crypto/cnxk: support AES-XCBC and null cipher

Add support for AES XCBC and NULL cipher.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>

diff --git a/doc/guides/cryptodevs/cnxk.rst b/doc/guides/cryptodevs/cnxk.rst
index 1239155fb2506f697ad3dec93413f3e356c9d4f5..6e844f54ec2c9d6b1a170437414d06b949851bbe 100644 (file)
--- a/doc/guides/cryptodevs/cnxk.rst
+++ b/doc/guides/cryptodevs/cnxk.rst
@@ -260,6 +260,7 @@ AEAD algorithms
 Cipher algorithms
 +++++++++++++++++
 
+* NULL
 * AES-128/192/256-CBC
 * AES-128/192/256-CTR
 
@@ -270,6 +271,7 @@ Auth algorithms
 * SHA256-128-HMAC
 * SHA384-192-HMAC
 * SHA512-256-HMAC
+* AES-XCBC-96
 
 CN10XX Features supported
 ~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -288,6 +290,7 @@ AEAD algorithms
 Cipher algorithms
 +++++++++++++++++
 
+* NULL
 * AES-128/192/256-CBC
 * AES-128/192/256-CTR
 
@@ -299,3 +302,4 @@ Auth algorithms
 * SHA256-128-HMAC
 * SHA384-192-HMAC
 * SHA512-256-HMAC
+* AES-XCBC-96

diff --git a/doc/guides/rel_notes/release_22_03.rst b/doc/guides/rel_notes/release_22_03.rst
index bfb5377cf86722ef6c0bbbcae4bb90b0a6b04cfc..f4579884ba6666b4bedf95ec953c2eb7604e4593 100644 (file)
--- a/doc/guides/rel_notes/release_22_03.rst
+++ b/doc/guides/rel_notes/release_22_03.rst
@@ -61,6 +61,8 @@ New Features
   * Added SHA384-HMAC support in lookaside protocol (IPsec) for CN9K & CN10K.
   * Added SHA512-HMAC support in lookaside protocol (IPsec) for CN9K & CN10K.
   * Added AES-CTR support in lookaside protocol (IPsec) for CN9K & CN10K.
+  * Added NULL cipher support in lookaside protocol (IPsec) for CN9K & CN10K.
+  * Added AES-XCBC support in lookaside protocol (IPsec) for CN9K & CN10K.
 
 * **Added an API to retrieve event port id of ethdev Rx adapter.**
 

diff --git a/drivers/common/cnxk/cnxk_security.c b/drivers/common/cnxk/cnxk_security.c
index 0d4baa942ef90f55d85ebb6ca3d0cdda0639cb09..6ebf0846f5c437036d26aa672e7a63b839008fed 100644 (file)
--- a/drivers/common/cnxk/cnxk_security.c
+++ b/drivers/common/cnxk/cnxk_security.c
@@ -120,6 +120,9 @@ ot_ipsec_sa_common_param_fill(union roc_ot_ipsec_sa_word2 *w2,
                }
        } else {
                switch (cipher_xfrm->cipher.algo) {
+               case RTE_CRYPTO_CIPHER_NULL:
+                       w2->s.enc_type = ROC_IE_OT_SA_ENC_NULL;
+                       break;
                case RTE_CRYPTO_CIPHER_AES_CBC:
                        w2->s.enc_type = ROC_IE_OT_SA_ENC_AES_CBC;
                        break;
@@ -146,11 +149,19 @@ ot_ipsec_sa_common_param_fill(union roc_ot_ipsec_sa_word2 *w2,
                case RTE_CRYPTO_AUTH_SHA512_HMAC:
                        w2->s.auth_type = ROC_IE_OT_SA_AUTH_SHA2_512;
                        break;
+               case RTE_CRYPTO_AUTH_AES_XCBC_MAC:
+                       w2->s.auth_type = ROC_IE_OT_SA_AUTH_AES_XCBC_128;
+                       break;
                default:
                        return -ENOTSUP;
                }
 
-               ipsec_hmac_opad_ipad_gen(auth_xfrm, hmac_opad_ipad);
+               if (auth_xfrm->auth.algo == RTE_CRYPTO_AUTH_AES_XCBC_MAC) {
+                       const uint8_t *auth_key = auth_xfrm->auth.key.data;
+                       roc_aes_xcbc_key_derive(auth_key, hmac_opad_ipad);
+               } else {
+                       ipsec_hmac_opad_ipad_gen(auth_xfrm, hmac_opad_ipad);
+               }
 
                tmp_key = (uint64_t *)hmac_opad_ipad;
                for (i = 0;
@@ -174,18 +185,26 @@ ot_ipsec_sa_common_param_fill(union roc_ot_ipsec_sa_word2 *w2,
        for (i = 0; i < (int)(ROC_CTX_MAX_CKEY_LEN / sizeof(uint64_t)); i++)
                tmp_key[i] = rte_be_to_cpu_64(tmp_key[i]);
 
-       switch (length) {
-       case ROC_CPT_AES128_KEY_LEN:
-               w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
-               break;
-       case ROC_CPT_AES192_KEY_LEN:
-               w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
-               break;
-       case ROC_CPT_AES256_KEY_LEN:
-               w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
-               break;
-       default:
-               return -EINVAL;
+       /* Set AES key length */
+       if (w2->s.enc_type == ROC_IE_OT_SA_ENC_AES_CBC ||
+           w2->s.enc_type == ROC_IE_OT_SA_ENC_AES_CCM ||
+           w2->s.enc_type == ROC_IE_OT_SA_ENC_AES_CTR ||
+           w2->s.enc_type == ROC_IE_OT_SA_ENC_AES_GCM ||
+           w2->s.auth_type == ROC_IE_OT_SA_AUTH_AES_GMAC) {
+               switch (length) {
+               case ROC_CPT_AES128_KEY_LEN:
+                       w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
+                       break;
+               case ROC_CPT_AES192_KEY_LEN:
+                       w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
+                       break;
+               case ROC_CPT_AES256_KEY_LEN:
+                       w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
+                       break;
+               default:
+                       plt_err("Invalid AES key length");
+                       return -EINVAL;
+               }
        }
 
        if (ipsec_xfrm->life.packets_soft_limit != 0 ||
@@ -815,6 +834,9 @@ cnxk_ipsec_icvlen_get(enum rte_crypto_cipher_algorithm c_algo,
        case RTE_CRYPTO_AUTH_SHA512_HMAC:
                icv = 32;
                break;
+       case RTE_CRYPTO_AUTH_AES_XCBC_MAC:
+               icv = 12;
+               break;
        default:
                break;
        }

diff --git a/drivers/common/cnxk/roc_ie_on.h b/drivers/common/cnxk/roc_ie_on.h
index 817ef33c521a4ee7896f76181bfcef39e4313141..cb56a707b3d707e512b718216d09b150a0f992c1 100644 (file)
--- a/drivers/common/cnxk/roc_ie_on.h
+++ b/drivers/common/cnxk/roc_ie_on.h
@@ -180,6 +180,11 @@ struct roc_ie_on_outb_sa {
                        uint8_t unused[24];
                        struct roc_ie_on_ip_template template;
                } sha1;
+               struct {
+                       uint8_t key[16];
+                       uint8_t unused[32];
+                       struct roc_ie_on_ip_template template;
+               } aes_xcbc;
                struct {
                        uint8_t hmac_key[64];
                        uint8_t hmac_iv[64];
@@ -201,6 +206,11 @@ struct roc_ie_on_inb_sa {
                        uint8_t hmac_key[48];
                        struct roc_ie_on_traffic_selector selector;
                } sha1_or_gcm;
+               struct {
+                       uint8_t key[16];
+                       uint8_t unused[32];
+                       struct roc_ie_on_traffic_selector selector;
+               } aes_xcbc;
                struct {
                        uint8_t hmac_key[64];
                        uint8_t hmac_iv[64];

diff --git a/drivers/crypto/cnxk/cn9k_ipsec.c b/drivers/crypto/cnxk/cn9k_ipsec.c
index 1e2269ccc89741426c1e3c7c4d3b741f11b88e51..c9f58255102ab9c6f2ff54f842cd600e499035c6 100644 (file)
--- a/drivers/crypto/cnxk/cn9k_ipsec.c
+++ b/drivers/crypto/cnxk/cn9k_ipsec.c
@@ -118,7 +118,7 @@ ipsec_sa_ctl_set(struct rte_security_ipsec_xform *ipsec,
                 struct roc_ie_on_sa_ctl *ctl)
 {
        struct rte_crypto_sym_xform *cipher_xform, *auth_xform;
-       int aes_key_len;
+       int aes_key_len = 0;
 
        if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
                ctl->direction = ROC_IE_SA_DIR_OUTBOUND;
@@ -157,37 +157,33 @@ ipsec_sa_ctl_set(struct rte_security_ipsec_xform *ipsec,
                return -EINVAL;
 
        if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
-               if (crypto_xform->aead.algo == RTE_CRYPTO_AEAD_AES_GCM) {
+               switch (crypto_xform->aead.algo) {
+               case RTE_CRYPTO_AEAD_AES_GCM:
                        ctl->enc_type = ROC_IE_ON_SA_ENC_AES_GCM;
                        aes_key_len = crypto_xform->aead.key.length;
-               } else {
+                       break;
+               default:
+                       plt_err("Unsupported AEAD algorithm");
                        return -ENOTSUP;
                }
-       } else if (cipher_xform->cipher.algo == RTE_CRYPTO_CIPHER_AES_CBC) {
-               ctl->enc_type = ROC_IE_ON_SA_ENC_AES_CBC;
-               aes_key_len = cipher_xform->cipher.key.length;
-       } else if (cipher_xform->cipher.algo == RTE_CRYPTO_CIPHER_AES_CTR) {
-               ctl->enc_type = ROC_IE_ON_SA_ENC_AES_CTR;
-               aes_key_len = cipher_xform->cipher.key.length;
        } else {
-               return -ENOTSUP;
-       }
-
-       switch (aes_key_len) {
-       case 16:
-               ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
-               break;
-       case 24:
-               ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
-               break;
-       case 32:
-               ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
-               break;
-       default:
-               return -EINVAL;
-       }
+               switch (cipher_xform->cipher.algo) {
+               case RTE_CRYPTO_CIPHER_NULL:
+                       ctl->enc_type = ROC_IE_ON_SA_ENC_NULL;
+                       break;
+               case RTE_CRYPTO_CIPHER_AES_CBC:
+                       ctl->enc_type = ROC_IE_ON_SA_ENC_AES_CBC;
+                       aes_key_len = cipher_xform->cipher.key.length;
+                       break;
+               case RTE_CRYPTO_CIPHER_AES_CTR:
+                       ctl->enc_type = ROC_IE_ON_SA_ENC_AES_CTR;
+                       aes_key_len = cipher_xform->cipher.key.length;
+                       break;
+               default:
+                       plt_err("Unsupported cipher algorithm");
+                       return -ENOTSUP;
+               }
 
-       if (crypto_xform->type != RTE_CRYPTO_SYM_XFORM_AEAD) {
                switch (auth_xform->auth.algo) {
                case RTE_CRYPTO_AUTH_NULL:
                        ctl->auth_type = ROC_IE_ON_SA_AUTH_NULL;
@@ -217,10 +213,33 @@ ipsec_sa_ctl_set(struct rte_security_ipsec_xform *ipsec,
                        ctl->auth_type = ROC_IE_ON_SA_AUTH_AES_XCBC_128;
                        break;
                default:
+                       plt_err("Unsupported auth algorithm");
                        return -ENOTSUP;
                }
        }
 
+       /* Set AES key length */
+       if (ctl->enc_type == ROC_IE_ON_SA_ENC_AES_CBC ||
+           ctl->enc_type == ROC_IE_ON_SA_ENC_AES_CCM ||
+           ctl->enc_type == ROC_IE_ON_SA_ENC_AES_CTR ||
+           ctl->enc_type == ROC_IE_ON_SA_ENC_AES_GCM ||
+           ctl->auth_type == ROC_IE_ON_SA_AUTH_AES_GMAC) {
+               switch (aes_key_len) {
+               case 16:
+                       ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
+                       break;
+               case 24:
+                       ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
+                       break;
+               case 32:
+                       ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
+                       break;
+               default:
+                       plt_err("Invalid AES key length");
+                       return -EINVAL;
+               }
+       }
+
        if (ipsec->options.esn)
                ctl->esn_en = 1;
 
@@ -267,8 +286,6 @@ fill_ipsec_common_sa(struct rte_security_ipsec_xform *ipsec,
 
        if (cipher_key_len != 0)
                memcpy(common_sa->cipher_key, cipher_key, cipher_key_len);
-       else
-               return -EINVAL;
 
        return 0;
 }
@@ -337,7 +354,13 @@ cn9k_ipsec_outb_sa_create(struct cnxk_cpt_qp *qp,
                        ctx_len = offsetof(struct roc_ie_on_outb_sa,
                                           sha2.template);
                        break;
+               case ROC_IE_ON_SA_AUTH_AES_XCBC_128:
+                       template = &out_sa->aes_xcbc.template;
+                       ctx_len = offsetof(struct roc_ie_on_outb_sa,
+                                          aes_xcbc.template);
+                       break;
                default:
+                       plt_err("Unsupported auth algorithm");
                        return -EINVAL;
                }
        }
@@ -419,6 +442,9 @@ cn9k_ipsec_outb_sa_create(struct cnxk_cpt_qp *qp,
                case RTE_CRYPTO_AUTH_SHA512_HMAC:
                        memcpy(out_sa->sha2.hmac_key, auth_key, auth_key_len);
                        break;
+               case RTE_CRYPTO_AUTH_AES_XCBC_MAC:
+                       memcpy(out_sa->aes_xcbc.key, auth_key, auth_key_len);
+                       break;
                default:
                        plt_err("Unsupported auth algorithm %u",
                                auth_xform->auth.algo);
@@ -505,6 +531,11 @@ cn9k_ipsec_inb_sa_create(struct cnxk_cpt_qp *qp,
                        ctx_len = offsetof(struct roc_ie_on_inb_sa,
                                           sha2.selector);
                        break;
+               case RTE_CRYPTO_AUTH_AES_XCBC_MAC:
+                       memcpy(in_sa->aes_xcbc.key, auth_key, auth_key_len);
+                       ctx_len = offsetof(struct roc_ie_on_inb_sa,
+                                          aes_xcbc.selector);
+                       break;
                default:
                        plt_err("Unsupported auth algorithm %u",
                                auth_xform->auth.algo);
@@ -597,6 +628,12 @@ cn9k_ipsec_xform_verify(struct rte_security_ipsec_xform *ipsec,
                                plt_err("Transport mode AES-CBC SHA2 HMAC 512 is not supported");
                                return -ENOTSUP;
                        }
+
+                       if ((cipher->algo == RTE_CRYPTO_CIPHER_AES_CBC) &&
+                           (auth->algo == RTE_CRYPTO_AUTH_AES_XCBC_MAC)) {
+                               plt_err("Transport mode AES-CBC AES-XCBC is not supported");
+                               return -ENOTSUP;
+                       }
                }
        }
 

diff --git a/drivers/crypto/cnxk/cnxk_cryptodev.h b/drivers/crypto/cnxk/cnxk_cryptodev.h
index 4a1e377580fc302968d7ba62ff735aab7fa72be9..16e757283ca38c87d2e2c1f92eb10c8ad7172535 100644 (file)
--- a/drivers/crypto/cnxk/cnxk_cryptodev.h
+++ b/drivers/crypto/cnxk/cnxk_cryptodev.h
@@ -11,7 +11,7 @@
 #include "roc_cpt.h"
 
 #define CNXK_CPT_MAX_CAPS       34
-#define CNXK_SEC_CRYPTO_MAX_CAPS 9
+#define CNXK_SEC_CRYPTO_MAX_CAPS 11
 #define CNXK_SEC_MAX_CAPS       5
 #define CNXK_AE_EC_ID_MAX       8
 /**

diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c b/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c
index fae433e9aa57a8a28c1ad2b484cf312bde7fc6d3..a0b2a1f5896877b50b46d60c56a1635f233472e9 100644 (file)
--- a/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c
@@ -794,6 +794,26 @@ static const struct rte_cryptodev_capabilities sec_caps_aes[] = {
                        }, }
                }, }
        },
+       {       /* AES-XCBC */
+               .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
+               { .sym = {
+                       .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
+                       {.auth = {
+                               .algo = RTE_CRYPTO_AUTH_AES_XCBC_MAC,
+                               .block_size = 16,
+                               .key_size = {
+                                       .min = 16,
+                                       .max = 16,
+                                       .increment = 0
+                               },
+                               .digest_size = {
+                                       .min = 12,
+                                       .max = 12,
+                                       .increment = 0,
+                               },
+                       }, }
+               }, }
+       },
 };
 
 static const struct rte_cryptodev_capabilities sec_caps_sha1_sha2[] = {
@@ -879,6 +899,29 @@ static const struct rte_cryptodev_capabilities sec_caps_sha1_sha2[] = {
        },
 };
 
+static const struct rte_cryptodev_capabilities sec_caps_null[] = {
+       {       /* NULL (CIPHER) */
+               .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
+               {.sym = {
+                       .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
+                       {.cipher = {
+                               .algo = RTE_CRYPTO_CIPHER_NULL,
+                               .block_size = 1,
+                               .key_size = {
+                                       .min = 0,
+                                       .max = 0,
+                                       .increment = 0
+                               },
+                               .iv_size = {
+                                       .min = 0,
+                                       .max = 0,
+                                       .increment = 0
+                               }
+                       }, },
+               }, }
+       },
+};
+
 static const struct rte_security_capability sec_caps_templ[] = {
        {       /* IPsec Lookaside Protocol ESP Tunnel Ingress */
                .action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
@@ -1069,6 +1112,8 @@ sec_crypto_caps_populate(struct rte_cryptodev_capabilities cnxk_caps[],
        else
                cn9k_sec_crypto_caps_update(cnxk_caps);
 
+       sec_caps_add(cnxk_caps, &cur_pos, sec_caps_null,
+                    RTE_DIM(sec_caps_null));
        sec_caps_add(cnxk_caps, &cur_pos, caps_end, RTE_DIM(caps_end));
 }
 

diff --git a/drivers/crypto/cnxk/cnxk_ipsec.h b/drivers/crypto/cnxk/cnxk_ipsec.h
index f5a51b526d5a1726ad15bae3902036a3a7259c2b..f50d9faaa54f6780adf5dc71c0b0c6aa411be08a 100644 (file)
--- a/drivers/crypto/cnxk/cnxk_ipsec.h
+++ b/drivers/crypto/cnxk/cnxk_ipsec.h
@@ -20,6 +20,9 @@ struct cnxk_cpt_inst_tmpl {
 static inline int
 ipsec_xform_cipher_verify(struct rte_crypto_sym_xform *crypto_xform)
 {
+       if (crypto_xform->cipher.algo == RTE_CRYPTO_CIPHER_NULL)
+               return 0;
+
        if (crypto_xform->cipher.algo == RTE_CRYPTO_CIPHER_AES_CBC ||
            crypto_xform->cipher.algo == RTE_CRYPTO_CIPHER_AES_CTR) {
                switch (crypto_xform->cipher.key.length) {
@@ -58,6 +61,10 @@ ipsec_xform_auth_verify(struct rte_crypto_sym_xform *crypto_xform)
                        return 0;
        }
 
+       if (crypto_xform->auth.algo == RTE_CRYPTO_AUTH_AES_XCBC_MAC &&
+           keylen == ROC_CPT_AES_XCBC_KEY_LENGTH)
+               return 0;
+
        return -ENOTSUP;
 }