1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(c) 2015-2021 Intel Corporation
5 #ifndef _PMD_AESNI_MB_PRIV_H_
6 #define _PMD_AESNI_MB_PRIV_H_
8 #include <intel-ipsec-mb.h>
10 #if defined(RTE_LIB_SECURITY)
11 #define AESNI_MB_DOCSIS_SEC_ENABLED 1
12 #include <rte_security.h>
13 #include <rte_security_driver.h>
14 #include <rte_ether.h>
17 #include "ipsec_mb_private.h"
19 #define AES_CCM_DIGEST_MIN_LEN 4
20 #define AES_CCM_DIGEST_MAX_LEN 16
21 #define HMAC_MAX_BLOCK_SIZE 128
22 #define HMAC_IPAD_VALUE (0x36)
23 #define HMAC_OPAD_VALUE (0x5C)
25 static const struct rte_cryptodev_capabilities aesni_mb_capabilities[] = {
27 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
29 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
31 .algo = RTE_CRYPTO_AUTH_MD5_HMAC,
48 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
50 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
52 .algo = RTE_CRYPTO_AUTH_SHA1_HMAC,
69 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
71 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
73 .algo = RTE_CRYPTO_AUTH_SHA1,
90 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
92 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
94 .algo = RTE_CRYPTO_AUTH_SHA224_HMAC,
111 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
113 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
115 .algo = RTE_CRYPTO_AUTH_SHA224,
132 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
134 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
136 .algo = RTE_CRYPTO_AUTH_SHA256_HMAC,
153 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
155 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
157 .algo = RTE_CRYPTO_AUTH_SHA256,
174 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
176 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
178 .algo = RTE_CRYPTO_AUTH_SHA384_HMAC,
195 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
197 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
199 .algo = RTE_CRYPTO_AUTH_SHA384,
216 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
218 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
220 .algo = RTE_CRYPTO_AUTH_SHA512_HMAC,
237 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
239 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
241 .algo = RTE_CRYPTO_AUTH_SHA512,
257 { /* AES XCBC HMAC */
258 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
260 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
262 .algo = RTE_CRYPTO_AUTH_AES_XCBC_MAC,
279 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
281 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
283 .algo = RTE_CRYPTO_AUTH_NULL,
299 { /* NULL (CIPHER) */
300 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
302 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
304 .algo = RTE_CRYPTO_CIPHER_NULL,
316 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
318 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
320 .algo = RTE_CRYPTO_CIPHER_AES_CBC,
336 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
338 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
340 .algo = RTE_CRYPTO_CIPHER_AES_CTR,
355 { /* AES DOCSIS BPI */
356 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
358 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
360 .algo = RTE_CRYPTO_CIPHER_AES_DOCSISBPI,
376 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
378 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
380 .algo = RTE_CRYPTO_CIPHER_DES_CBC,
396 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
398 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
400 .algo = RTE_CRYPTO_CIPHER_3DES_CBC,
415 { /* DES DOCSIS BPI */
416 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
418 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
420 .algo = RTE_CRYPTO_CIPHER_DES_DOCSISBPI,
436 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
438 .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
440 .algo = RTE_CRYPTO_AEAD_AES_CCM,
466 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
468 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
470 .algo = RTE_CRYPTO_AUTH_AES_CMAC,
487 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
489 .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
491 .algo = RTE_CRYPTO_AEAD_AES_GCM,
516 { /* AES GMAC (AUTH) */
517 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
519 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
521 .algo = RTE_CRYPTO_AUTH_AES_GMAC,
542 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
544 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
546 .algo = RTE_CRYPTO_CIPHER_AES_ECB,
558 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
560 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
562 .algo = RTE_CRYPTO_AUTH_ZUC_EIA3,
583 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
585 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
587 .algo = RTE_CRYPTO_CIPHER_ZUC_EEA3,
602 { /* SNOW 3G (UIA2) */
603 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
605 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
607 .algo = RTE_CRYPTO_AUTH_SNOW3G_UIA2,
627 { /* SNOW 3G (UEA2) */
628 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
630 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
632 .algo = RTE_CRYPTO_CIPHER_SNOW3G_UEA2,
648 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
650 .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
652 .algo = RTE_CRYPTO_AUTH_KASUMI_F9,
669 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
671 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
673 .algo = RTE_CRYPTO_CIPHER_KASUMI_F8,
688 { /* CHACHA20-POLY1305 */
689 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
691 .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
693 .algo = RTE_CRYPTO_AEAD_CHACHA20_POLY1305,
718 RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
721 uint8_t pmd_driver_id_aesni_mb;
723 struct aesni_mb_qp_data {
724 uint8_t temp_digests[IMB_MAX_JOBS][DIGEST_LENGTH_MAX];
725 /* *< Buffers used to store the digest generated
726 * by the driver when verifying a digest provided
727 * by the user (using authentication verify operation)
731 /* Maximum length for digest */
732 #define DIGEST_LENGTH_MAX 64
733 static const unsigned int auth_blocksize[] = {
736 [IMB_AUTH_HMAC_SHA_1] = 64,
737 [IMB_AUTH_HMAC_SHA_224] = 64,
738 [IMB_AUTH_HMAC_SHA_256] = 64,
739 [IMB_AUTH_HMAC_SHA_384] = 128,
740 [IMB_AUTH_HMAC_SHA_512] = 128,
741 [IMB_AUTH_AES_XCBC] = 16,
742 [IMB_AUTH_AES_CCM] = 16,
743 [IMB_AUTH_AES_CMAC] = 16,
744 [IMB_AUTH_AES_GMAC] = 16,
745 [IMB_AUTH_SHA_1] = 64,
746 [IMB_AUTH_SHA_224] = 64,
747 [IMB_AUTH_SHA_256] = 64,
748 [IMB_AUTH_SHA_384] = 128,
749 [IMB_AUTH_SHA_512] = 128,
750 [IMB_AUTH_ZUC_EIA3_BITLEN] = 16,
751 [IMB_AUTH_SNOW3G_UIA2_BITLEN] = 16,
752 [IMB_AUTH_KASUMI_UIA1] = 16
756 * Get the blocksize in bytes for a specified authentication algorithm
758 * @Note: this function will not return a valid value for a non-valid
759 * authentication algorithm
761 static inline unsigned int
762 get_auth_algo_blocksize(IMB_HASH_ALG algo)
764 return auth_blocksize[algo];
767 static const unsigned int auth_truncated_digest_byte_lengths[] = {
769 [IMB_AUTH_HMAC_SHA_1] = 12,
770 [IMB_AUTH_HMAC_SHA_224] = 14,
771 [IMB_AUTH_HMAC_SHA_256] = 16,
772 [IMB_AUTH_HMAC_SHA_384] = 24,
773 [IMB_AUTH_HMAC_SHA_512] = 32,
774 [IMB_AUTH_AES_XCBC] = 12,
775 [IMB_AUTH_AES_CMAC] = 12,
776 [IMB_AUTH_AES_CCM] = 8,
778 [IMB_AUTH_AES_GMAC] = 12,
779 [IMB_AUTH_SHA_1] = 20,
780 [IMB_AUTH_SHA_224] = 28,
781 [IMB_AUTH_SHA_256] = 32,
782 [IMB_AUTH_SHA_384] = 48,
783 [IMB_AUTH_SHA_512] = 64,
784 [IMB_AUTH_ZUC_EIA3_BITLEN] = 4,
785 [IMB_AUTH_SNOW3G_UIA2_BITLEN] = 4,
786 [IMB_AUTH_KASUMI_UIA1] = 4
790 * Get the IPsec specified truncated length in bytes of the HMAC digest for a
791 * specified authentication algorithm
793 * @Note: this function will not return a valid value for a non-valid
794 * authentication algorithm
796 static inline unsigned int
797 get_truncated_digest_byte_length(IMB_HASH_ALG algo)
799 return auth_truncated_digest_byte_lengths[algo];
802 static const unsigned int auth_digest_byte_lengths[] = {
804 [IMB_AUTH_HMAC_SHA_1] = 20,
805 [IMB_AUTH_HMAC_SHA_224] = 28,
806 [IMB_AUTH_HMAC_SHA_256] = 32,
807 [IMB_AUTH_HMAC_SHA_384] = 48,
808 [IMB_AUTH_HMAC_SHA_512] = 64,
809 [IMB_AUTH_AES_XCBC] = 16,
810 [IMB_AUTH_AES_CMAC] = 16,
811 [IMB_AUTH_AES_CCM] = 16,
812 [IMB_AUTH_AES_GMAC] = 16,
814 [IMB_AUTH_SHA_1] = 20,
815 [IMB_AUTH_SHA_224] = 28,
816 [IMB_AUTH_SHA_256] = 32,
817 [IMB_AUTH_SHA_384] = 48,
818 [IMB_AUTH_SHA_512] = 64,
819 [IMB_AUTH_ZUC_EIA3_BITLEN] = 4,
820 [IMB_AUTH_SNOW3G_UIA2_BITLEN] = 4,
821 [IMB_AUTH_KASUMI_UIA1] = 4
822 /**< Vector mode dependent pointer table of the multi-buffer APIs */
827 * Get the full digest size in bytes for a specified authentication algorithm
828 * (if available in the Multi-buffer library)
830 * @Note: this function will not return a valid value for a non-valid
831 * authentication algorithm
833 static inline unsigned int
834 get_digest_byte_length(IMB_HASH_ALG algo)
836 return auth_digest_byte_lengths[algo];
839 /** AES-NI multi-buffer private session structure */
840 struct aesni_mb_session {
841 IMB_CIPHER_MODE cipher_mode;
842 IMB_CIPHER_DIRECTION cipher_direction;
843 IMB_HASH_ALG hash_alg;
844 IMB_CHAIN_ORDER chain_order;
845 /* common job fields */
857 /* * Cipher Parameters
860 /* * Cipher direction - encrypt / decrypt */
861 IMB_CIPHER_DIRECTION direction;
862 /* * Cipher mode - CBC / Counter */
863 IMB_CIPHER_MODE mode;
865 uint64_t key_length_in_bytes;
869 uint32_t encode[60] __rte_aligned(16);
871 uint32_t decode[60] __rte_aligned(16);
874 /* *< Expanded AES keys - Allocating space to
875 * contain the maximum expanded key size which
876 * is 240 bytes for 256 bit AES, calculate by:
877 * ((key size (bytes)) *
878 * ((number of rounds) + 1))
881 const void *ks_ptr[3];
884 /* *< Expanded 3DES keys */
886 struct gcm_key_data gcm_key;
887 /* *< Expanded GCM key */
888 uint8_t zuc_cipher_key[32];
889 /* *< ZUC cipher key */
890 snow3g_key_schedule_t pKeySched_snow3g_cipher;
891 /* *< SNOW3G scheduled cipher key */
892 kasumi_key_sched_t pKeySched_kasumi_cipher;
893 /* *< KASUMI scheduled cipher key */
897 /* *< Authentication Parameters */
899 IMB_HASH_ALG algo; /* *< Authentication Algorithm */
900 enum rte_crypto_auth_operation operation;
901 /* *< auth operation generate or verify */
904 uint8_t inner[128] __rte_aligned(16);
906 uint8_t outer[128] __rte_aligned(16);
909 /* *< HMAC Authentication pads -
910 * allocating space for the maximum pad
911 * size supported which is 128 bytes for
916 uint32_t k1_expanded[44] __rte_aligned(16);
917 /* *< k1 (expanded key). */
918 uint8_t k2[16] __rte_aligned(16);
920 uint8_t k3[16] __rte_aligned(16);
925 uint32_t expkey[60] __rte_aligned(16);
926 /* *< k1 (expanded key). */
927 uint32_t skey1[4] __rte_aligned(16);
929 uint32_t skey2[4] __rte_aligned(16);
932 /* *< Expanded XCBC authentication keys */
933 uint8_t zuc_auth_key[32];
934 /* *< ZUC authentication key */
935 snow3g_key_schedule_t pKeySched_snow3g_auth;
936 /* *< SNOW3G scheduled authentication key */
937 kasumi_key_sched_t pKeySched_kasumi_auth;
938 /* *< KASUMI scheduled authentication key */
940 /* * Generated digest size by the Multi-buffer library */
941 uint16_t gen_digest_len;
942 /* * Requested digest size from Cryptodev */
943 uint16_t req_digest_len;
947 /* * AAD data length */
950 } __rte_cache_aligned;
952 typedef void (*hash_one_block_t)(const void *data, void *digest);
953 typedef void (*aes_keyexp_t)(const void *key, void *enc_exp_keys,
956 #ifdef AESNI_MB_DOCSIS_SEC_ENABLED
957 static const struct rte_cryptodev_capabilities
958 aesni_mb_pmd_security_crypto_cap[] = {
959 { /* AES DOCSIS BPI */
960 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
962 .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
964 .algo = RTE_CRYPTO_CIPHER_AES_DOCSISBPI,
980 RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
983 static const struct rte_security_capability aesni_mb_pmd_security_cap[] = {
984 { /* DOCSIS Uplink */
985 .action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
986 .protocol = RTE_SECURITY_PROTOCOL_DOCSIS,
988 .direction = RTE_SECURITY_DOCSIS_UPLINK
990 .crypto_capabilities = aesni_mb_pmd_security_crypto_cap
992 { /* DOCSIS Downlink */
993 .action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
994 .protocol = RTE_SECURITY_PROTOCOL_DOCSIS,
996 .direction = RTE_SECURITY_DOCSIS_DOWNLINK
998 .crypto_capabilities = aesni_mb_pmd_security_crypto_cap
1001 .action = RTE_SECURITY_ACTION_TYPE_NONE
1006 #endif /* _PMD_AESNI_MB_PRIV_H_ */