From: Pablo de Lara <pablo.de.lara.guarch@intel.com>
To: declan.doherty@intel.com, zbigniew.bodek@caviumnetworks.com,
jerin.jacob@caviumnetworks.com, akhil.goyal@nxp.com,
hemant.agrawal@nxp.com
Cc: dev@dpdk.org, Pablo de Lara <pablo.de.lara.guarch@intel.com>,
stable@dpdk.org
Subject: [dpdk-stable] [PATCH v2 07/27] crypto/qat: fix KASUMI authentication
Date: Mon, 26 Jun 2017 11:22:40 +0100 [thread overview]
Message-ID: <20170626102300.56637-8-pablo.de.lara.guarch@intel.com> (raw)
In-Reply-To: <20170626102300.56637-1-pablo.de.lara.guarch@intel.com>
QAT PMD was assuming that cipher IV was always prepended,
before the input buffer, but it is not necessary to have it
there, only the auth IV (COUNT and FRESH) and the input buffer
needs to be contiguous, with the direction bit after.
If AAD (containing the IV for authentication)
is not just before the message, the authentication will fail.
Therefore, the headroom of the input buffer is used to
copy the AAD, and then it is removed after the operation is
finished.
It was also assuming that the IV was starting at offset 0,
which is not always the case.
Fixes: d4f2745300e0 ("crypto/qat: add KASUMI")
CC: stable@dpdk.org
Signed-off-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
---
drivers/crypto/qat/qat_crypto.c | 37 ++++++++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 11 deletions(-)
diff --git a/drivers/crypto/qat/qat_crypto.c b/drivers/crypto/qat/qat_crypto.c
index 9b294e4..bdd5bab 100644
--- a/drivers/crypto/qat/qat_crypto.c
+++ b/drivers/crypto/qat/qat_crypto.c
@@ -812,6 +812,11 @@ qat_pmd_dequeue_op_burst(void *qp, struct rte_crypto_op **ops,
(rx_op->sym->session->_private);
if (sess->bpi_ctx)
qat_bpicipher_postprocess(sess, rx_op);
+ if (sess->qat_hash_alg ==
+ ICP_QAT_HW_AUTH_ALGO_KASUMI_F9)
+ /* Trim area used for authentication IV. */
+ rte_pktmbuf_adj(rx_op->sym->m_src,
+ ICP_QAT_HW_KASUMI_BLK_SZ);
rx_op->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
}
@@ -1012,15 +1017,25 @@ qat_write_hw_desc_entry(struct rte_crypto_op *op, uint8_t *out_msg,
if (ctx->qat_hash_alg ==
ICP_QAT_HW_AUTH_ALGO_KASUMI_F9) {
- if (do_cipher) {
- auth_len = auth_len + auth_ofs + 1 -
- ICP_QAT_HW_KASUMI_BLK_SZ;
- auth_ofs = ICP_QAT_HW_KASUMI_BLK_SZ;
- } else {
- auth_len = auth_len + auth_ofs + 1;
- auth_ofs = 0;
- }
- }
+ /*
+ * Prepend IV in mbuf, as IV and the plaintext
+ * needs to be contiguous
+ */
+ uint8_t *auth_iv_ptr_dst =
+ (uint8_t *) rte_pktmbuf_prepend(
+ op->sym->m_src,
+ ICP_QAT_HW_KASUMI_BLK_SZ);
+ const uint8_t *auth_iv_ptr_src =
+ op->sym->auth.aad.data;
+ rte_memcpy(auth_iv_ptr_dst, auth_iv_ptr_src,
+ ICP_QAT_HW_KASUMI_BLK_SZ);
+ /* Auth IV and message is contiguous + direction bit */
+ auth_len = auth_len + ICP_QAT_HW_KASUMI_BLK_SZ + 1;
+ /* Buffer to cipher starts after auth IV */
+ if (do_cipher)
+ cipher_ofs += ICP_QAT_HW_KASUMI_BLK_SZ;
+ } else
+ auth_param->u1.aad_adr = op->sym->auth.aad.phys_addr;
} else if (ctx->qat_hash_alg ==
ICP_QAT_HW_AUTH_ALGO_GALOIS_128 ||
@@ -1028,6 +1043,8 @@ qat_write_hw_desc_entry(struct rte_crypto_op *op, uint8_t *out_msg,
ICP_QAT_HW_AUTH_ALGO_GALOIS_64) {
auth_ofs = op->sym->cipher.data.offset;
auth_len = op->sym->cipher.data.length;
+
+ auth_param->u1.aad_adr = op->sym->auth.aad.phys_addr;
} else {
auth_ofs = op->sym->auth.data.offset;
auth_len = op->sym->auth.data.length;
@@ -1036,8 +1053,6 @@ qat_write_hw_desc_entry(struct rte_crypto_op *op, uint8_t *out_msg,
auth_param->auth_res_addr = op->sym->auth.digest.phys_addr;
- auth_param->u1.aad_adr = op->sym->auth.aad.phys_addr;
-
}
if (op->sym->m_src->next || (op->sym->m_dst && op->sym->m_dst->next))
--
2.9.4
prev parent reply other threads:[~2017-06-26 18:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1496005522-134934-1-git-send-email-pablo.de.lara.guarch@intel.com>
[not found] ` <20170626102126.56563-1-pablo.de.lara.guarch@intel.com>
2017-06-26 10:21 ` Pablo de Lara
[not found] ` <20170626102300.56637-1-pablo.de.lara.guarch@intel.com>
2017-06-26 10:22 ` Pablo de Lara [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170626102300.56637-8-pablo.de.lara.guarch@intel.com \
--to=pablo.de.lara.guarch@intel.com \
--cc=akhil.goyal@nxp.com \
--cc=declan.doherty@intel.com \
--cc=dev@dpdk.org \
--cc=hemant.agrawal@nxp.com \
--cc=jerin.jacob@caviumnetworks.com \
--cc=stable@dpdk.org \
--cc=zbigniew.bodek@caviumnetworks.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).