drivers/common/cnxk/cnxk_security.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright(C) 2021 Marvell.
   3  */
   4
   5 #include <rte_udp.h>
   6
   7 #include "cnxk_security.h"
   8
   9 #include "roc_api.h"
  10
  11 static void
  12 ipsec_hmac_opad_ipad_gen(struct rte_crypto_sym_xform *auth_xform,
  13                          uint8_t *hmac_opad_ipad)
  14 {
  15         const uint8_t *key = auth_xform->auth.key.data;
  16         uint32_t length = auth_xform->auth.key.length;
  17         uint8_t opad[128] = {[0 ... 127] = 0x5c};
  18         uint8_t ipad[128] = {[0 ... 127] = 0x36};
  19         uint32_t i;
  20
  21         /* HMAC OPAD and IPAD */
  22         for (i = 0; i < 127 && i < length; i++) {
  23                 opad[i] = opad[i] ^ key[i];
  24                 ipad[i] = ipad[i] ^ key[i];
  25         }
  26
  27         /* Precompute hash of HMAC OPAD and IPAD to avoid
  28          * per packet computation
  29          */
  30         switch (auth_xform->auth.algo) {
  31         case RTE_CRYPTO_AUTH_SHA1_HMAC:
  32                 roc_hash_sha1_gen(opad, (uint32_t *)&hmac_opad_ipad[0]);
  33                 roc_hash_sha1_gen(ipad, (uint32_t *)&hmac_opad_ipad[24]);
  34                 break;
  35         default:
  36                 break;
  37         }
  38 }
  39
  40 static int
  41 ot_ipsec_sa_common_param_fill(union roc_ot_ipsec_sa_word2 *w2,
  42                               uint8_t *cipher_key, uint8_t *salt_key,
  43                               uint8_t *hmac_opad_ipad,
  44                               struct rte_security_ipsec_xform *ipsec_xfrm,
  45                               struct rte_crypto_sym_xform *crypto_xfrm)
  46 {
  47         struct rte_crypto_sym_xform *auth_xfrm, *cipher_xfrm;
  48         const uint8_t *key;
  49         uint32_t *tmp_salt;
  50         uint64_t *tmp_key;
  51         int length, i;
  52
  53         /* Set direction */
  54         switch (ipsec_xfrm->direction) {
  55         case RTE_SECURITY_IPSEC_SA_DIR_INGRESS:
  56                 w2->s.dir = ROC_IE_SA_DIR_INBOUND;
  57                 auth_xfrm = crypto_xfrm;
  58                 cipher_xfrm = crypto_xfrm->next;
  59                 break;
  60         case RTE_SECURITY_IPSEC_SA_DIR_EGRESS:
  61                 w2->s.dir = ROC_IE_SA_DIR_OUTBOUND;
  62                 cipher_xfrm = crypto_xfrm;
  63                 auth_xfrm = crypto_xfrm->next;
  64                 break;
  65         default:
  66                 return -EINVAL;
  67         }
  68
  69         /* Set protocol - ESP vs AH */
  70         switch (ipsec_xfrm->proto) {
  71         case RTE_SECURITY_IPSEC_SA_PROTO_ESP:
  72                 w2->s.protocol = ROC_IE_SA_PROTOCOL_ESP;
  73                 break;
  74         case RTE_SECURITY_IPSEC_SA_PROTO_AH:
  75                 w2->s.protocol = ROC_IE_SA_PROTOCOL_AH;
  76                 break;
  77         default:
  78                 return -EINVAL;
  79         }
  80
  81         /* Set mode - transport vs tunnel */
  82         switch (ipsec_xfrm->mode) {
  83         case RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT:
  84                 w2->s.mode = ROC_IE_SA_MODE_TRANSPORT;
  85                 break;
  86         case RTE_SECURITY_IPSEC_SA_MODE_TUNNEL:
  87                 w2->s.mode = ROC_IE_SA_MODE_TUNNEL;
  88                 break;
  89         default:
  90                 return -EINVAL;
  91         }
  92
  93         /* Set encryption algorithm */
  94         if (crypto_xfrm->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
  95                 key = crypto_xfrm->aead.key.data;
  96                 length = crypto_xfrm->aead.key.length;
  97
  98                 switch (crypto_xfrm->aead.algo) {
  99                 case RTE_CRYPTO_AEAD_AES_GCM:
 100                         w2->s.enc_type = ROC_IE_OT_SA_ENC_AES_GCM;
 101                         w2->s.auth_type = ROC_IE_OT_SA_AUTH_NULL;
 102                         memcpy(salt_key, &ipsec_xfrm->salt, 4);
 103                         tmp_salt = (uint32_t *)salt_key;
 104                         *tmp_salt = rte_be_to_cpu_32(*tmp_salt);
 105                         break;
 106                 default:
 107                         return -ENOTSUP;
 108                 }
 109         } else {
 110                 switch (cipher_xfrm->cipher.algo) {
 111                 case RTE_CRYPTO_CIPHER_AES_CBC:
 112                         w2->s.enc_type = ROC_IE_OT_SA_ENC_AES_CBC;
 113                         break;
 114                 default:
 115                         return -ENOTSUP;
 116                 }
 117
 118                 switch (auth_xfrm->auth.algo) {
 119                 case RTE_CRYPTO_AUTH_NULL:
 120                         w2->s.auth_type = ROC_IE_OT_SA_AUTH_NULL;
 121                         break;
 122                 case RTE_CRYPTO_AUTH_SHA1_HMAC:
 123                         w2->s.auth_type = ROC_IE_OT_SA_AUTH_SHA1;
 124                         ipsec_hmac_opad_ipad_gen(auth_xfrm, hmac_opad_ipad);
 125
 126                         tmp_key = (uint64_t *)hmac_opad_ipad;
 127                         for (i = 0; i < (int)(ROC_CTX_MAX_OPAD_IPAD_LEN /
 128                                               sizeof(uint64_t));
 129                              i++)
 130                                 tmp_key[i] = rte_be_to_cpu_64(tmp_key[i]);
 131                         break;
 132                 default:
 133                         return -ENOTSUP;
 134                 }
 135
 136                 key = cipher_xfrm->cipher.key.data;
 137                 length = cipher_xfrm->cipher.key.length;
 138         }
 139
 140         /* Set encapsulation type */
 141         if (ipsec_xfrm->options.udp_encap)
 142                 w2->s.encap_type = ROC_IE_OT_SA_ENCAP_UDP;
 143
 144         w2->s.spi = ipsec_xfrm->spi;
 145
 146         /* Copy encryption key */
 147         memcpy(cipher_key, key, length);
 148         tmp_key = (uint64_t *)cipher_key;
 149         for (i = 0; i < (int)(ROC_CTX_MAX_CKEY_LEN / sizeof(uint64_t)); i++)
 150                 tmp_key[i] = rte_be_to_cpu_64(tmp_key[i]);
 151
 152         switch (length) {
 153         case ROC_CPT_AES128_KEY_LEN:
 154                 w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
 155                 break;
 156         case ROC_CPT_AES192_KEY_LEN:
 157                 w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
 158                 break;
 159         case ROC_CPT_AES256_KEY_LEN:
 160                 w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
 161                 break;
 162         default:
 163                 return -EINVAL;
 164         }
 165
 166         if (ipsec_xfrm->life.packets_soft_limit != 0 ||
 167             ipsec_xfrm->life.packets_hard_limit != 0) {
 168                 if (ipsec_xfrm->life.bytes_soft_limit != 0 ||
 169                     ipsec_xfrm->life.bytes_hard_limit != 0) {
 170                         plt_err("Expiry tracking with both packets & bytes is not supported");
 171                         return -EINVAL;
 172                 }
 173                 w2->s.life_unit = ROC_IE_OT_SA_LIFE_UNIT_PKTS;
 174         }
 175
 176         if (ipsec_xfrm->life.bytes_soft_limit != 0 ||
 177             ipsec_xfrm->life.bytes_hard_limit != 0) {
 178                 if (ipsec_xfrm->life.packets_soft_limit != 0 ||
 179                     ipsec_xfrm->life.packets_hard_limit != 0) {
 180                         plt_err("Expiry tracking with both packets & bytes is not supported");
 181                         return -EINVAL;
 182                 }
 183                 w2->s.life_unit = ROC_IE_OT_SA_LIFE_UNIT_OCTETS;
 184         }
 185
 186         return 0;
 187 }
 188
 189 static size_t
 190 ot_ipsec_inb_ctx_size(struct roc_ot_ipsec_inb_sa *sa)
 191 {
 192         size_t size;
 193
 194         /* Variable based on Anti-replay Window */
 195         size = offsetof(struct roc_ot_ipsec_inb_sa, ctx) +
 196                offsetof(struct roc_ot_ipsec_inb_ctx_update_reg, ar_winbits);
 197
 198         if (sa->w0.s.ar_win)
 199                 size += (1 << (sa->w0.s.ar_win - 1)) * sizeof(uint64_t);
 200
 201         return size;
 202 }
 203
 204 static int
 205 ot_ipsec_inb_tunnel_hdr_fill(struct roc_ot_ipsec_inb_sa *sa,
 206                              struct rte_security_ipsec_xform *ipsec_xfrm)
 207 {
 208         struct rte_security_ipsec_tunnel_param *tunnel;
 209
 210         if (ipsec_xfrm->mode != RTE_SECURITY_IPSEC_SA_MODE_TUNNEL)
 211                 return 0;
 212
 213         if (ipsec_xfrm->options.tunnel_hdr_verify == 0)
 214                 return 0;
 215
 216         tunnel = &ipsec_xfrm->tunnel;
 217
 218         switch (tunnel->type) {
 219         case RTE_SECURITY_IPSEC_TUNNEL_IPV4:
 220                 sa->w2.s.outer_ip_ver = ROC_IE_SA_IP_VERSION_4;
 221                 memcpy(&sa->outer_hdr.ipv4.src_addr, &tunnel->ipv4.src_ip,
 222                        sizeof(struct in_addr));
 223                 memcpy(&sa->outer_hdr.ipv4.dst_addr, &tunnel->ipv4.dst_ip,
 224                        sizeof(struct in_addr));
 225
 226                 /* IP Source and Dest are in LE/CPU endian */
 227                 sa->outer_hdr.ipv4.src_addr =
 228                         rte_be_to_cpu_32(sa->outer_hdr.ipv4.src_addr);
 229                 sa->outer_hdr.ipv4.dst_addr =
 230                         rte_be_to_cpu_32(sa->outer_hdr.ipv4.dst_addr);
 231
 232                 break;
 233         case RTE_SECURITY_IPSEC_TUNNEL_IPV6:
 234                 sa->w2.s.outer_ip_ver = ROC_IE_SA_IP_VERSION_6;
 235                 memcpy(&sa->outer_hdr.ipv6.src_addr, &tunnel->ipv6.src_addr,
 236                        sizeof(struct in6_addr));
 237                 memcpy(&sa->outer_hdr.ipv6.dst_addr, &tunnel->ipv6.dst_addr,
 238                        sizeof(struct in6_addr));
 239
 240                 break;
 241         default:
 242                 return -EINVAL;
 243         }
 244
 245         switch (ipsec_xfrm->options.tunnel_hdr_verify) {
 246         case RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR:
 247                 sa->w2.s.ip_hdr_verify = ROC_IE_OT_SA_IP_HDR_VERIFY_DST_ADDR;
 248                 break;
 249         case RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR:
 250                 sa->w2.s.ip_hdr_verify =
 251                         ROC_IE_OT_SA_IP_HDR_VERIFY_SRC_DST_ADDR;
 252                 break;
 253         default:
 254                 return -ENOTSUP;
 255         }
 256
 257         return 0;
 258 }
 259
 260 int
 261 cnxk_ot_ipsec_inb_sa_fill(struct roc_ot_ipsec_inb_sa *sa,
 262                           struct rte_security_ipsec_xform *ipsec_xfrm,
 263                           struct rte_crypto_sym_xform *crypto_xfrm)
 264 {
 265         union roc_ot_ipsec_sa_word2 w2;
 266         uint32_t replay_win_sz;
 267         size_t offset;
 268         int rc;
 269
 270         w2.u64 = 0;
 271         rc = ot_ipsec_sa_common_param_fill(&w2, sa->cipher_key, sa->w8.s.salt,
 272                                            sa->hmac_opad_ipad, ipsec_xfrm,
 273                                            crypto_xfrm);
 274         if (rc)
 275                 return rc;
 276
 277         /* Updata common word2 data */
 278         sa->w2.u64 = w2.u64;
 279
 280         /* Only support power-of-two window sizes supported */
 281         replay_win_sz = ipsec_xfrm->replay_win_sz;
 282         if (replay_win_sz) {
 283                 if (!rte_is_power_of_2(replay_win_sz) ||
 284                     replay_win_sz > ROC_AR_WIN_SIZE_MAX)
 285                         return -ENOTSUP;
 286
 287                 sa->w0.s.ar_win = rte_log2_u32(replay_win_sz) - 5;
 288         }
 289
 290         rc = ot_ipsec_inb_tunnel_hdr_fill(sa, ipsec_xfrm);
 291         if (rc)
 292                 return rc;
 293
 294         /* Default options for pkt_out and pkt_fmt are with
 295          * second pass meta and no defrag.
 296          */
 297         sa->w0.s.pkt_format = ROC_IE_OT_SA_PKT_FMT_META;
 298         sa->w0.s.pkt_output = ROC_IE_OT_SA_PKT_OUTPUT_HW_BASED_DEFRAG;
 299         sa->w0.s.pkind = ROC_OT_CPT_META_PKIND;
 300
 301         /* ESN */
 302         sa->w2.s.esn_en = !!ipsec_xfrm->options.esn;
 303         if (ipsec_xfrm->options.udp_encap) {
 304                 sa->w10.s.udp_src_port = 4500;
 305                 sa->w10.s.udp_dst_port = 4500;
 306         }
 307
 308         if (ipsec_xfrm->options.udp_ports_verify)
 309                 sa->w2.s.udp_ports_verify = 1;
 310
 311         offset = offsetof(struct roc_ot_ipsec_inb_sa, ctx);
 312         /* Word offset for HW managed SA field */
 313         sa->w0.s.hw_ctx_off = offset / 8;
 314         /* Context push size for inbound spans up to hw_ctx including
 315          * ar_base field, in 8b units
 316          */
 317         sa->w0.s.ctx_push_size = sa->w0.s.hw_ctx_off + 1;
 318         /* Entire context size in 128B units */
 319         sa->w0.s.ctx_size =
 320                 (PLT_ALIGN_CEIL(ot_ipsec_inb_ctx_size(sa), ROC_CTX_UNIT_128B) /
 321                  ROC_CTX_UNIT_128B) -
 322                 1;
 323
 324         /**
 325          * CPT MC triggers expiry when counter value changes from 2 to 1. To
 326          * mitigate this behaviour add 1 to the life counter values provided.
 327          */
 328
 329         if (ipsec_xfrm->life.bytes_soft_limit) {
 330                 sa->ctx.soft_life = ipsec_xfrm->life.bytes_soft_limit + 1;
 331                 sa->w0.s.soft_life_dec = 1;
 332         }
 333
 334         if (ipsec_xfrm->life.packets_soft_limit) {
 335                 sa->ctx.soft_life = ipsec_xfrm->life.packets_soft_limit + 1;
 336                 sa->w0.s.soft_life_dec = 1;
 337         }
 338
 339         if (ipsec_xfrm->life.bytes_hard_limit) {
 340                 sa->ctx.hard_life = ipsec_xfrm->life.bytes_hard_limit + 1;
 341                 sa->w0.s.hard_life_dec = 1;
 342         }
 343
 344         if (ipsec_xfrm->life.packets_hard_limit) {
 345                 sa->ctx.hard_life = ipsec_xfrm->life.packets_hard_limit + 1;
 346                 sa->w0.s.hard_life_dec = 1;
 347         }
 348
 349         /* There are two words of CPT_CTX_HW_S for ucode to skip */
 350         sa->w0.s.ctx_hdr_size = 1;
 351         sa->w0.s.aop_valid = 1;
 352         sa->w0.s.et_ovrwr = 1;
 353
 354         rte_wmb();
 355
 356         /* Enable SA */
 357         sa->w2.s.valid = 1;
 358         return 0;
 359 }
 360
 361 int
 362 cnxk_ot_ipsec_outb_sa_fill(struct roc_ot_ipsec_outb_sa *sa,
 363                            struct rte_security_ipsec_xform *ipsec_xfrm,
 364                            struct rte_crypto_sym_xform *crypto_xfrm)
 365 {
 366         struct rte_security_ipsec_tunnel_param *tunnel = &ipsec_xfrm->tunnel;
 367         union roc_ot_ipsec_sa_word2 w2;
 368         size_t offset;
 369         int rc;
 370
 371         w2.u64 = 0;
 372         rc = ot_ipsec_sa_common_param_fill(&w2, sa->cipher_key, sa->iv.s.salt,
 373                                            sa->hmac_opad_ipad, ipsec_xfrm,
 374                                            crypto_xfrm);
 375         if (rc)
 376                 return rc;
 377
 378         /* Update common word2 data */
 379         sa->w2.u64 = w2.u64;
 380
 381         if (ipsec_xfrm->mode != RTE_SECURITY_IPSEC_SA_MODE_TUNNEL)
 382                 goto skip_tunnel_info;
 383
 384         /* Tunnel header info */
 385         switch (tunnel->type) {
 386         case RTE_SECURITY_IPSEC_TUNNEL_IPV4:
 387                 sa->w2.s.outer_ip_ver = ROC_IE_SA_IP_VERSION_4;
 388                 memcpy(&sa->outer_hdr.ipv4.src_addr, &tunnel->ipv4.src_ip,
 389                        sizeof(struct in_addr));
 390                 memcpy(&sa->outer_hdr.ipv4.dst_addr, &tunnel->ipv4.dst_ip,
 391                        sizeof(struct in_addr));
 392
 393                 /* IP Source and Dest seems to be in LE/CPU endian */
 394                 sa->outer_hdr.ipv4.src_addr =
 395                         rte_be_to_cpu_32(sa->outer_hdr.ipv4.src_addr);
 396                 sa->outer_hdr.ipv4.dst_addr =
 397                         rte_be_to_cpu_32(sa->outer_hdr.ipv4.dst_addr);
 398
 399                 /* Outer header DF bit source */
 400                 if (!ipsec_xfrm->options.copy_df) {
 401                         sa->w2.s.ipv4_df_src_or_ipv6_flw_lbl_src =
 402                                 ROC_IE_OT_SA_COPY_FROM_SA;
 403                         sa->w10.s.ipv4_df_or_ipv6_flw_lbl = tunnel->ipv4.df;
 404                 } else {
 405                         sa->w2.s.ipv4_df_src_or_ipv6_flw_lbl_src =
 406                                 ROC_IE_OT_SA_COPY_FROM_INNER_IP_HDR;
 407                 }
 408
 409                 /* Outer header DSCP source */
 410                 if (!ipsec_xfrm->options.copy_dscp) {
 411                         sa->w2.s.dscp_src = ROC_IE_OT_SA_COPY_FROM_SA;
 412                         sa->w10.s.dscp = tunnel->ipv4.dscp;
 413                 } else {
 414                         sa->w2.s.dscp_src = ROC_IE_OT_SA_COPY_FROM_INNER_IP_HDR;
 415                 }
 416                 break;
 417         case RTE_SECURITY_IPSEC_TUNNEL_IPV6:
 418                 sa->w2.s.outer_ip_ver = ROC_IE_SA_IP_VERSION_6;
 419                 memcpy(&sa->outer_hdr.ipv6.src_addr, &tunnel->ipv6.src_addr,
 420                        sizeof(struct in6_addr));
 421                 memcpy(&sa->outer_hdr.ipv6.dst_addr, &tunnel->ipv6.dst_addr,
 422                        sizeof(struct in6_addr));
 423
 424                 /* Outer header flow label source */
 425                 if (!ipsec_xfrm->options.copy_flabel) {
 426                         sa->w2.s.ipv4_df_src_or_ipv6_flw_lbl_src =
 427                                 ROC_IE_OT_SA_COPY_FROM_SA;
 428
 429                         sa->w10.s.ipv4_df_or_ipv6_flw_lbl = tunnel->ipv6.flabel;
 430                 } else {
 431                         sa->w2.s.ipv4_df_src_or_ipv6_flw_lbl_src =
 432                                 ROC_IE_OT_SA_COPY_FROM_INNER_IP_HDR;
 433                 }
 434
 435                 /* Outer header DSCP source */
 436                 if (!ipsec_xfrm->options.copy_dscp) {
 437                         sa->w2.s.dscp_src = ROC_IE_OT_SA_COPY_FROM_SA;
 438                         sa->w10.s.dscp = tunnel->ipv6.dscp;
 439                 } else {
 440                         sa->w2.s.dscp_src = ROC_IE_OT_SA_COPY_FROM_INNER_IP_HDR;
 441                 }
 442                 break;
 443         default:
 444                 return -EINVAL;
 445         }
 446
 447 skip_tunnel_info:
 448         /* ESN */
 449         sa->w0.s.esn_en = !!ipsec_xfrm->options.esn;
 450
 451         if (ipsec_xfrm->options.udp_encap) {
 452                 sa->w10.s.udp_src_port = 4500;
 453                 sa->w10.s.udp_dst_port = 4500;
 454         }
 455
 456         offset = offsetof(struct roc_ot_ipsec_outb_sa, ctx);
 457         /* Word offset for HW managed SA field */
 458         sa->w0.s.hw_ctx_off = offset / 8;
 459         /* Context push size is up to hmac_opad_ipad */
 460         sa->w0.s.ctx_push_size = sa->w0.s.hw_ctx_off;
 461         /* Entire context size in 128B units */
 462         offset = sizeof(struct roc_ot_ipsec_outb_sa);
 463         sa->w0.s.ctx_size = (PLT_ALIGN_CEIL(offset, ROC_CTX_UNIT_128B) /
 464                              ROC_CTX_UNIT_128B) -
 465                             1;
 466
 467         /* IPID gen */
 468         sa->w2.s.ipid_gen = 1;
 469
 470         /**
 471          * CPT MC triggers expiry when counter value changes from 2 to 1. To
 472          * mitigate this behaviour add 1 to the life counter values provided.
 473          */
 474
 475         if (ipsec_xfrm->life.bytes_soft_limit) {
 476                 sa->ctx.soft_life = ipsec_xfrm->life.bytes_soft_limit + 1;
 477                 sa->w0.s.soft_life_dec = 1;
 478         }
 479
 480         if (ipsec_xfrm->life.packets_soft_limit) {
 481                 sa->ctx.soft_life = ipsec_xfrm->life.packets_soft_limit + 1;
 482                 sa->w0.s.soft_life_dec = 1;
 483         }
 484
 485         if (ipsec_xfrm->life.bytes_hard_limit) {
 486                 sa->ctx.hard_life = ipsec_xfrm->life.bytes_hard_limit + 1;
 487                 sa->w0.s.hard_life_dec = 1;
 488         }
 489
 490         if (ipsec_xfrm->life.packets_hard_limit) {
 491                 sa->ctx.hard_life = ipsec_xfrm->life.packets_hard_limit + 1;
 492                 sa->w0.s.hard_life_dec = 1;
 493         }
 494
 495         /* There are two words of CPT_CTX_HW_S for ucode to skip */
 496         sa->w0.s.ctx_hdr_size = 1;
 497         sa->w0.s.aop_valid = 1;
 498
 499         rte_wmb();
 500
 501         /* Enable SA */
 502         sa->w2.s.valid = 1;
 503         return 0;
 504 }
 505
 506 bool
 507 cnxk_ot_ipsec_inb_sa_valid(struct roc_ot_ipsec_inb_sa *sa)
 508 {
 509         return !!sa->w2.s.valid;
 510 }
 511
 512 bool
 513 cnxk_ot_ipsec_outb_sa_valid(struct roc_ot_ipsec_outb_sa *sa)
 514 {
 515         return !!sa->w2.s.valid;
 516 }
 517
 518 static inline int
 519 ipsec_xfrm_verify(struct rte_security_ipsec_xform *ipsec_xfrm,
 520                   struct rte_crypto_sym_xform *crypto_xfrm)
 521 {
 522         if (crypto_xfrm->next == NULL)
 523                 return -EINVAL;
 524
 525         if (ipsec_xfrm->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
 526                 if (crypto_xfrm->type != RTE_CRYPTO_SYM_XFORM_AUTH ||
 527                     crypto_xfrm->next->type != RTE_CRYPTO_SYM_XFORM_CIPHER)
 528                         return -EINVAL;
 529         } else {
 530                 if (crypto_xfrm->type != RTE_CRYPTO_SYM_XFORM_CIPHER ||
 531                     crypto_xfrm->next->type != RTE_CRYPTO_SYM_XFORM_AUTH)
 532                         return -EINVAL;
 533         }
 534
 535         return 0;
 536 }
 537
 538 static int
 539 onf_ipsec_sa_common_param_fill(struct roc_ie_onf_sa_ctl *ctl, uint8_t *salt,
 540                                uint8_t *cipher_key, uint8_t *hmac_opad_ipad,
 541                                struct rte_security_ipsec_xform *ipsec_xfrm,
 542                                struct rte_crypto_sym_xform *crypto_xfrm)
 543 {
 544         struct rte_crypto_sym_xform *auth_xfrm, *cipher_xfrm;
 545         int rc, length, auth_key_len;
 546         const uint8_t *key = NULL;
 547
 548         /* Set direction */
 549         switch (ipsec_xfrm->direction) {
 550         case RTE_SECURITY_IPSEC_SA_DIR_INGRESS:
 551                 ctl->direction = ROC_IE_SA_DIR_INBOUND;
 552                 auth_xfrm = crypto_xfrm;
 553                 cipher_xfrm = crypto_xfrm->next;
 554                 break;
 555         case RTE_SECURITY_IPSEC_SA_DIR_EGRESS:
 556                 ctl->direction = ROC_IE_SA_DIR_OUTBOUND;
 557                 cipher_xfrm = crypto_xfrm;
 558                 auth_xfrm = crypto_xfrm->next;
 559                 break;
 560         default:
 561                 return -EINVAL;
 562         }
 563
 564         /* Set protocol - ESP vs AH */
 565         switch (ipsec_xfrm->proto) {
 566         case RTE_SECURITY_IPSEC_SA_PROTO_ESP:
 567                 ctl->ipsec_proto = ROC_IE_SA_PROTOCOL_ESP;
 568                 break;
 569         case RTE_SECURITY_IPSEC_SA_PROTO_AH:
 570                 return -ENOTSUP;
 571         default:
 572                 return -EINVAL;
 573         }
 574
 575         /* Set mode - transport vs tunnel */
 576         switch (ipsec_xfrm->mode) {
 577         case RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT:
 578                 ctl->ipsec_mode = ROC_IE_SA_MODE_TRANSPORT;
 579                 break;
 580         case RTE_SECURITY_IPSEC_SA_MODE_TUNNEL:
 581                 ctl->ipsec_mode = ROC_IE_SA_MODE_TUNNEL;
 582                 break;
 583         default:
 584                 return -EINVAL;
 585         }
 586
 587         /* Set encryption algorithm */
 588         if (crypto_xfrm->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 589                 length = crypto_xfrm->aead.key.length;
 590
 591                 switch (crypto_xfrm->aead.algo) {
 592                 case RTE_CRYPTO_AEAD_AES_GCM:
 593                         ctl->enc_type = ROC_IE_ON_SA_ENC_AES_GCM;
 594                         ctl->auth_type = ROC_IE_ON_SA_AUTH_NULL;
 595                         memcpy(salt, &ipsec_xfrm->salt, 4);
 596                         key = crypto_xfrm->aead.key.data;
 597                         break;
 598                 default:
 599                         return -ENOTSUP;
 600                 }
 601
 602         } else {
 603                 rc = ipsec_xfrm_verify(ipsec_xfrm, crypto_xfrm);
 604                 if (rc)
 605                         return rc;
 606
 607                 switch (cipher_xfrm->cipher.algo) {
 608                 case RTE_CRYPTO_CIPHER_AES_CBC:
 609                         ctl->enc_type = ROC_IE_ON_SA_ENC_AES_CBC;
 610                         break;
 611                 default:
 612                         return -ENOTSUP;
 613                 }
 614
 615                 switch (auth_xfrm->auth.algo) {
 616                 case RTE_CRYPTO_AUTH_SHA1_HMAC:
 617                         ctl->auth_type = ROC_IE_ON_SA_AUTH_SHA1;
 618                         break;
 619                 default:
 620                         return -ENOTSUP;
 621                 }
 622                 auth_key_len = auth_xfrm->auth.key.length;
 623                 if (auth_key_len < 20 || auth_key_len > 64)
 624                         return -ENOTSUP;
 625
 626                 key = cipher_xfrm->cipher.key.data;
 627                 length = cipher_xfrm->cipher.key.length;
 628
 629                 ipsec_hmac_opad_ipad_gen(auth_xfrm, hmac_opad_ipad);
 630         }
 631
 632         switch (length) {
 633         case ROC_CPT_AES128_KEY_LEN:
 634                 ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
 635                 break;
 636         case ROC_CPT_AES192_KEY_LEN:
 637                 ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
 638                 break;
 639         case ROC_CPT_AES256_KEY_LEN:
 640                 ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
 641                 break;
 642         default:
 643                 return -EINVAL;
 644         }
 645
 646         memcpy(cipher_key, key, length);
 647
 648         if (ipsec_xfrm->options.esn)
 649                 ctl->esn_en = 1;
 650
 651         ctl->spi = rte_cpu_to_be_32(ipsec_xfrm->spi);
 652         return 0;
 653 }
 654
 655 int
 656 cnxk_onf_ipsec_inb_sa_fill(struct roc_onf_ipsec_inb_sa *sa,
 657                            struct rte_security_ipsec_xform *ipsec_xfrm,
 658                            struct rte_crypto_sym_xform *crypto_xfrm)
 659 {
 660         struct roc_ie_onf_sa_ctl *ctl = &sa->ctl;
 661         int rc;
 662
 663         rc = onf_ipsec_sa_common_param_fill(ctl, sa->nonce, sa->cipher_key,
 664                                             sa->hmac_key, ipsec_xfrm,
 665                                             crypto_xfrm);
 666         if (rc)
 667                 return rc;
 668
 669         rte_wmb();
 670
 671         /* Enable SA */
 672         ctl->valid = 1;
 673         return 0;
 674 }
 675
 676 int
 677 cnxk_onf_ipsec_outb_sa_fill(struct roc_onf_ipsec_outb_sa *sa,
 678                             struct rte_security_ipsec_xform *ipsec_xfrm,
 679                             struct rte_crypto_sym_xform *crypto_xfrm)
 680 {
 681         struct rte_security_ipsec_tunnel_param *tunnel = &ipsec_xfrm->tunnel;
 682         struct roc_ie_onf_sa_ctl *ctl = &sa->ctl;
 683         int rc;
 684
 685         /* Fill common params */
 686         rc = onf_ipsec_sa_common_param_fill(ctl, sa->nonce, sa->cipher_key,
 687                                             sa->hmac_key, ipsec_xfrm,
 688                                             crypto_xfrm);
 689         if (rc)
 690                 return rc;
 691
 692         if (ipsec_xfrm->mode != RTE_SECURITY_IPSEC_SA_MODE_TUNNEL)
 693                 goto skip_tunnel_info;
 694
 695         /* Tunnel header info */
 696         switch (tunnel->type) {
 697         case RTE_SECURITY_IPSEC_TUNNEL_IPV4:
 698                 memcpy(&sa->ip_src, &tunnel->ipv4.src_ip,
 699                        sizeof(struct in_addr));
 700                 memcpy(&sa->ip_dst, &tunnel->ipv4.dst_ip,
 701                        sizeof(struct in_addr));
 702                 break;
 703         case RTE_SECURITY_IPSEC_TUNNEL_IPV6:
 704                 return -ENOTSUP;
 705         default:
 706                 return -EINVAL;
 707         }
 708
 709 skip_tunnel_info:
 710         rte_wmb();
 711
 712         /* Enable SA */
 713         ctl->valid = 1;
 714         return 0;
 715 }
 716
 717 bool
 718 cnxk_onf_ipsec_inb_sa_valid(struct roc_onf_ipsec_inb_sa *sa)
 719 {
 720         return !!sa->ctl.valid;
 721 }
 722
 723 bool
 724 cnxk_onf_ipsec_outb_sa_valid(struct roc_onf_ipsec_outb_sa *sa)
 725 {
 726         return !!sa->ctl.valid;
 727 }
 728
 729 uint8_t
 730 cnxk_ipsec_ivlen_get(enum rte_crypto_cipher_algorithm c_algo,
 731                      enum rte_crypto_auth_algorithm a_algo,
 732                      enum rte_crypto_aead_algorithm aead_algo)
 733 {
 734         uint8_t ivlen = 0;
 735
 736         if (aead_algo == RTE_CRYPTO_AEAD_AES_GCM)
 737                 ivlen = 8;
 738
 739         switch (c_algo) {
 740         case RTE_CRYPTO_CIPHER_AES_CTR:
 741                 ivlen = 8;
 742                 break;
 743         case RTE_CRYPTO_CIPHER_3DES_CBC:
 744                 ivlen = ROC_CPT_DES_BLOCK_LENGTH;
 745                 break;
 746         case RTE_CRYPTO_CIPHER_AES_CBC:
 747                 ivlen = ROC_CPT_AES_BLOCK_LENGTH;
 748                 break;
 749         default:
 750                 break;
 751         }
 752
 753         switch (a_algo) {
 754         case RTE_CRYPTO_AUTH_AES_GMAC:
 755                 ivlen = 8;
 756                 break;
 757         default:
 758                 break;
 759         }
 760
 761         return ivlen;
 762 }
 763
 764 uint8_t
 765 cnxk_ipsec_icvlen_get(enum rte_crypto_cipher_algorithm c_algo,
 766                       enum rte_crypto_auth_algorithm a_algo,
 767                       enum rte_crypto_aead_algorithm aead_algo)
 768 {
 769         uint8_t icv = 0;
 770
 771         (void)c_algo;
 772
 773         switch (a_algo) {
 774         case RTE_CRYPTO_AUTH_NULL:
 775                 icv = 0;
 776                 break;
 777         case RTE_CRYPTO_AUTH_SHA1_HMAC:
 778                 icv = 12;
 779                 break;
 780         case RTE_CRYPTO_AUTH_SHA256_HMAC:
 781         case RTE_CRYPTO_AUTH_AES_GMAC:
 782                 icv = 16;
 783                 break;
 784         case RTE_CRYPTO_AUTH_SHA384_HMAC:
 785                 icv = 24;
 786                 break;
 787         case RTE_CRYPTO_AUTH_SHA512_HMAC:
 788                 icv = 32;
 789                 break;
 790         default:
 791                 break;
 792         }
 793
 794         switch (aead_algo) {
 795         case RTE_CRYPTO_AEAD_AES_GCM:
 796                 icv = 16;
 797                 break;
 798         default:
 799                 break;
 800         }
 801
 802         return icv;
 803 }
 804
 805 uint8_t
 806 cnxk_ipsec_outb_roundup_byte(enum rte_crypto_cipher_algorithm c_algo,
 807                              enum rte_crypto_aead_algorithm aead_algo)
 808 {
 809         uint8_t roundup_byte = 4;
 810
 811         if (aead_algo == RTE_CRYPTO_AEAD_AES_GCM)
 812                 return roundup_byte;
 813
 814         switch (c_algo) {
 815         case RTE_CRYPTO_CIPHER_AES_CTR:
 816                 roundup_byte = 4;
 817                 break;
 818         case RTE_CRYPTO_CIPHER_AES_CBC:
 819                 roundup_byte = 16;
 820                 break;
 821         case RTE_CRYPTO_CIPHER_3DES_CBC:
 822                 roundup_byte = 8;
 823                 break;
 824         case RTE_CRYPTO_CIPHER_NULL:
 825                 roundup_byte = 4;
 826                 break;
 827         default:
 828                 break;
 829         }
 830
 831         return roundup_byte;
 832 }
 833
 834 int
 835 cnxk_ipsec_outb_rlens_get(struct cnxk_ipsec_outb_rlens *rlens,
 836                           struct rte_security_ipsec_xform *ipsec_xfrm,
 837                           struct rte_crypto_sym_xform *crypto_xfrm)
 838 {
 839         struct rte_security_ipsec_tunnel_param *tunnel = &ipsec_xfrm->tunnel;
 840         enum rte_crypto_cipher_algorithm c_algo = RTE_CRYPTO_CIPHER_NULL;
 841         enum rte_crypto_auth_algorithm a_algo = RTE_CRYPTO_AUTH_NULL;
 842         enum rte_crypto_aead_algorithm aead_algo = 0;
 843         uint16_t partial_len = 0;
 844         uint8_t roundup_byte = 0;
 845         int8_t roundup_len = 0;
 846
 847         memset(rlens, 0, sizeof(struct cnxk_ipsec_outb_rlens));
 848
 849         /* Get Cipher and Auth algo */
 850         if (crypto_xfrm->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 851                 aead_algo = crypto_xfrm->aead.algo;
 852         } else {
 853                 if (crypto_xfrm->type == RTE_CRYPTO_SYM_XFORM_CIPHER)
 854                         c_algo = crypto_xfrm->cipher.algo;
 855                 else
 856                         a_algo = crypto_xfrm->auth.algo;
 857
 858                 if (crypto_xfrm->next) {
 859                         if (crypto_xfrm->next->type ==
 860                             RTE_CRYPTO_SYM_XFORM_CIPHER)
 861                                 c_algo = crypto_xfrm->next->cipher.algo;
 862                         else
 863                                 a_algo = crypto_xfrm->next->auth.algo;
 864                 }
 865         }
 866
 867         if (ipsec_xfrm->proto == RTE_SECURITY_IPSEC_SA_PROTO_ESP) {
 868                 partial_len = ROC_CPT_ESP_HDR_LEN;
 869                 roundup_len = ROC_CPT_ESP_TRL_LEN;
 870         } else {
 871                 partial_len = ROC_CPT_AH_HDR_LEN;
 872         }
 873
 874         if (ipsec_xfrm->mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
 875                 if (tunnel->type == RTE_SECURITY_IPSEC_TUNNEL_IPV4)
 876                         partial_len += ROC_CPT_TUNNEL_IPV4_HDR_LEN;
 877                 else
 878                         partial_len += ROC_CPT_TUNNEL_IPV6_HDR_LEN;
 879         }
 880
 881         partial_len += cnxk_ipsec_ivlen_get(c_algo, a_algo, aead_algo);
 882         partial_len += cnxk_ipsec_icvlen_get(c_algo, a_algo, aead_algo);
 883         roundup_byte = cnxk_ipsec_outb_roundup_byte(c_algo, aead_algo);
 884
 885         if (ipsec_xfrm->options.udp_encap)
 886                 partial_len += sizeof(struct rte_udp_hdr);
 887
 888         rlens->partial_len = partial_len;
 889         rlens->roundup_len = roundup_len;
 890         rlens->roundup_byte = roundup_byte;
 891         rlens->max_extended_len = partial_len + roundup_len + roundup_byte;
 892         return 0;
 893 }