.c | 8 +-
drivers/crypto/cnxk/cn9k_cryptodev_ops.c | 4 +-
drivers/crypto/cnxk/cnxk_se.h | 171 ++++++++++++++--------
4 files changed, 121 insertions(+), 70 deletions(-)
diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
index 17edf636da..d6b95a14aa 100644
--- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
@@ -206,7 +206,8 @@ cn10k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[], struct
w7 = sec_sess->inst.w7;
} else if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION) {
sess = (struct cnxk_se_sess *)(sym_op->session);
- ret = cpt_sym_inst_fill(qp, op, sess, infl_req, &inst[0], is_sg_ver2);
+ ret = cpt_sym_inst_fill(qp, op, sess, infl_req, &inst[0], is_sg_ver2,
+ false);
if (unlikely(ret))
return 0;
w7 = sess->cpt_inst_w7;
@@ -217,7 +218,8 @@ cn10k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[], struct
return 0;
}
- ret = cpt_sym_inst_fill(qp, op, sess, infl_req, &inst[0], is_sg_ver2);
+ ret = cpt_sym_inst_fill(qp, op, sess, infl_req, &inst[0], is_sg_ver2,
+ false);
if (unlikely(ret)) {
sym_session_clear(op->sym->session, true);
rte_mempool_put(qp->sess_mp, op->sym->session);
@@ -1557,7 +1559,7 @@ cn10k_cpt_raw_fill_inst(struct cnxk_iov *iov, struct cnxk_cpt_qp *qp,
break;
case CPT_DP_THREAD_AUTH_ONLY:
ret = fill_raw_digest_params(iov, sess, &qp->meta_info, infl_req, &inst[0],
- is_sg_ver2);
+ is_sg_ver2, false);
break;
default:
ret = -EINVAL;
diff --git a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
index 86d02ba5ca..30194db4ad 100644
--- a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
@@ -207,7 +207,7 @@ cn20k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[], struct
w7 = sec_sess->inst.w7;
} else if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION) {
sess = (struct cnxk_se_sess *)(sym_op->session);
- ret = cpt_sym_inst_fill(qp, op, sess, infl_req, &inst[0], true);
+ ret = cpt_sym_inst_fill(qp, op, sess, infl_req, &inst[0], true, true);
if (unlikely(ret))
return 0;
w7 = sess->cpt_inst_w7;
@@ -218,7 +218,7 @@ cn20k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[], struct
return 0;
}
- ret = cpt_sym_inst_fill(qp, op, sess, infl_req, &inst[0], true);
+ ret = cpt_sym_inst_fill(qp, op, sess, infl_req, &inst[0], true, true);
if (unlikely(ret)) {
sym_session_clear(op->sym->session, true);
rte_mempool_put(qp->sess_mp, op->sym->session);
@@ -278,6 +278,7 @@ cn20k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[], struct
cnxk_cpt_request_data_sgv2_mode_dump((void *)inst[0].dptr, 1, inst[0].w5.s.gather_sz);
cnxk_cpt_request_data_sgv2_mode_dump((void *)inst[0].rptr, 0, inst[0].w6.s.scatter_sz);
+
#endif
return 1;
@@ -1342,7 +1343,8 @@ cn20k_cpt_raw_fill_inst(struct cnxk_iov *iov, struct cnxk_cpt_qp *qp,
true);
break;
case CPT_DP_THREAD_AUTH_ONLY:
- ret = fill_raw_digest_params(iov, sess, &qp->meta_info, infl_req, &inst[0], true);
+ ret = fill_raw_digest_params(iov, sess, &qp->meta_info, infl_req, &inst[0], true,
+ true);
break;
default:
ret = -EINVAL;
diff --git a/drivers/crypto/cnxk/cn9k_cryptodev_ops.c b/drivers/crypto/cnxk/cn9k_cryptodev_ops.c
index c94e9e0f92..5551e40cb0 100644
--- a/drivers/crypto/cnxk/cn9k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn9k_cryptodev_ops.c
@@ -117,7 +117,7 @@ cn9k_cpt_inst_prep(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op,
if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION) {
sym_op = op->sym;
sess = (struct cnxk_se_sess *)sym_op->session;
- ret = cpt_sym_inst_fill(qp, op, sess, infl_req, inst, false);
+ ret = cpt_sym_inst_fill(qp, op, sess, infl_req, inst, false, false);
inst->w7.u64 = sess->cpt_inst_w7;
} else if (op->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION)
ret = cn9k_cpt_sec_inst_fill(qp, op, infl_req, inst);
@@ -128,7 +128,7 @@ cn9k_cpt_inst_prep(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op,
return -1;
}
- ret = cpt_sym_inst_fill(qp, op, sess, infl_req, inst, false);
+ ret = cpt_sym_inst_fill(qp, op, sess, infl_req, inst, false, false);
if (unlikely(ret)) {
sym_session_clear(op->sym->session, true);
rte_mempool_put(qp->sess_mp, op->sym->session);
diff --git a/drivers/crypto/cnxk/cnxk_se.h b/drivers/crypto/cnxk/cnxk_se.h
index 1838140727..3631b95e8c 100644
--- a/drivers/crypto/cnxk/cnxk_se.h
+++ b/drivers/crypto/cnxk/cnxk_se.h
@@ -459,7 +459,7 @@ static __rte_always_inline int
sg2_inst_prep(struct roc_se_fc_params *params, struct cpt_inst_s *inst, uint64_t offset_ctrl,
const uint8_t *iv_s, int iv_len, const bool pack_iv, uint8_t pdcp_alg_type,
int32_t inputlen, int32_t outputlen, uint32_t passthrough_len, uint32_t req_flags,
- int pdcp_flag, int decrypt)
+ int pdcp_flag, int decrypt, uint32_t off_ctrl_len, const bool use_metadata)
{
struct roc_sg2list_comp *gather_comp, *scatter_comp;
void *m_vaddr = params->meta_buf.vaddr;
@@ -488,17 +488,17 @@ sg2_inst_prep(struct roc_se_fc_params *params, struct cpt_inst_s *inst, uint64_t
/* save space for iv */
offset_vaddr = m_vaddr;
- m_vaddr = (uint8_t *)m_vaddr + ROC_SE_OFF_CTRL_LEN + RTE_ALIGN_CEIL(iv_len, 8);
+ m_vaddr = (uint8_t *)m_vaddr + off_ctrl_len + RTE_ALIGN_CEIL(iv_len, 8);
inst->w4.s.opcode_major |= (uint64_t)ROC_DMA_MODE_SG;
/* This is DPTR len in case of SG mode */
- inst->w4.s.dlen = inputlen + ROC_SE_OFF_CTRL_LEN;
+ inst->w4.s.dlen = inputlen + off_ctrl_len;
/* iv offset is 0 */
*offset_vaddr = offset_ctrl;
- iv_d = ((uint8_t *)offset_vaddr + ROC_SE_OFF_CTRL_LEN);
+ iv_d = ((uint8_t *)offset_vaddr + off_ctrl_len);
if (pdcp_flag) {
if (likely(iv_len)) {
if (zsk_flags == 0x1)
@@ -524,7 +524,7 @@ sg2_inst_prep(struct roc_se_fc_params *params, struct cpt_inst_s *inst, uint64_t
/* Offset control word followed by iv */
- i = fill_sg2_comp(gather_comp, i, (uint64_t)offset_vaddr, ROC_SE_OFF_CTRL_LEN + iv_len);
+ i = fill_sg2_comp(gather_comp, i, (uint64_t)offset_vaddr, off_ctrl_len + iv_len);
/* Add input data */
if (decrypt && (req_flags & ROC_SE_VALID_MAC_BUF)) {
@@ -585,14 +585,15 @@ sg2_inst_prep(struct roc_se_fc_params *params, struct cpt_inst_s *inst, uint64_t
iv_len = 0;
}
- if (iv_len) {
- i = fill_sg2_comp(scatter_comp, i, (uint64_t)offset_vaddr + ROC_SE_OFF_CTRL_LEN,
- iv_len);
+ if ((!use_metadata) && iv_len) {
+ i = fill_sg2_comp(scatter_comp, i, (uint64_t)offset_vaddr + off_ctrl_len, iv_len);
}
/* Add output data */
if ((!decrypt) && (req_flags & ROC_SE_VALID_MAC_BUF)) {
- size = outputlen - iv_len - mac_len;
+ size = outputlen - mac_len;
+ if (!use_metadata)
+ size -= iv_len;
if (size) {
uint32_t aad_offset = aad_len ? passthrough_len : 0;
@@ -617,7 +618,9 @@ sg2_inst_prep(struct roc_se_fc_params *params, struct cpt_inst_s *inst, uint64_t
i = fill_sg2_comp_from_buf(scatter_comp, i, ¶ms->mac_buf);
} else {
/* Output including mac */
- size = outputlen - iv_len;
+ size = outputlen;
+ if (!use_metadata)
+ size -= iv_len;
if (size) {
uint32_t aad_offset = aad_len ? passthrough_len : 0;
@@ -992,7 +995,8 @@ pdcp_chain_sg2_prep(struct roc_se_fc_params *params, struct roc_se_ctx *cpt_ctx,
struct cpt_inst_s *inst, union cpt_inst_w4 w4, int32_t inputlen,
uint8_t hdr_len, uint64_t offset_ctrl, uint32_t req_flags,
const uint8_t *cipher_iv, const uint8_t *auth_iv, const bool pack_iv,
- const uint8_t pdcp_ci_alg, const uint8_t pdcp_auth_alg)
+ const uint8_t pdcp_ci_alg, const uint8_t pdcp_auth_alg, uint32_t pad_len,
+ uint32_t off_ctrl_len, const bool use_metadata)
{
struct roc_sg2list_comp *gather_comp, *scatter_comp;
void *m_vaddr = params->meta_buf.vaddr;
@@ -1009,10 +1013,10 @@ pdcp_chain_sg2_prep(struct roc_se_fc_params *params, struct roc_se_ctx *cpt_ctx,
/* save space for IV */
offset_vaddr = m_vaddr;
- m_vaddr = PLT_PTR_ADD(m_vaddr, ROC_SE_OFF_CTRL_LEN + RTE_ALIGN_CEIL(hdr_len, 8));
+ m_vaddr = PLT_PTR_ADD(m_vaddr, off_ctrl_len + RTE_ALIGN_CEIL(hdr_len, 8));
w4.s.opcode_major |= (uint64_t)ROC_DMA_MODE_SG;
- w4.s.dlen = inputlen + ROC_SE_OFF_CTRL_LEN;
+ w4.s.dlen = inputlen + off_ctrl_len;
gather_comp = m_vaddr;
@@ -1022,14 +1026,14 @@ pdcp_chain_sg2_prep(struct roc_se_fc_params *params, struct roc_se_ctx *cpt_ctx,
/* Offset control word followed by IV */
*(uint64_t *)offset_vaddr = offset_ctrl;
- i = fill_sg2_comp(gather_comp, i, (uint64_t)offset_vaddr, ROC_SE_OFF_CTRL_LEN + hdr_len);
+ i = fill_sg2_comp(gather_comp, i, (uint64_t)offset_vaddr, off_ctrl_len + hdr_len);
/* Cipher IV */
- iv_d = ((uint8_t *)offset_vaddr + ROC_SE_OFF_CTRL_LEN);
+ iv_d = ((uint8_t *)offset_vaddr + off_ctrl_len);
pdcp_iv_copy(iv_d, cipher_iv, pdcp_ci_alg, pack_iv);
/* Auth IV */
- iv_d = ((uint8_t *)offset_vaddr + ROC_SE_OFF_CTRL_LEN + params->pdcp_iv_offset);
+ iv_d = ((uint8_t *)offset_vaddr + off_ctrl_len + params->pdcp_iv_offset);
pdcp_iv_copy(iv_d, auth_iv, pdcp_auth_alg, pack_iv);
/* input data */
@@ -1052,8 +1056,13 @@ pdcp_chain_sg2_prep(struct roc_se_fc_params *params, struct roc_se_ctx *cpt_ctx,
i = 0;
scatter_comp = PLT_PTR_ADD(gather_comp, g_size_bytes);
- if ((hdr_len))
- i = fill_sg2_comp(scatter_comp, i, (uint64_t)(offset_vaddr) + ROC_SE_OFF_CTRL_LEN,
+ if (use_metadata && pad_len)
+ /* Add padding */
+ i = fill_sg2_comp(scatter_comp, i, (uint64_t)(offset_vaddr) + off_ctrl_len,
+ pad_len);
+
+ if ((!use_metadata) && hdr_len)
+ i = fill_sg2_comp(scatter_comp, i, (uint64_t)(offset_vaddr) + off_ctrl_len,
hdr_len);
/* Add output data */
@@ -1171,7 +1180,7 @@ cpt_sm_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens, struct roc_se_fc_p
if (is_sg_ver2)
ret = sg2_inst_prep(fc_params, inst, offset_ctrl, src, iv_len + pad_len, 0,
0, inputlen, outputlen, passthrough_len, flags, 0,
- decrypt);
+ decrypt, ROC_SE_OFF_CTRL_LEN, false);
else
ret = sg_inst_prep(fc_params, inst, offset_ctrl, src, iv_len + pad_len, 0,
0, inputlen, outputlen, passthrough_len, flags, 0,
@@ -1341,7 +1350,8 @@ cpt_enc_hmac_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens,
if (is_sg_ver2)
ret = sg2_inst_prep(fc_params, inst, offset_ctrl, src, iv_len, 0, 0,
- inputlen, outputlen, passthrough_len, flags, 0, 0);
+ inputlen, outputlen, passthrough_len, flags, 0, 0,
+ ROC_SE_OFF_CTRL_LEN, false);
else
ret = sg_inst_prep(fc_params, inst, offset_ctrl, src, iv_len, 0, 0,
inputlen, outputlen, passthrough_len, flags, 0, 0);
@@ -1499,7 +1509,8 @@ cpt_dec_hmac_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens,
if (is_sg_ver2)
ret = sg2_inst_prep(fc_params, inst, offset_ctrl, src, iv_len, 0, 0,
- inputlen, outputlen, passthrough_len, flags, 0, 1);
+ inputlen, outputlen, passthrough_len, flags, 0, 1,
+ ROC_SE_OFF_CTRL_LEN, false);
else
ret = sg_inst_prep(fc_params, inst, offset_ctrl, src, iv_len, 0, 0,
inputlen, outputlen, passthrough_len, flags, 0, 1);
@@ -1515,12 +1526,13 @@ cpt_dec_hmac_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens,
static __rte_always_inline int
cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
struct roc_se_fc_params *params, struct cpt_inst_s *inst,
- const bool is_sg_ver2)
+ const bool is_sg_ver2, const bool use_metadata)
{
uint32_t encr_data_len, auth_data_len, aad_len, passthr_len, pad_len, hdr_len;
uint32_t encr_offset, auth_offset, iv_offset = 0;
const uint8_t *auth_iv = NULL, *cipher_iv = NULL;
uint8_t pdcp_iv_off = params->pdcp_iv_offset;
+ uint32_t off_ctrl_len = ROC_SE_OFF_CTRL_LEN;
const int iv_len = pdcp_iv_off * 2;
uint8_t pdcp_ci_alg, pdcp_auth_alg;
union cpt_inst_w4 cpt_inst_w4;
@@ -1550,8 +1562,10 @@ cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
auth_data_len = ROC_SE_AUTH_DLEN(d_lens);
auth_data_len -= aad_len;
- encr_offset += iv_len;
- auth_offset = encr_offset - aad_len;
+ if (!use_metadata) {
+ encr_offset += iv_len;
+ auth_offset = encr_offset - aad_len;
+ }
passthr_len = RTE_ALIGN_CEIL(auth_offset, 8);
if (unlikely((aad_len >> 16) || (passthr_len >> 8))) {
@@ -1582,10 +1596,15 @@ cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
inputlen = encr_data_len;
inputlen += (encr_offset + pad_len);
+ if (use_metadata)
+ inputlen += iv_len;
offset_ctrl = rte_cpu_to_be_64(((uint64_t)(aad_len) << 16) | ((uint64_t)(iv_offset) << 8) |
((uint64_t)(passthr_len)));
+ if (use_metadata)
+ off_ctrl_len *= 2;
+
if (likely(((req_flags & ROC_SE_SINGLE_BUF_INPLACE)) &&
((req_flags & ROC_SE_SINGLE_BUF_HEADROOM)))) {
@@ -1593,20 +1612,23 @@ cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
/* Use Direct mode */
- offset_vaddr = PLT_PTR_SUB(dm_vaddr, ROC_SE_OFF_CTRL_LEN + hdr_len);
+ offset_vaddr = PLT_PTR_SUB(dm_vaddr, off_ctrl_len + hdr_len);
*offset_vaddr = offset_ctrl;
/* DPTR */
inst->dptr = (uint64_t)offset_vaddr;
/* RPTR should just exclude offset control word */
- inst->rptr = (uint64_t)PLT_PTR_SUB(dm_vaddr, hdr_len);
+ if (use_metadata)
+ inst->rptr = (uint64_t)dm_vaddr - pad_len;
+ else
+ inst->rptr = (uint64_t)PLT_PTR_SUB(dm_vaddr, hdr_len);
- cpt_inst_w4.s.dlen = inputlen + ROC_SE_OFF_CTRL_LEN;
+ cpt_inst_w4.s.dlen = inputlen + off_ctrl_len;
- iv_d = ((uint8_t *)offset_vaddr + ROC_SE_OFF_CTRL_LEN);
+ iv_d = ((uint8_t *)offset_vaddr + off_ctrl_len);
pdcp_iv_copy(iv_d, cipher_iv, pdcp_ci_alg, false);
- iv_d = ((uint8_t *)offset_vaddr + ROC_SE_OFF_CTRL_LEN + pdcp_iv_off);
+ iv_d = ((uint8_t *)offset_vaddr + off_ctrl_len + pdcp_iv_off);
pdcp_iv_copy(iv_d, auth_iv, pdcp_auth_alg, false);
inst->w4.u64 = cpt_inst_w4.u64;
@@ -1616,7 +1638,8 @@ cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
if (is_sg_ver2)
return pdcp_chain_sg2_prep(params, se_ctx, inst, cpt_inst_w4, inputlen,
hdr_len, offset_ctrl, req_flags, cipher_iv,
- auth_iv, false, pdcp_ci_alg, pdcp_auth_alg);
+ auth_iv, false, pdcp_ci_alg, pdcp_auth_alg,
+ pad_len, off_ctrl_len, use_metadata);
else
return pdcp_chain_sg1_prep(params, se_ctx, inst, cpt_inst_w4, inputlen,
hdr_len, offset_ctrl, req_flags, cipher_iv,
@@ -1626,7 +1649,8 @@ cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
static __rte_always_inline int
cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
- struct roc_se_fc_params *params, struct cpt_inst_s *inst, const bool is_sg_ver2)
+ struct roc_se_fc_params *params, struct cpt_inst_s *inst, const bool is_sg_ver2,
+ const bool use_metadata)
{
/*
* pdcp_iv_offset is auth_iv_offset wrt cipher_iv_offset which is
@@ -1636,6 +1660,7 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
* and 48B with new microcode.
*/
const int iv_len = params->pdcp_iv_offset * 2;
+ uint32_t off_ctrl_len = ROC_SE_OFF_CTRL_LEN;
struct roc_se_ctx *se_ctx = params->ctx;
uint32_t encr_data_len, auth_data_len;
const int flags = se_ctx->zsk_flags;
@@ -1653,6 +1678,8 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
mac_len = se_ctx->mac_len;
cpt_inst_w4.u64 = se_ctx->template_w4.u64;
+ if (use_metadata)
+ off_ctrl_len *= 2;
if (flags == 0x1) {
cpt_inst_w4.s.opcode_minor = 1;
@@ -1675,11 +1702,15 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
auth_data_len = RTE_ALIGN(auth_data_len, 8) / 8;
}
- /* consider iv len */
- auth_offset += iv_len;
-
- inputlen = auth_offset + auth_data_len;
- outputlen = iv_len + mac_len;
+ if (use_metadata) {
+ inputlen = iv_len + auth_offset + auth_data_len;
+ outputlen = mac_len;
+ } else {
+ /* consider iv len */
+ auth_offset += iv_len;
+ inputlen = auth_offset + auth_data_len;
+ outputlen = iv_len + mac_len;
+ }
offset_ctrl = rte_cpu_to_be_64((uint64_t)auth_offset);
cpt_inst_w4.s.param1 = auth_data_len;
@@ -1703,11 +1734,15 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
encr_offset = ROC_SE_ENCR_OFFSET(d_offs);
encr_offset = encr_offset / 8;
- /* consider iv len */
- encr_offset += iv_len;
-
- inputlen = encr_offset + (RTE_ALIGN(encr_data_len, 8) / 8);
- outputlen = inputlen;
+ if (use_metadata) {
+ outputlen = encr_offset + (RTE_ALIGN(encr_data_len, 8) / 8);
+ inputlen = iv_len + outputlen;
+ } else {
+ /* consider iv len */
+ encr_offset += iv_len;
+ inputlen = encr_offset + (RTE_ALIGN(encr_data_len, 8) / 8);
+ outputlen = inputlen;
+ }
/* iv offset is 0 */
offset_ctrl = rte_cpu_to_be_64((uint64_t)encr_offset);
@@ -1737,16 +1772,19 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
/* Use Direct mode */
cpt_inst_w4.s.opcode_major = ROC_SE_MAJOR_OP_PDCP_CHAIN;
- offset_vaddr = (uint64_t *)((uint8_t *)dm_vaddr - ROC_SE_OFF_CTRL_LEN - iv_len);
+ offset_vaddr = (uint64_t *)((uint8_t *)dm_vaddr - off_ctrl_len - iv_len);
/* DPTR */
inst->dptr = (uint64_t)offset_vaddr;
/* RPTR should just exclude offset control word */
- inst->rptr = (uint64_t)dm_vaddr - iv_len;
+ if (use_metadata)
+ inst->rptr = (uint64_t)dm_vaddr;
+ else
+ inst->rptr = (uint64_t)dm_vaddr - iv_len;
- cpt_inst_w4.s.dlen = inputlen + ROC_SE_OFF_CTRL_LEN;
+ cpt_inst_w4.s.dlen = inputlen + off_ctrl_len;
- uint8_t *iv_d = ((uint8_t *)offset_vaddr + ROC_SE_OFF_CTRL_LEN);
+ uint8_t *iv_d = ((uint8_t *)offset_vaddr + off_ctrl_len);
pdcp_iv_copy(iv_d, iv_s, pdcp_alg_type, pack_iv);
*offset_vaddr = offset_ctrl;
@@ -1756,7 +1794,8 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
inst->w4.u64 = cpt_inst_w4.u64;
if (is_sg_ver2)
ret = sg2_inst_prep(params, inst, offset_ctrl, iv_s, iv_len, pack_iv,
- pdcp_alg_type, inputlen, outputlen, 0, req_flags, 1, 0);
+ pdcp_alg_type, inputlen, outputlen, 0, req_flags, 1, 0,
+ off_ctrl_len, use_metadata);
else
ret = sg_inst_prep(params, inst, offset_ctrl, iv_s, iv_len, pack_iv,
pdcp_alg_type, inputlen, outputlen, 0, req_flags, 1, 0);
@@ -1840,7 +1879,7 @@ cpt_kasumi_enc_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
if (is_sg_ver2)
sg2_inst_prep(params, inst, offset_ctrl, iv_s, iv_len, 0, 0, inputlen, outputlen, 0,
- req_flags, 0, 0);
+ req_flags, 0, 0, ROC_SE_OFF_CTRL_LEN, false);
else
sg_inst_prep(params, inst, offset_ctrl, iv_s, iv_len, 0, 0, inputlen, outputlen, 0,
req_flags, 0, 0);
@@ -1900,7 +1939,7 @@ cpt_kasumi_dec_prep(uint64_t d_offs, uint64_t d_lens, struct roc_se_fc_params *p
if (is_sg_ver2)
sg2_inst_prep(params, inst, offset_ctrl, params->iv_buf, iv_len, 0, 0, inputlen,
- outputlen, 0, 0, 0, 1);
+ outputlen, 0, 0, 0, 1, ROC_SE_OFF_CTRL_LEN, false);
else
sg_inst_prep(params, inst, offset_ctrl, params->iv_buf, iv_len, 0, 0, inputlen,
outputlen, 0, 0, 0, 1);
@@ -1911,7 +1950,7 @@ cpt_kasumi_dec_prep(uint64_t d_offs, uint64_t d_lens, struct roc_se_fc_params *p
static __rte_always_inline int
cpt_fc_enc_hmac_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens,
struct roc_se_fc_params *fc_params, struct cpt_inst_s *inst,
- const bool is_sg_ver2)
+ const bool is_sg_ver2, const bool use_metadata)
{
struct roc_se_ctx *ctx = fc_params->ctx;
uint8_t fc_type;
@@ -1922,7 +1961,8 @@ cpt_fc_enc_hmac_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens,
if (likely(fc_type == ROC_SE_FC_GEN)) {
ret = cpt_enc_hmac_prep(flags, d_offs, d_lens, fc_params, inst, is_sg_ver2);
} else if (fc_type == ROC_SE_PDCP) {
- ret = cpt_pdcp_alg_prep(flags, d_offs, d_lens, fc_params, inst, is_sg_ver2);
+ ret = cpt_pdcp_alg_prep(flags, d_offs, d_lens, fc_params, inst, is_sg_ver2,
+ use_metadata);
} else if (fc_type == ROC_SE_KASUMI) {
ret = cpt_kasumi_enc_prep(flags, d_offs, d_lens, fc_params, inst, is_sg_ver2);
} else if (fc_type == ROC_SE_HASH_HMAC) {
@@ -2946,7 +2986,7 @@ fill_passthrough_params(struct rte_crypto_op *cop, struct cpt_inst_s *inst)
static __rte_always_inline int
fill_pdcp_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
struct cpt_qp_meta_info *m_info, struct cpt_inflight_req *infl_req,
- struct cpt_inst_s *inst, const bool is_sg_ver2)
+ struct cpt_inst_s *inst, const bool is_sg_ver2, const bool use_metadata)
{
struct rte_crypto_sym_op *sym_op = cop->sym;
struct roc_se_fc_params fc_params;
@@ -3022,7 +3062,7 @@ fill_pdcp_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
}
}
- ret = cpt_pdcp_alg_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2);
+ ret = cpt_pdcp_alg_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2, use_metadata);
if (unlikely(ret)) {
plt_dp_err("Could not prepare instruction");
goto free_mdata_and_exit;
@@ -3040,7 +3080,7 @@ fill_pdcp_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
static __rte_always_inline int
fill_pdcp_chain_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
struct cpt_qp_meta_info *m_info, struct cpt_inflight_req *infl_req,
- struct cpt_inst_s *inst, const bool is_sg_ver2)
+ struct cpt_inst_s *inst, const bool is_sg_ver2, const bool use_metadata)
{
uint32_t ci_data_length, ci_data_offset, a_data_length, a_data_offset;
struct rte_crypto_sym_op *sym_op = cop->sym;
@@ -3155,7 +3195,8 @@ fill_pdcp_chain_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
}
/* Finally prepare the instruction */
- ret = cpt_pdcp_chain_alg_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2);
+ ret = cpt_pdcp_chain_alg_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2,
+ use_metadata);
if (unlikely(ret)) {
plt_dp_err("Could not prepare instruction");
goto free_mdata_and_exit;
@@ -3229,7 +3270,7 @@ find_kasumif9_direction_and_length(uint8_t *src, uint32_t counter_num_bytes,
static __rte_always_inline int
fill_digest_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
struct cpt_qp_meta_info *m_info, struct cpt_inflight_req *infl_req,
- struct cpt_inst_s *inst, const bool is_sg_ver2)
+ struct cpt_inst_s *inst, const bool is_sg_ver2, const bool use_metadata)
{
uint32_t space = 0;
struct rte_crypto_sym_op *sym_op = cop->sym;
@@ -3365,7 +3406,8 @@ fill_digest_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
goto free_mdata_and_exit;
}
- ret = cpt_fc_enc_hmac_prep(flags, d_offs, d_lens, ¶ms, inst, is_sg_ver2);
+ ret = cpt_fc_enc_hmac_prep(flags, d_offs, d_lens, ¶ms, inst, is_sg_ver2, use_metadata);
+
if (ret)
goto free_mdata_and_exit;
@@ -3380,7 +3422,8 @@ fill_digest_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
static __rte_always_inline int __rte_hot
cpt_sym_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op, struct cnxk_se_sess *sess,
- struct cpt_inflight_req *infl_req, struct cpt_inst_s *inst, const bool is_sg_ver2)
+ struct cpt_inflight_req *infl_req, struct cpt_inst_s *inst, const bool is_sg_ver2,
+ const bool use_metadata)
{
enum cpt_dp_thread_type dp_thr_type;
int ret;
@@ -3399,7 +3442,8 @@ cpt_sym_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op, struct cnxk_
ret = fill_passthrough_params(op, inst);
break;
case CPT_DP_THREAD_TYPE_PDCP:
- ret = fill_pdcp_params(op, sess, &qp->meta_info, infl_req, inst, is_sg_ver2);
+ ret = fill_pdcp_params(op, sess, &qp->meta_info, infl_req, inst, is_sg_ver2,
+ use_metadata);
break;
case CPT_DP_THREAD_TYPE_FC_CHAIN:
ret = fill_fc_params(op, sess, &qp->meta_info, infl_req, inst, false, false,
@@ -3410,7 +3454,8 @@ cpt_sym_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op, struct cnxk_
is_sg_ver2);
break;
case CPT_DP_THREAD_TYPE_PDCP_CHAIN:
- ret = fill_pdcp_chain_params(op, sess, &qp->meta_info, infl_req, inst, is_sg_ver2);
+ ret = fill_pdcp_chain_params(op, sess, &qp->meta_info, infl_req, inst, is_sg_ver2,
+ use_metadata);
break;
case CPT_DP_THREAD_TYPE_KASUMI:
ret = fill_fc_params(op, sess, &qp->meta_info, infl_req, inst, true, false,
@@ -3421,7 +3466,8 @@ cpt_sym_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op, struct cnxk_
break;
case CPT_DP_THREAD_AUTH_ONLY:
- ret = fill_digest_params(op, sess, &qp->meta_info, infl_req, inst, is_sg_ver2);
+ ret = fill_digest_params(op, sess, &qp->meta_info, infl_req, inst, is_sg_ver2,
+ use_metadata);
break;
default:
ret = -EINVAL;
@@ -3658,7 +3704,7 @@ fill_raw_fc_params(struct cnxk_iov *iov, struct cnxk_se_sess *sess, struct cpt_q
static __rte_always_inline int
fill_raw_digest_params(struct cnxk_iov *iov, struct cnxk_se_sess *sess,
struct cpt_qp_meta_info *m_info, struct cpt_inflight_req *infl_req,
- struct cpt_inst_s *inst, const bool is_sg_ver2)
+ struct cpt_inst_s *inst, const bool is_sg_ver2, const bool use_metadata)
{
uint16_t auth_op = sess->cpt_op & ROC_SE_OP_AUTH_MASK;
struct roc_se_fc_params fc_params;
@@ -3712,7 +3758,8 @@ fill_raw_digest_params(struct cnxk_iov *iov, struct cnxk_se_sess *sess,
fc_params.meta_buf.vaddr = (uint8_t *)mdata + space;
fc_params.meta_buf.size -= space;
- ret = cpt_fc_enc_hmac_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2);
+ ret = cpt_fc_enc_hmac_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2,
+ use_metadata);
if (ret)
goto free_mdata_and_exit;
--
2.25.1
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v2 8/8] crypto/cnxk: support custom metadata with CN20K
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
` (6 preceding siblings ...)
2025-08-21 6:13 ` [PATCH v2 7/8] crypto/cnxk: align PDCP API with latest firmware Tejasree Kondoj
@ 2025-08-21 6:13 ` Tejasree Kondoj
2025-08-21 15:35 ` [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Stephen Hemminger
8 siblings, 0 replies; 10+ messages in thread
From: Tejasree Kondoj @ 2025-08-21 6:13 UTC (permalink / raw)
To: Akhil Goyal
Cc: Anoob Joseph, Aakash Sasidharan, Nithinsen Kaithakadan,
Rupesh Chiluka, Sucharitha Sarananaga, Vidya Sagar Velumuri, dev
Adding support for custom metadata in CN20K PMD.
Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
drivers/common/cnxk/hw/cpt.h | 14 +++-
drivers/crypto/cnxk/cn20k_cryptodev_ops.c | 4 +
drivers/crypto/cnxk/cnxk_se.h | 94 +++++++++++++++--------
3 files changed, 78 insertions(+), 34 deletions(-)
diff --git a/drivers/common/cnxk/hw/cpt.h b/drivers/common/cnxk/hw/cpt.h
index e542f3a3d4..4079221676 100644
--- a/drivers/common/cnxk/hw/cpt.h
+++ b/drivers/common/cnxk/hw/cpt.h
@@ -247,7 +247,13 @@ struct cpt_inst_s {
uint64_t nixtxl : 3;
uint64_t doneint : 1;
uint64_t nixtx_addr : 60;
- } s;
+ } cn10k;
+ struct {
+ uint64_t nixtxl : 3;
+ uint64_t doneint : 1;
+ uint64_t rsvd : 58;
+ uint64_t pkt_ctl : 2;
+ } cn20k;
struct {
uint64_t nixtxl : 3;
uint64_t doneint : 1;
@@ -260,7 +266,11 @@ struct cpt_inst_s {
uint64_t u64;
} w0;
- uint64_t res_addr;
+ struct {
+ uint64_t res_addr : 59;
+ uint64_t meta_sz : 4;
+ uint64_t cq_ena : 1;
+ };
union cpt_inst_w2 {
struct {
diff --git a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
index 30194db4ad..b696c28081 100644
--- a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
@@ -196,6 +196,10 @@ cn20k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[], struct
inst[0].w2.u64 = 0;
inst[0].w3.u64 = 0;
+ inst[0].meta_sz = 0;
+ inst[0].cq_ena = 0;
+ inst[0].res_addr = 0;
+
sym_op = op->sym;
if (op->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC) {
diff --git a/drivers/crypto/cnxk/cnxk_se.h b/drivers/crypto/cnxk/cnxk_se.h
index 3631b95e8c..7a0624ca28 100644
--- a/drivers/crypto/cnxk/cnxk_se.h
+++ b/drivers/crypto/cnxk/cnxk_se.h
@@ -17,6 +17,9 @@
#define DST_IOV_SIZE \
(sizeof(struct roc_se_iov_ptr) + (sizeof(struct roc_se_buf_ptr) * ROC_MAX_SG_CNT))
+#define META_PKT_CTL_ENABLE 1
+#define META_SIZE_DIVISOR 32
+
enum cpt_dp_thread_type {
CPT_DP_THREAD_TYPE_FC_CHAIN = 0x1,
CPT_DP_THREAD_TYPE_FC_AEAD,
@@ -1526,7 +1529,8 @@ cpt_dec_hmac_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens,
static __rte_always_inline int
cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
struct roc_se_fc_params *params, struct cpt_inst_s *inst,
- const bool is_sg_ver2, const bool use_metadata)
+ struct cpt_inflight_req *infl_req, const bool is_sg_ver2,
+ const bool use_metadata)
{
uint32_t encr_data_len, auth_data_len, aad_len, passthr_len, pad_len, hdr_len;
uint32_t encr_offset, auth_offset, iv_offset = 0;
@@ -1611,19 +1615,23 @@ cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
dm_vaddr = params->bufs[0].vaddr;
/* Use Direct mode */
+ if (use_metadata) {
+ inst->w0.cn20k.pkt_ctl = META_PKT_CTL_ENABLE;
+ inst->meta_sz = META_LEN / META_SIZE_DIVISOR;
- offset_vaddr = PLT_PTR_SUB(dm_vaddr, off_ctrl_len + hdr_len);
- *offset_vaddr = offset_ctrl;
-
- /* DPTR */
- inst->dptr = (uint64_t)offset_vaddr;
- /* RPTR should just exclude offset control word */
- if (use_metadata)
- inst->rptr = (uint64_t)dm_vaddr - pad_len;
- else
+ offset_vaddr = PLT_PTR_CAST(infl_req->meta);
+ inst->dptr = (uint64_t)dm_vaddr - pad_len;
+ inst->rptr = inst->dptr;
+ cpt_inst_w4.s.dlen = inputlen - iv_len;
+ } else {
+ offset_vaddr = PLT_PTR_SUB(dm_vaddr, off_ctrl_len + hdr_len);
+ inst->dptr = (uint64_t)offset_vaddr;
+ /* RPTR should just exclude offset control word */
inst->rptr = (uint64_t)PLT_PTR_SUB(dm_vaddr, hdr_len);
+ cpt_inst_w4.s.dlen = inputlen + off_ctrl_len;
+ }
- cpt_inst_w4.s.dlen = inputlen + off_ctrl_len;
+ *offset_vaddr = offset_ctrl;
iv_d = ((uint8_t *)offset_vaddr + off_ctrl_len);
pdcp_iv_copy(iv_d, cipher_iv, pdcp_ci_alg, false);
@@ -1649,8 +1657,8 @@ cpt_pdcp_chain_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
static __rte_always_inline int
cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
- struct roc_se_fc_params *params, struct cpt_inst_s *inst, const bool is_sg_ver2,
- const bool use_metadata)
+ struct roc_se_fc_params *params, struct cpt_inst_s *inst,
+ struct cpt_inflight_req *infl_req, const bool is_sg_ver2, const bool use_metadata)
{
/*
* pdcp_iv_offset is auth_iv_offset wrt cipher_iv_offset which is
@@ -1666,9 +1674,11 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
const int flags = se_ctx->zsk_flags;
uint32_t encr_offset, auth_offset;
union cpt_inst_w4 cpt_inst_w4;
+ uint32_t passthrough_len = 0;
int32_t inputlen, outputlen;
uint64_t *offset_vaddr;
uint8_t pdcp_alg_type;
+ uint32_t pad_len = 0;
uint32_t mac_len = 0;
uint64_t offset_ctrl;
bool pack_iv = false;
@@ -1703,8 +1713,10 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
}
if (use_metadata) {
- inputlen = iv_len + auth_offset + auth_data_len;
- outputlen = mac_len;
+ passthrough_len = RTE_ALIGN_CEIL(auth_offset, 8);
+ pad_len = passthrough_len - auth_offset;
+ inputlen = pad_len + iv_len + auth_offset + auth_data_len;
+ outputlen = pad_len + mac_len;
} else {
/* consider iv len */
auth_offset += iv_len;
@@ -1735,7 +1747,9 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
encr_offset = encr_offset / 8;
if (use_metadata) {
- outputlen = encr_offset + (RTE_ALIGN(encr_data_len, 8) / 8);
+ passthrough_len = RTE_ALIGN_CEIL(encr_offset, 8);
+ pad_len = passthrough_len - encr_offset;
+ outputlen = pad_len + encr_offset + (RTE_ALIGN(encr_data_len, 8) / 8);
inputlen = iv_len + outputlen;
} else {
/* consider iv len */
@@ -1767,22 +1781,35 @@ cpt_pdcp_alg_prep(uint32_t req_flags, uint64_t d_offs, uint64_t d_lens,
*/
if (likely((req_flags & ROC_SE_SINGLE_BUF_INPLACE) &&
(req_flags & ROC_SE_SINGLE_BUF_HEADROOM))) {
+
void *dm_vaddr = params->bufs[0].vaddr;
/* Use Direct mode */
-
cpt_inst_w4.s.opcode_major = ROC_SE_MAJOR_OP_PDCP_CHAIN;
- offset_vaddr = (uint64_t *)((uint8_t *)dm_vaddr - off_ctrl_len - iv_len);
- /* DPTR */
- inst->dptr = (uint64_t)offset_vaddr;
- /* RPTR should just exclude offset control word */
- if (use_metadata)
- inst->rptr = (uint64_t)dm_vaddr;
- else
+ if (use_metadata) {
+ inst->w0.cn20k.pkt_ctl = META_PKT_CTL_ENABLE;
+ inst->meta_sz = META_LEN / META_SIZE_DIVISOR;
+
+ offset_vaddr = PLT_PTR_CAST(infl_req->meta);
+ offset_ctrl = rte_cpu_to_be_64((uint64_t)(passthrough_len));
+ *offset_vaddr = offset_ctrl;
+
+ inst->dptr = (uint64_t)dm_vaddr - pad_len;
+ inst->rptr = inst->dptr;
+
+ cpt_inst_w4.s.dlen = inputlen - iv_len + pad_len;
+ } else {
+
+ offset_vaddr = (uint64_t *)((uint8_t *)dm_vaddr - off_ctrl_len - iv_len);
+
+ /* DPTR */
+ inst->dptr = (uint64_t)offset_vaddr;
+ /* RPTR should just exclude offset control word */
inst->rptr = (uint64_t)dm_vaddr - iv_len;
- cpt_inst_w4.s.dlen = inputlen + off_ctrl_len;
+ cpt_inst_w4.s.dlen = inputlen + off_ctrl_len;
+ }
uint8_t *iv_d = ((uint8_t *)offset_vaddr + off_ctrl_len);
pdcp_iv_copy(iv_d, iv_s, pdcp_alg_type, pack_iv);
@@ -1950,7 +1977,8 @@ cpt_kasumi_dec_prep(uint64_t d_offs, uint64_t d_lens, struct roc_se_fc_params *p
static __rte_always_inline int
cpt_fc_enc_hmac_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens,
struct roc_se_fc_params *fc_params, struct cpt_inst_s *inst,
- const bool is_sg_ver2, const bool use_metadata)
+ struct cpt_inflight_req *infl_req, const bool is_sg_ver2,
+ const bool use_metadata)
{
struct roc_se_ctx *ctx = fc_params->ctx;
uint8_t fc_type;
@@ -1961,8 +1989,8 @@ cpt_fc_enc_hmac_prep(uint32_t flags, uint64_t d_offs, uint64_t d_lens,
if (likely(fc_type == ROC_SE_FC_GEN)) {
ret = cpt_enc_hmac_prep(flags, d_offs, d_lens, fc_params, inst, is_sg_ver2);
} else if (fc_type == ROC_SE_PDCP) {
- ret = cpt_pdcp_alg_prep(flags, d_offs, d_lens, fc_params, inst, is_sg_ver2,
- use_metadata);
+ ret = cpt_pdcp_alg_prep(flags, d_offs, d_lens, fc_params, inst, infl_req,
+ is_sg_ver2, use_metadata);
} else if (fc_type == ROC_SE_KASUMI) {
ret = cpt_kasumi_enc_prep(flags, d_offs, d_lens, fc_params, inst, is_sg_ver2);
} else if (fc_type == ROC_SE_HASH_HMAC) {
@@ -3062,7 +3090,8 @@ fill_pdcp_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
}
}
- ret = cpt_pdcp_alg_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2, use_metadata);
+ ret = cpt_pdcp_alg_prep(flags, d_offs, d_lens, &fc_params, inst, infl_req, is_sg_ver2,
+ use_metadata);
if (unlikely(ret)) {
plt_dp_err("Could not prepare instruction");
goto free_mdata_and_exit;
@@ -3195,7 +3224,7 @@ fill_pdcp_chain_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
}
/* Finally prepare the instruction */
- ret = cpt_pdcp_chain_alg_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2,
+ ret = cpt_pdcp_chain_alg_prep(flags, d_offs, d_lens, &fc_params, inst, infl_req, is_sg_ver2,
use_metadata);
if (unlikely(ret)) {
plt_dp_err("Could not prepare instruction");
@@ -3406,7 +3435,8 @@ fill_digest_params(struct rte_crypto_op *cop, struct cnxk_se_sess *sess,
goto free_mdata_and_exit;
}
- ret = cpt_fc_enc_hmac_prep(flags, d_offs, d_lens, ¶ms, inst, is_sg_ver2, use_metadata);
+ ret = cpt_fc_enc_hmac_prep(flags, d_offs, d_lens, ¶ms, inst, infl_req, is_sg_ver2,
+ use_metadata);
if (ret)
goto free_mdata_and_exit;
@@ -3758,7 +3788,7 @@ fill_raw_digest_params(struct cnxk_iov *iov, struct cnxk_se_sess *sess,
fc_params.meta_buf.vaddr = (uint8_t *)mdata + space;
fc_params.meta_buf.size -= space;
- ret = cpt_fc_enc_hmac_prep(flags, d_offs, d_lens, &fc_params, inst, is_sg_ver2,
+ ret = cpt_fc_enc_hmac_prep(flags, d_offs, d_lens, &fc_params, inst, infl_req, is_sg_ver2,
use_metadata);
if (ret)
goto free_mdata_and_exit;
--
2.25.1
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD
2025-08-21 6:13 [PATCH v2 0/8] fixes and improvements to cnxk crypto PMD Tejasree Kondoj
` (7 preceding siblings ...)
2025-08-21 6:13 ` [PATCH v2 8/8] crypto/cnxk: support custom metadata with CN20K Tejasree Kondoj
@ 2025-08-21 15:35 ` Stephen Hemminger
8 siblings, 0 replies; 10+ messages in thread
From: Stephen Hemminger @ 2025-08-21 15:35 UTC (permalink / raw)
To: Tejasree Kondoj
Cc: Akhil Goyal, Anoob Joseph, Aakash Sasidharan,
Nithinsen Kaithakadan, Rupesh Chiluka, Sucharitha Sarananaga,
Vidya Sagar Velumuri, dev
On Thu, 21 Aug 2025 11:43:33 +0530
Tejasree Kondoj <ktejasree@marvell.com> wrote:
> Adding fixes and improvements to cnxk crypto PMD.
>
> v2:
> - Fixed coding style issues.
>
> Nithinsen Kaithakadan (3):
> common/cnxk: get context ilen as devarg
> crypto/cnxk: fix compilation error and warnings
> crypto/cnxk: align cptr to 256B in cn20k
>
> Sucharitha Sarananaga (3):
> crypto/cnxk: add new API to get fpm tbl address
> crypto/cnxk: add new API to get EC grp tbl address
> crypto/cnxk: refactor rsa verification
>
> Tejasree Kondoj (2):
> crypto/cnxk: align PDCP API with latest firmware
> crypto/cnxk: support custom metadata with CN20K
>
> doc/guides/cryptodevs/cnxk.rst | 11 +
> drivers/common/cnxk/cnxk_security.c | 20 +-
> drivers/common/cnxk/cnxk_security.h | 25 +-
> drivers/common/cnxk/hw/cpt.h | 14 +-
> drivers/common/cnxk/roc_cpt.c | 8 +-
> drivers/common/cnxk/roc_cpt.h | 5 +
> drivers/common/cnxk/roc_se.h | 37 +-
> drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 16 +-
> drivers/crypto/cnxk/cn10k_ipsec.c | 4 +-
> drivers/crypto/cnxk/cn10k_tls.c | 16 +-
> drivers/crypto/cnxk/cn20k_cryptodev_ops.c | 20 +-
> drivers/crypto/cnxk/cn20k_ipsec.c | 80 +++--
> drivers/crypto/cnxk/cn20k_ipsec.h | 15 +-
> drivers/crypto/cnxk/cn20k_ipsec_la_ops.h | 41 ++-
> drivers/crypto/cnxk/cn9k_cryptodev_ops.c | 4 +-
> drivers/crypto/cnxk/cnxk_ae.h | 15 +-
> drivers/crypto/cnxk/cnxk_cryptodev.h | 1 +
> drivers/crypto/cnxk/cnxk_cryptodev_devargs.c | 49 +++
> drivers/crypto/cnxk/cnxk_cryptodev_ops.c | 130 ++++++-
> drivers/crypto/cnxk/cnxk_se.h | 340 +++++++++++++------
> drivers/crypto/cnxk/rte_pmd_cnxk_crypto.h | 96 ++++++
> drivers/net/cnxk/cn10k_ethdev_sec.c | 14 +-
> drivers/net/cnxk/cn20k_ethdev_sec.c | 8 +-
> 23 files changed, 725 insertions(+), 244 deletions(-)
>
I have been doing test builds with more warnings enabled.
These drivers have a lot of shadowed variables which are often a source of bugs.
In file included from ../drivers/crypto/cnxk/cnxk_cryptodev_ops.c:30:
../drivers/crypto/cnxk/cnxk_se.h: In function ‘cpt_sm_prep’:
../drivers/crypto/cnxk/cnxk_se.h:1160:41: warning: declaration of ‘src’ shadows a previous local [-Wshadow]
1160 | const uint64_t *src = fc_params->iv_buf;
| ^~~
../drivers/crypto/cnxk/cnxk_se.h:1105:24: note: shadowed declaration is here
1105 | const uint8_t *src = NULL;
| ^~~
../drivers/crypto/cnxk/cnxk_se.h: In function ‘cpt_enc_hmac_prep’:
../drivers/crypto/cnxk/cnxk_se.h:1330:41: warning: declaration of ‘src’ shadows a previous local [-Wshadow]
1330 | const uint64_t *src = fc_params->iv_buf;
| ^~~
../drivers/crypto/cnxk/cnxk_se.h:1200:24: note: shadowed declaration is here
1200 | const uint8_t *src = NULL;
| ^~~
../drivers/crypto/cnxk/cnxk_se.h: In function ‘cpt_dec_hmac_prep’:
../drivers/crypto/cnxk/cnxk_se.h:1487:41: warning: declaration of ‘src’ shadows a previous local [-Wshadow]
1487 | const uint64_t *src = fc_params->iv_buf;
| ^~~
../drivers/crypto/cnxk/cnxk_se.h:1369:24: note: shadowed declaration is here
1369 | const uint8_t *src = NULL;
| ^~~
../drivers/crypto/cnxk/cnxk_se.h: In function ‘fill_digest_params’:
../drivers/crypto/cnxk/cnxk_se.h:3233:34: warning: declaration of ‘src’ shadows a previous local [-Wshadow]
3233 | uint8_t *src, direction = 0;
| ^~~
../drivers/crypto/cnxk/cnxk_se.h:3200:14: note: shadowed declaration is here
3200 | char src[SRC_IOV_SIZE];
| ^~~
../drivers/crypto/cnxk/cnxk_se.h:3273:39: warning: declaration of ‘space’ shadows a previous local [-Wshadow]
3273 | int32_t dlen, space;
| ^~~~~
../drivers/crypto/cnxk/cnxk_se.h:3190:18: note: shadowed declaration is here
3190 | uint32_t space = 0;
| ^~~~~
../drivers/crypto/cnxk/cnxk_se.h: In function ‘fill_raw_fc_params’:
../drivers/crypto/cnxk/cnxk_se.h:3576:12: warning: this condition has identical branches [-Wduplicated-branches]
3576 | if (is_kasumi) {
| ^
^ permalink raw reply [flat|nested] 10+ messages in thread