From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id EE2D9A0509; Thu, 14 Apr 2022 20:46:02 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 848924067E; Thu, 14 Apr 2022 20:46:02 +0200 (CEST) Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by mails.dpdk.org (Postfix) with ESMTP id 9F21B4067C for ; Thu, 14 Apr 2022 20:46:00 +0200 (CEST) Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 23EIQAG4022836; Thu, 14 Apr 2022 18:45:59 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=corp-2021-07-09; bh=GpPthxh7EFL8XFHNv2w0gNEe/LW0r81XiOCuz7hITSw=; b=pJvlsoCmWixFzXjdAabWrRy6MX8paPmrsWEL2GOQuIY+h80Z1NnGfizyaFn0NZeFoAZ6 G4y9TTj1h2vL2DQN+4IdZfS1wbxrKxl3iVgqmi34FekmJCA/XZh/qVWMysJ3lBT968IS 8+RER8++H0zlAMRztNWyjZt/TrGSDJKaTK4uD8vVnMrWb8S/lZR6tvLe1+c9t383gL9n YxdvBssQAE1KHVFxmBa7qKUE/QF8NzAwm8Dbd12JV/KkGQdh25pOtjsGpL5lV1TITwHj 23v4lt/iA/BIgBuD9Uk8fkfq4pZ/QoylzfhN26zx7/ZyYGl6K2OJ/PK5mA/uMZiR1fKp oQ== Received: from iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta03.appoci.oracle.com [130.35.103.27]) by mx0b-00069f02.pphosted.com with ESMTP id 3fb0jdd8k8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 14 Apr 2022 18:45:58 +0000 Received: from pps.filterd (iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (8.16.1.2/8.16.1.2) with SMTP id 23EIaUjV035492; Thu, 14 Apr 2022 18:45:58 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2100.outbound.protection.outlook.com [104.47.70.100]) by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com with ESMTP id 3fck15863v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 14 Apr 2022 18:45:57 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=euXBwwV3yzfwNNpsu3Mh0Xc1LzprIKyMri3HBUhKcRHCbPe6MgH6JCWmWwIX8T6Skl2Pl6qFf3475kUJL/Xgkh2vClQPMWj2K+dUSY8leMPB9QrwgBNgqZ4dEZUTJC8zgxyIo6gVrxPGrnQOh53MoA6slBYO3QUfBBm+mMQrmSW9lZ+8OcnUuzgAghkRewrnJcOuLQpcgJdUHgxffS3Itv5P+b+XE1fo5kAm+7cHIIutythflrtuieSl+pMNiwwM2KekjDZ8xTaslSdlVJsisldYLBPMhCnOnAvX/FEc7uuf5+K7gar3zHHAK2nfQ9VG1+b1vEsgnYmrTLND0zeC0Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GpPthxh7EFL8XFHNv2w0gNEe/LW0r81XiOCuz7hITSw=; b=e7nV5LeSqwPr/WS4hFM7XG9D9dMCk45aYTZpVyLbjiTYgdVLxDgHstOsE6ueSdmjlSDTPXTDR1McpgvB3SQUaBSilpjf5wXIvXZepywPGd7Letx7MRLblhHH3aOdkmEVJoKZwkl/Sg0jPZo+MjTCCSWR4DvnkTmkDpwL3tcNo9T49wN8s9bubYa8G4zmtKTrIVjtUqOh54dNAsYU60OWs0akhnIcgwxmP3tTFlndfl4f6slMhLqPiwN+TCWZYtLYdJgIdY/T3zv7QJR6+s5xWMYtCiU7oTxOBv4UNOA37jiL9q/rb7GmG2ovxgEnP1HUBMt2zM9rI2K8C6hTc9PtPQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GpPthxh7EFL8XFHNv2w0gNEe/LW0r81XiOCuz7hITSw=; b=svMDXEfyVtvSUjUQ7yknl1bX6zgOujGCMoHpDrJebFzsWRycONNBdPtQIhjLNI7GljLQf2K8+ZhyRJzqK777UFvYUfYO8XYHCOo10u40JK06C5bMzU+6fmu6QLHOWC5b/+M+7SDMIf/f4dRsSSxuHTpb4nFi0el8P7h0UUZS/4w= Received: from CO1PR10MB4756.namprd10.prod.outlook.com (2603:10b6:303:9b::17) by MN2PR10MB3934.namprd10.prod.outlook.com (2603:10b6:208:183::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5144.29; Thu, 14 Apr 2022 18:45:56 +0000 Received: from CO1PR10MB4756.namprd10.prod.outlook.com ([fe80::68fb:c895:3c38:5706]) by CO1PR10MB4756.namprd10.prod.outlook.com ([fe80::68fb:c895:3c38:5706%9]) with mapi id 15.20.5164.018; Thu, 14 Apr 2022 18:45:56 +0000 From: Changchun Zhang To: Fan Zhang , "dev@dpdk.org" CC: "kai.ji@intel.com" , "gakhil@marvell.com" , "pablo.de.lara.guarch@intel.com" , Fan Zhang Subject: Re: [External] : [PATCH] crypto/qat: use intel-ipsec-mb for partial hash Thread-Topic: [External] : [PATCH] crypto/qat: use intel-ipsec-mb for partial hash Thread-Index: AQHYSpRRRGFHnV57w0yEJUyDPsfrYazvydcw Date: Thu, 14 Apr 2022 18:45:56 +0000 Message-ID: References: <20220407152931.8771-1-roy.fan.zhang@intel.com> In-Reply-To: <20220407152931.8771-1-roy.fan.zhang@intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f82fea9e-9c1e-47c0-20b5-08da1e4702bc x-ms-traffictypediagnostic: MN2PR10MB3934:EE_ x-microsoft-antispam-prvs: x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: IDthVA3O4k9KfSiXD+LdfjUPRZvWBM6khD4CaigRkI9Ie88dVv2Wxtz7XAyKUjQixWceIUq1ZVjYim8S7P2yhF4kSoBhsNgjynqF1SjWemcjZ6FzEddx7lFwUD3hH0RLgt6JrmW9kh96p9ftjTzUR+L0o0eU3W3Y/efJ5DhoDkeV4bvsDkQiLxhhjw7YwZlmaKlIZhXnTqvciLM2H0M4rPh+AeXstwbegGoCDFQczVA3sKtc11IioZmOk7/lRnyxoqtjezIwjqaNFrpE5qFlBr7ZsPoMO64OH0P0ybP7a0/pFv1zYZmk7tkp6lmE45PByqqAdnah79p5ILn4iVwSKGpf+dG9WJVXgOGF8cEpY1nfvXdxglBgdytqTKQtipFfX4xCkX1fqwiX9to6xnNLRpetlHW5BhXTPShu3vvZSuc9qgOqAmqpelMGhXP7+usTqc7MsdJlwAZug86OwdMP/XGwXnjg1mfcedOs9Mk7dsA7fHVYKJylXvEResKzOFuRjclMmGeOS4FUerd/4t7LnSsVvkFEyU9wgu5kv4M2PAGskVtTV15BH0vVxSon3k6BgqiEi7+vNg1VTeEEGtG1pok/PDh8CeqC4y/S1zKPc6WEbT6aHZUZkhvAxNrKHrmlxq5B2mw1FxHOD3ZT043lZKT25ffZEZb+SW/MU6L/VxWOnTycsGqOHUT2Wi/67G7/T9PH2kSg3iS/UWNIktcuMw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CO1PR10MB4756.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(366004)(64756008)(66946007)(76116006)(66556008)(66476007)(66446008)(8676002)(4326008)(9686003)(122000001)(508600001)(33656002)(186003)(53546011)(7696005)(6506007)(83380400001)(91956017)(26005)(316002)(5660300002)(52536014)(8936002)(9326002)(71200400001)(54906003)(110136005)(55016003)(44832011)(38100700002)(2906002)(38070700005)(86362001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?08opn8zpey4/U9FNhUpRRAS3bCrM7AxLYczPgDOiNsu0iGCMcu7Hx2yrN175?= =?us-ascii?Q?pSGt3xyhU4JzS8dKTC3nhHf48VMhr6vxTFjc5P7yTRxeJ8crHD0pfhyZkO4z?= =?us-ascii?Q?2epPBf6VL+ym1hbh5J+ZFavuzYeqgGreRVWsAnwyPI52EzMSdQfBw6f5jFed?= =?us-ascii?Q?7DfHrOxJxvzKCsLUMJ72IQFdkJzAqKnLbsKyr3uLcrb1Can9NNDt2X9nxkzr?= =?us-ascii?Q?otM2/U3rQQVKe0kddwXWbwq7k61/wWWVrAOTz6d/PGupqmqUpTMrjTDfdCQk?= =?us-ascii?Q?UM3/S7V+Wqhx5gmfYybVIhx28prWvtIET8l2OznvzGyYfquGCneGS9SWrWHM?= =?us-ascii?Q?T6lFa6yDpgpN4XqJ2Wgc79vzpGnnmgC8z8yDOhqILtXgVXajA6VGTQCtFWOr?= =?us-ascii?Q?SiXkeO8UWv5aQZXB83icL0e2YIh0bJDGXx+a1XVcqEya+lRCk5Y1SmOphOt7?= =?us-ascii?Q?BfJfkf4vW6Tr1YRsG6upL7/qTTpO2bkojh5qAiIAVKWjqfhd3JIh9jAJAO6B?= =?us-ascii?Q?mnase31/m2fwS3yzra5GCUNoIDfr1uIPUxomhvRR+P6z7/DXkiA6OIe0AWlD?= =?us-ascii?Q?XMUYCiD/lpwIl+hNB0bBHtRGVekCpEkZjrU51bxeB8xkiAGC0T5ZiVOOsL9J?= =?us-ascii?Q?eGHwK7g75JF/Mjd4DHqtx1xa2g5Yv/TxX22X2lw8EOY3LoAg7bmtSkU567Pf?= =?us-ascii?Q?78qom7SsjbzCbKmzFDpXFgUZSiLMmMvCvAlwhxMji6s4+tdLAxZxIToC3ZJS?= =?us-ascii?Q?wBe4V0gLV11N5+m3+KmbPxOg5rN1AvSYI6B6EtrHZ+7CHcXAzRnTv5gCm9Uj?= =?us-ascii?Q?a79wrSMYFn3J+MJvBf0iFKaeDZvEV6Mh+mWyOruE+1gqtDdkOP6VrDIbvCJP?= =?us-ascii?Q?3dMqZfIAzwsYXhF9QwTJuMKmK51HFUIERd31D5AB1rNIJRH0kN7VBaMDhJNI?= =?us-ascii?Q?EpzLmrj87buFYlgB+2oNeGPk8izUTXFbjqE3gtz6zymnFFyc5s/wrOzEPEWU?= =?us-ascii?Q?0N+z4bUuccddmkzuJKLLwbO35BLogUq/83IpMAkbZD2O+aGA1RU+NBDsXLrg?= =?us-ascii?Q?SmxG7vpKtikd54NJ552jdt3cHySuc/xXFZTwmGImzqFyHSDTY1shToBrJ6fZ?= =?us-ascii?Q?PHvfhNxv4+uNdpCzdZ3GwCdXi+LbYqgdyzWmmLNMbYvqcim9Y+gH8RB7FP3N?= =?us-ascii?Q?075juPZa78B8c8LsoHsw9EyW3guLN4BBQypdcWZ5LZ9r5h8FViJYxnzxSURP?= =?us-ascii?Q?uxjXqmWg+Io6tSbIAgeoA56Hw/13bg96ziA/yt5nWtm3ND0SaWyThBaEvIQd?= =?us-ascii?Q?YnfMPaYJ7xZQUyN5q34xXNzQKT2dcAFCXPYV6btsnk8SRLQo9Ad5llCOkOv0?= =?us-ascii?Q?cJhVloPV6a439UW+HjKI9CFxb/r0sxA2dCxF/UONEWTX+CeP+0eHEKvHKULt?= =?us-ascii?Q?gcAsu8+dwNQZWxHW9bo64RIsXGXF53VWhWv0uuCkaPZELW9ZNkkXDjaDwfsg?= =?us-ascii?Q?j5dERwqT/5DJvniRgqx/sR8H4AAIgmi4CcSQAWGvD4Gcw5PzlFKQkX9H5n2/?= =?us-ascii?Q?41v5pah1bJefZIlnRjttppVw4z/mK3ozQsZG2AfBUXDjzbng64wZdfBFCEa6?= =?us-ascii?Q?n/wPcNyYiRQdOZLTrGs0EF+gg8rS2fG95xnc0jAVeXoelkfNgKtT3uNpTCpD?= =?us-ascii?Q?aLxmevOvSnmJ11MhIP9LWSQT3cuRRqyynvs8xpywFZqAJvq3kK7EY8isvprt?= =?us-ascii?Q?Yp2GZGEr7pw66eW61GnP1+zWBTjUVkbfR/oIh96rHn+xOcZ+6VSq?= Content-Type: multipart/alternative; boundary="_000_CO1PR10MB475613338DCE8F2D79A19A4D84EF9CO1PR10MB4756namp_" MIME-Version: 1.0 X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CO1PR10MB4756.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: f82fea9e-9c1e-47c0-20b5-08da1e4702bc X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Apr 2022 18:45:56.2492 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: uExJGo4dUKdcsAVfaPm81ODlheBhW8wNaC6rOZTWMLvNqO5hU2nETfVJOQ84QkVxWY0hW99JanC3pvFztYHXqKQJ+fACX/P2gESnTACiYZI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR10MB3934 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486, 18.0.858 definitions=2022-04-14_05:2022-04-14, 2022-04-14 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 spamscore=0 adultscore=0 phishscore=0 mlxscore=0 suspectscore=0 malwarescore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000 definitions=main-2204140098 X-Proofpoint-ORIG-GUID: q71J8ZFpF5N1sM-1WGgS9xz8oyZE5B3m X-Proofpoint-GUID: q71J8ZFpF5N1sM-1WGgS9xz8oyZE5B3m X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org --_000_CO1PR10MB475613338DCE8F2D79A19A4D84EF9CO1PR10MB4756namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Fan, Does it mean the intel-ipsec-mb would be prerequisite of applying QAT offlo= ading for security application? It this is the case, as I know, the intel-i= psec-mb has no FIPS certification yet. Thus I am thinking this would impact= existing QAT based security application, right? Best Regards, Changchun Zhang From: Fan Zhang Date: Thursday, April 7, 2022 at 11:29 AM To: dev@dpdk.org Cc: kai.ji@intel.com , gakhil@marvell.com , pablo.de.lara.guarch@intel.com , Fan= Zhang Subject: [External] : [PATCH] crypto/qat: use intel-ipsec-mb for partial ha= sh Since openssl 3.0 now deprecates the low level API QAT required to perform partial hash operation when creating the session. This patch is to transfer such dependency from openssl to intel-ipsec-mb. Signed-off-by: Fan Zhang --- drivers/common/qat/meson.build | 10 +++ drivers/crypto/qat/qat_sym_session.c | 101 +++++---------------------- 2 files changed, 28 insertions(+), 83 deletions(-) diff --git a/drivers/common/qat/meson.build b/drivers/common/qat/meson.buil= d index b7027f3164..d35fc69d96 100644 --- a/drivers/common/qat/meson.build +++ b/drivers/common/qat/meson.build @@ -35,6 +35,16 @@ if qat_crypto and not libcrypto.found() 'missing dependency, libcrypto') endif + +IMB_required_ver =3D '1.0.0' +libipsecmb =3D cc.find_library('IPSec_MB', required: false) +if not lib.found() + build =3D false + reason =3D 'missing dependency, "libIPSec_MB"' +else + ext_deps +=3D libipsecmb +endif + # The driver should not build if both compression and crypto are disabled #FIXME common code depends on compression files so check only compress! if not qat_compress # and not qat_crypto diff --git a/drivers/crypto/qat/qat_sym_session.c b/drivers/crypto/qat/qat_= sym_session.c index 9d6a19c0be..05a11db750 100644 --- a/drivers/crypto/qat/qat_sym_session.c +++ b/drivers/crypto/qat/qat_sym_session.c @@ -6,6 +6,7 @@ #include /* Needed to calculate pre-compute values = */ #include /* Needed to calculate pre-compute values = */ #include /* Needed for bpi runt block processing */ +#include #include #include @@ -1057,139 +1058,73 @@ static int qat_hash_get_block_size(enum icp_qat_hw= _auth_algo qat_hash_alg) return -EFAULT; } -static int partial_hash_sha1(uint8_t *data_in, uint8_t *data_out) -{ - SHA_CTX ctx; - - if (!SHA1_Init(&ctx)) - return -EFAULT; - SHA1_Transform(&ctx, data_in); - rte_memcpy(data_out, &ctx, SHA_DIGEST_LENGTH); - return 0; -} - -static int partial_hash_sha224(uint8_t *data_in, uint8_t *data_out) -{ - SHA256_CTX ctx; - - if (!SHA224_Init(&ctx)) - return -EFAULT; - SHA256_Transform(&ctx, data_in); - rte_memcpy(data_out, &ctx, SHA256_DIGEST_LENGTH); - return 0; -} - -static int partial_hash_sha256(uint8_t *data_in, uint8_t *data_out) -{ - SHA256_CTX ctx; - - if (!SHA256_Init(&ctx)) - return -EFAULT; - SHA256_Transform(&ctx, data_in); - rte_memcpy(data_out, &ctx, SHA256_DIGEST_LENGTH); - return 0; -} - -static int partial_hash_sha384(uint8_t *data_in, uint8_t *data_out) -{ - SHA512_CTX ctx; - - if (!SHA384_Init(&ctx)) - return -EFAULT; - SHA512_Transform(&ctx, data_in); - rte_memcpy(data_out, &ctx, SHA512_DIGEST_LENGTH); - return 0; -} - -static int partial_hash_sha512(uint8_t *data_in, uint8_t *data_out) -{ - SHA512_CTX ctx; - - if (!SHA512_Init(&ctx)) - return -EFAULT; - SHA512_Transform(&ctx, data_in); - rte_memcpy(data_out, &ctx, SHA512_DIGEST_LENGTH); - return 0; -} - -static int partial_hash_md5(uint8_t *data_in, uint8_t *data_out) -{ - MD5_CTX ctx; - - if (!MD5_Init(&ctx)) - return -EFAULT; - MD5_Transform(&ctx, data_in); - rte_memcpy(data_out, &ctx, MD5_DIGEST_LENGTH); - - return 0; -} - static int partial_hash_compute(enum icp_qat_hw_auth_algo hash_alg, uint8_t *data_in, uint8_t *data_out) { + IMB_MGR *m; + uint32_t *hash_state_out_be32; + uint64_t *hash_state_out_be64; int digest_size; uint8_t digest[qat_hash_get_digest_size( ICP_QAT_HW_AUTH_ALGO_DELIMITER)]; - uint32_t *hash_state_out_be32; - uint64_t *hash_state_out_be64; int i; + hash_state_out_be32 =3D (uint32_t *)data_out; + hash_state_out_be64 =3D (uint64_t *)data_out; + /* Initialize to avoid gcc warning */ memset(digest, 0, sizeof(digest)); digest_size =3D qat_hash_get_digest_size(hash_alg); if (digest_size <=3D 0) return -EFAULT; + m =3D alloc_mb_mgr(0); + if (m =3D=3D NULL) + return -ENOMEM; - hash_state_out_be32 =3D (uint32_t *)data_out; - hash_state_out_be64 =3D (uint64_t *)data_out; + init_mb_mgr_auto(m, NULL); switch (hash_alg) { case ICP_QAT_HW_AUTH_ALGO_SHA1: - if (partial_hash_sha1(data_in, digest)) - return -EFAULT; + IMB_SHA1_ONE_BLOCK(m, data_in, digest); for (i =3D 0; i < digest_size >> 2; i++, hash_state_out_be= 32++) *hash_state_out_be32 =3D rte_bswap32(*(((uint32_t *)digest)+i)); break; case ICP_QAT_HW_AUTH_ALGO_SHA224: - if (partial_hash_sha224(data_in, digest)) - return -EFAULT; + IMB_SHA224_ONE_BLOCK(m, data_in, digest); for (i =3D 0; i < digest_size >> 2; i++, hash_state_out_be= 32++) *hash_state_out_be32 =3D rte_bswap32(*(((uint32_t *)digest)+i)); break; case ICP_QAT_HW_AUTH_ALGO_SHA256: - if (partial_hash_sha256(data_in, digest)) - return -EFAULT; + IMB_SHA256_ONE_BLOCK(m, data_in, digest); for (i =3D 0; i < digest_size >> 2; i++, hash_state_out_be= 32++) *hash_state_out_be32 =3D rte_bswap32(*(((uint32_t *)digest)+i)); break; case ICP_QAT_HW_AUTH_ALGO_SHA384: - if (partial_hash_sha384(data_in, digest)) - return -EFAULT; + IMB_SHA384_ONE_BLOCK(m, data_in, digest); for (i =3D 0; i < digest_size >> 3; i++, hash_state_out_be= 64++) *hash_state_out_be64 =3D rte_bswap64(*(((uint64_t *)digest)+i)); break; case ICP_QAT_HW_AUTH_ALGO_SHA512: - if (partial_hash_sha512(data_in, digest)) - return -EFAULT; + IMB_SHA512_ONE_BLOCK(m, data_in, digest); for (i =3D 0; i < digest_size >> 3; i++, hash_state_out_be= 64++) *hash_state_out_be64 =3D rte_bswap64(*(((uint64_t *)digest)+i)); break; case ICP_QAT_HW_AUTH_ALGO_MD5: - if (partial_hash_md5(data_in, data_out)) - return -EFAULT; + IMB_MD5_ONE_BLOCK(m, data_in, data_out); break; default: QAT_LOG(ERR, "invalid hash alg %u", hash_alg); return -EFAULT; } + free_mb_mgr(m); return 0; } #define HMAC_IPAD_VALUE 0x36 -- 2.32.0 --_000_CO1PR10MB475613338DCE8F2D79A19A4D84EF9CO1PR10MB4756namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Fan,<= /span>

 

Does it mean the in= tel-ipsec-mb would be prerequisite of applying QAT offloading for security = application? It this is the case, as I know, the intel-ipsec-mb has no FIPS= certification yet. Thus I am thinking this would impact existing QAT based security application, right?

 

Best Regards,

Changchun Zhang

 

From: Fan Zhang <roy.f= an.zhang@intel.com>
Date: Thursday, April 7, 2022 at 11:29 AM
To: dev@dpdk.org <dev@dpdk.org>
Cc: kai.ji@intel.com <kai.ji@intel.com>, gakhil@marvell.com &l= t;gakhil@marvell.com>, pablo.de.lara.guarch@intel.com <pablo.de.lara.= guarch@intel.com>, Fan Zhang <roy.fan.zhang@intel.com>
Subject: [External] : [PATCH] crypto/qat: use intel-ipsec-mb for par= tial hash

Since openssl 3.0 now deprecates the low level API QAT required= to
perform partial hash operation when creating the session. This
patch is to transfer such dependency from openssl to intel-ipsec-mb.

Signed-off-by: Fan Zhang <roy.fan.zhang@intel.com>
---
 drivers/common/qat/meson.build       |&= nbsp; 10 +++
 drivers/crypto/qat/qat_sym_session.c | 101 +++++---------------------= -
 2 files changed, 28 insertions(+), 83 deletions(-)

diff --git a/drivers/common/qat/meson.build b/drivers/common/qat/meson.buil= d
index b7027f3164..d35fc69d96 100644
--- a/drivers/common/qat/meson.build
+++ b/drivers/common/qat/meson.build
@@ -35,6 +35,16 @@ if qat_crypto and not libcrypto.found()
             'm= issing dependency, libcrypto')
 endif
 
+
+IMB_required_ver =3D '1.0.0'
+libipsecmb =3D cc.find_library('IPSec_MB', required: false)
+if not lib.found()
+    build =3D false
+    reason =3D 'missing dependency, "libIPSec_MB"= '
+else
+    ext_deps +=3D libipsecmb
+endif
+
 # The driver should not build if both compression and crypto are disa= bled
 #FIXME common code depends on compression files so check only compres= s!
 if not qat_compress # and not qat_crypto
diff --git a/drivers/crypto/qat/qat_sym_session.c b/drivers/crypto/qat/qat_= sym_session.c
index 9d6a19c0be..05a11db750 100644
--- a/drivers/crypto/qat/qat_sym_session.c
+++ b/drivers/crypto/qat/qat_sym_session.c
@@ -6,6 +6,7 @@
 #include <openssl/aes.h>      &nb= sp; /* Needed to calculate pre-compute values */
 #include <openssl/md5.h>      &nb= sp; /* Needed to calculate pre-compute values */
 #include <openssl/evp.h>      &nb= sp; /* Needed for bpi runt block processing */
+#include <intel-ipsec-mb.h>
 
 #include <rte_memcpy.h>
 #include <rte_common.h>
@@ -1057,139 +1058,73 @@ static int qat_hash_get_block_size(enum icp_qat_hw= _auth_algo qat_hash_alg)
         return -EFAULT;
 }
 
-static int partial_hash_sha1(uint8_t *data_in, uint8_t *data_out)
-{
-       SHA_CTX ctx;
-
-       if (!SHA1_Init(&ctx))
-            &n= bsp;  return -EFAULT;
-       SHA1_Transform(&ctx, data_in); -       rte_memcpy(data_out, &ctx, SHA_DI= GEST_LENGTH);
-       return 0;
-}
-
-static int partial_hash_sha224(uint8_t *data_in, uint8_t *data_out)
-{
-       SHA256_CTX ctx;
-
-       if (!SHA224_Init(&ctx))
-            &n= bsp;  return -EFAULT;
-       SHA256_Transform(&ctx, data_in);<= br> -       rte_memcpy(data_out, &ctx, SHA256= _DIGEST_LENGTH);
-       return 0;
-}
-
-static int partial_hash_sha256(uint8_t *data_in, uint8_t *data_out)
-{
-       SHA256_CTX ctx;
-
-       if (!SHA256_Init(&ctx))
-            &n= bsp;  return -EFAULT;
-       SHA256_Transform(&ctx, data_in);<= br> -       rte_memcpy(data_out, &ctx, SHA256= _DIGEST_LENGTH);
-       return 0;
-}
-
-static int partial_hash_sha384(uint8_t *data_in, uint8_t *data_out)
-{
-       SHA512_CTX ctx;
-
-       if (!SHA384_Init(&ctx))
-            &n= bsp;  return -EFAULT;
-       SHA512_Transform(&ctx, data_in);<= br> -       rte_memcpy(data_out, &ctx, SHA512= _DIGEST_LENGTH);
-       return 0;
-}
-
-static int partial_hash_sha512(uint8_t *data_in, uint8_t *data_out)
-{
-       SHA512_CTX ctx;
-
-       if (!SHA512_Init(&ctx))
-            &n= bsp;  return -EFAULT;
-       SHA512_Transform(&ctx, data_in);<= br> -       rte_memcpy(data_out, &ctx, SHA512= _DIGEST_LENGTH);
-       return 0;
-}
-
-static int partial_hash_md5(uint8_t *data_in, uint8_t *data_out)
-{
-       MD5_CTX ctx;
-
-       if (!MD5_Init(&ctx))
-            &n= bsp;  return -EFAULT;
-       MD5_Transform(&ctx, data_in);
-       rte_memcpy(data_out, &ctx, MD5_DI= GEST_LENGTH);
-
-       return 0;
-}
-
 static int
 partial_hash_compute(enum icp_qat_hw_auth_algo hash_alg,
            &nb= sp;    uint8_t *data_in, uint8_t *data_out)
 {
+       IMB_MGR *m;
+       uint32_t *hash_state_out_be32;
+       uint64_t *hash_state_out_be64;
         int digest_size;
         uint8_t digest[qat_hash_ge= t_digest_size(
            &nb= sp;            ICP_Q= AT_HW_AUTH_ALGO_DELIMITER)];
-       uint32_t *hash_state_out_be32;
-       uint64_t *hash_state_out_be64;
         int i;
 
+       hash_state_out_be32 =3D (uint32_t *)d= ata_out;
+       hash_state_out_be64 =3D (uint64_t *)d= ata_out;
+
         /* Initialize to avoid gcc= warning */
         memset(digest, 0, sizeof(d= igest));
 
         digest_size =3D qat_hash_g= et_digest_size(hash_alg);
         if (digest_size <=3D 0)=
            &nb= sp;    return -EFAULT;
+       m =3D alloc_mb_mgr(0);
+       if (m =3D=3D NULL)
+            &n= bsp;  return -ENOMEM;
 
-       hash_state_out_be32 =3D (uint32_t *)d= ata_out;
-       hash_state_out_be64 =3D (uint64_t *)d= ata_out;
+       init_mb_mgr_auto(m, NULL);
 
         switch (hash_alg) {
         case ICP_QAT_HW_AUTH_ALGO_= SHA1:
-            &n= bsp;  if (partial_hash_sha1(data_in, digest))
-            &n= bsp;          return -EFAULT;<= br> +            &n= bsp;  IMB_SHA1_ONE_BLOCK(m, data_in, digest);
            &nb= sp;    for (i =3D 0; i < digest_size >> 2; i++, has= h_state_out_be32++)
            &nb= sp;            *hash= _state_out_be32 =3D
            &nb= sp;            =         rte_bswap32(*(((uint32_t *)diges= t)+i));
            &nb= sp;    break;
         case ICP_QAT_HW_AUTH_ALGO_= SHA224:
-            &n= bsp;  if (partial_hash_sha224(data_in, digest))
-            &n= bsp;          return -EFAULT;<= br> +            &n= bsp;  IMB_SHA224_ONE_BLOCK(m, data_in, digest);
            &nb= sp;    for (i =3D 0; i < digest_size >> 2; i++, has= h_state_out_be32++)
            &nb= sp;            *hash= _state_out_be32 =3D
            &nb= sp;            =         rte_bswap32(*(((uint32_t *)diges= t)+i));
            &nb= sp;    break;
         case ICP_QAT_HW_AUTH_ALGO_= SHA256:
-            &n= bsp;  if (partial_hash_sha256(data_in, digest))
-            &n= bsp;          return -EFAULT;<= br> +            &n= bsp;  IMB_SHA256_ONE_BLOCK(m, data_in, digest);
            &nb= sp;    for (i =3D 0; i < digest_size >> 2; i++, has= h_state_out_be32++)
            &nb= sp;            *hash= _state_out_be32 =3D
            &nb= sp;            =         rte_bswap32(*(((uint32_t *)diges= t)+i));
            &nb= sp;    break;
         case ICP_QAT_HW_AUTH_ALGO_= SHA384:
-            &n= bsp;  if (partial_hash_sha384(data_in, digest))
-            &n= bsp;          return -EFAULT;<= br> +            &n= bsp;  IMB_SHA384_ONE_BLOCK(m, data_in, digest);
            &nb= sp;    for (i =3D 0; i < digest_size >> 3; i++, has= h_state_out_be64++)
            &nb= sp;            *hash= _state_out_be64 =3D
            &nb= sp;            =         rte_bswap64(*(((uint64_t *)diges= t)+i));
            &nb= sp;    break;
         case ICP_QAT_HW_AUTH_ALGO_= SHA512:
-            &n= bsp;  if (partial_hash_sha512(data_in, digest))
-            &n= bsp;          return -EFAULT;<= br> +            &n= bsp;  IMB_SHA512_ONE_BLOCK(m, data_in, digest);
            &nb= sp;    for (i =3D 0; i < digest_size >> 3; i++, has= h_state_out_be64++)
            &nb= sp;            *hash= _state_out_be64 =3D
            &nb= sp;            =         rte_bswap64(*(((uint64_t *)diges= t)+i));
            &nb= sp;    break;
         case ICP_QAT_HW_AUTH_ALGO_= MD5:
-            &n= bsp;  if (partial_hash_md5(data_in, data_out))
-            &n= bsp;          return -EFAULT;<= br> +            &n= bsp;  IMB_MD5_ONE_BLOCK(m, data_in, data_out);
            &nb= sp;    break;
         default:
            &nb= sp;    QAT_LOG(ERR, "invalid hash alg %u", hash_al= g);
            &nb= sp;    return -EFAULT;
         }
 
+       free_mb_mgr(m);
         return 0;
 }
 #define HMAC_IPAD_VALUE 0x36
--
2.32.0

--_000_CO1PR10MB475613338DCE8F2D79A19A4D84EF9CO1PR10MB4756namp_--