From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 44CEA42EC5; Thu, 20 Jul 2023 12:38:28 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 3145041143; Thu, 20 Jul 2023 12:38:28 +0200 (CEST) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by mails.dpdk.org (Postfix) with ESMTP id EB693410FB for ; Thu, 20 Jul 2023 12:38:26 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1689849507; x=1721385507; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=yr3aLRqfSCnFk8F/K4sC6sg7vk+imzZ6lKJ/oQSUPV4=; b=K9gs1cntmYBLFMeoN3gx8nydAoi2kQnhF219Ptb8O1ll/fiNViLQknnj oBuBpP/YTuYQXrO75FSHpQ/HMzgfGkTVBMXCv7/BCflxIJRwXL4wQMhxp dmKNVUJMpJzbAxfQW9RQ1fK3HYVz3r9UfCEOKfZhflyrVCbElvTa/aFO9 HNrUbdi0V/6vondqg1bM0AAC+4K7pPyOGYvour2itDu3xTCyhRVwKtdF3 w5lIDIb+QcxEy16ShSxbR4wsYLqsg/RTy0FA3VaQFNfehxDB/AQpXffqu kEdwJfTmGhXjLoG+JG6tyqmcdErniyPvgOTsz8Mz2yx7uWmb2N7NVzhTw A==; X-IronPort-AV: E=McAfee;i="6600,9927,10776"; a="356659912" X-IronPort-AV: E=Sophos;i="6.01,218,1684825200"; d="scan'208";a="356659912" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Jul 2023 03:38:26 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10776"; a="701582152" X-IronPort-AV: E=Sophos;i="6.01,218,1684825200"; d="scan'208";a="701582152" Received: from silpixa00400883.ir.intel.com ([10.243.22.155]) by orsmga006.jf.intel.com with ESMTP; 20 Jul 2023 03:38:24 -0700 From: Brian Dooley To: Kai Ji , Pablo de Lara Cc: dev@dpdk.org, gakhil@marvell.com, Brian Dooley Subject: [PATCH v1] crypto/ipsec_mb: add digest encrypted feature Date: Thu, 20 Jul 2023 10:38:18 +0000 Message-Id: <20230720103818.1810015-1-brian.dooley@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230421101310.420593-1-brian.dooley@intel.com> References: <20230421101310.420593-1-brian.dooley@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org AESNI_MB PMD does not support Digest Encrypted. This patch adds support for this feature. Signed-off-by: Brian Dooley --- drivers/crypto/ipsec_mb/pmd_aesni_mb.c | 107 +++++++++++++++++++++++-- 1 file changed, 102 insertions(+), 5 deletions(-) diff --git a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c index 9e298023d7..48b0e66f24 100644 --- a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c +++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c @@ -1438,6 +1438,54 @@ set_gcm_job(IMB_MGR *mb_mgr, IMB_JOB *job, const uint8_t sgl, return 0; } +/** Check if conditions are met for digest-appended operations */ +static uint8_t * +aesni_mb_digest_appended_in_src(struct rte_crypto_op *op, IMB_JOB *job, + uint32_t oop) +{ + unsigned int auth_size, cipher_size; + uint8_t *end_cipher; + uint8_t *start_cipher; + + if (job->cipher_mode == IMB_CIPHER_NULL) + return NULL; + + if (job->cipher_mode == IMB_CIPHER_ZUC_EEA3 || + job->cipher_mode == IMB_CIPHER_SNOW3G_UEA2_BITLEN || + job->cipher_mode == IMB_CIPHER_KASUMI_UEA1_BITLEN) { + cipher_size = (op->sym->cipher.data.offset >> 3) + + (op->sym->cipher.data.length >> 3); + } else { + cipher_size = (op->sym->cipher.data.offset) + + (op->sym->cipher.data.length); + } + if (job->hash_alg == IMB_AUTH_ZUC_EIA3_BITLEN || + job->hash_alg == IMB_AUTH_SNOW3G_UIA2_BITLEN || + job->hash_alg == IMB_AUTH_KASUMI_UIA1 || + job->hash_alg == IMB_AUTH_ZUC256_EIA3_BITLEN) { + auth_size = (op->sym->auth.data.offset >> 3) + + (op->sym->auth.data.length >> 3); + } else { + auth_size = (op->sym->auth.data.offset) + + (op->sym->auth.data.length); + } + + if (!oop) { + end_cipher = rte_pktmbuf_mtod_offset(op->sym->m_src, uint8_t *, cipher_size); + start_cipher = rte_pktmbuf_mtod(op->sym->m_src, uint8_t *); + } else { + end_cipher = rte_pktmbuf_mtod_offset(op->sym->m_dst, uint8_t *, cipher_size); + start_cipher = rte_pktmbuf_mtod(op->sym->m_dst, uint8_t *); + } + + if (start_cipher < op->sym->auth.digest.data && + op->sym->auth.digest.data < end_cipher) { + return rte_pktmbuf_mtod_offset(op->sym->m_src, uint8_t *, auth_size); + } else { + return NULL; + } +} + /** * Process a crypto operation and complete a IMB_JOB job structure for * submission to the multi buffer library for processing. @@ -1580,9 +1628,12 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp, } else { if (aead) job->auth_tag_output = op->sym->aead.digest.data; - else - job->auth_tag_output = op->sym->auth.digest.data; - + else { + job->auth_tag_output = aesni_mb_digest_appended_in_src(op, job, oop); + if (job->auth_tag_output == NULL) { + job->auth_tag_output = op->sym->auth.digest.data; + } + } if (session->auth.req_digest_len != job->auth_tag_output_len_in_bytes) { job->auth_tag_output = @@ -1917,6 +1968,7 @@ post_process_mb_job(struct ipsec_mb_qp *qp, IMB_JOB *job) struct aesni_mb_session *sess = NULL; uint8_t *linear_buf = NULL; int sgl = 0; + uint8_t oop = 0; uint8_t is_docsis_sec = 0; if (op->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) { @@ -1962,8 +2014,52 @@ post_process_mb_job(struct ipsec_mb_qp *qp, IMB_JOB *job) op->sym->auth.digest.data, sess->auth.req_digest_len, &op->status); - } else + } else { + if (!op->sym->m_dst || op->sym->m_dst == op->sym->m_src) { + /* in-place operation */ + oop = 0; + } else { /* out-of-place operation */ + oop = 1; + } + + if (op->sym->m_src->nb_segs == 1 && op->sym->m_dst != NULL + && !is_aead_algo(job->hash_alg, sess->template_job.cipher_mode) && + aesni_mb_digest_appended_in_src(op, job, oop) != NULL) { + unsigned int auth_size, cipher_size; + int unencrypted_bytes = 0; + if (job->cipher_mode == IMB_CIPHER_SNOW3G_UEA2_BITLEN || + job->cipher_mode == IMB_CIPHER_KASUMI_UEA1_BITLEN || + job->cipher_mode == IMB_CIPHER_ZUC_EEA3) { + cipher_size = (op->sym->cipher.data.offset >> 3) + + (op->sym->cipher.data.length >> 3); + } else { + cipher_size = (op->sym->cipher.data.offset) + + (op->sym->cipher.data.length); + } + if (job->hash_alg == IMB_AUTH_ZUC_EIA3_BITLEN || + job->hash_alg == IMB_AUTH_SNOW3G_UIA2_BITLEN || + job->hash_alg == IMB_AUTH_KASUMI_UIA1 || + job->hash_alg == IMB_AUTH_ZUC256_EIA3_BITLEN) { + auth_size = (op->sym->auth.data.offset >> 3) + + (op->sym->auth.data.length >> 3); + } else { + auth_size = (op->sym->auth.data.offset) + + (op->sym->auth.data.length); + } + if (job->cipher_mode != IMB_CIPHER_NULL) { + unencrypted_bytes = auth_size + + job->auth_tag_output_len_in_bytes - cipher_size; + if (unencrypted_bytes > 0) + rte_memcpy( + rte_pktmbuf_mtod_offset( + op->sym->m_dst, uint8_t *, cipher_size), + rte_pktmbuf_mtod_offset( + op->sym->m_src, uint8_t *, cipher_size), + unencrypted_bytes); + } + } generate_digest(job, op, sess); + } break; default: op->status = RTE_CRYPTO_OP_STATUS_ERROR; @@ -2555,7 +2651,8 @@ RTE_INIT(ipsec_mb_register_aesni_mb) RTE_CRYPTODEV_FF_OOP_SGL_IN_SGL_OUT | RTE_CRYPTODEV_FF_OOP_LB_IN_SGL_OUT | RTE_CRYPTODEV_FF_OOP_SGL_IN_LB_OUT | - RTE_CRYPTODEV_FF_SECURITY; + RTE_CRYPTODEV_FF_SECURITY | + RTE_CRYPTODEV_FF_DIGEST_ENCRYPTED; aesni_mb_data->internals_priv_size = 0; aesni_mb_data->ops = &aesni_mb_pmd_ops; -- 2.25.1