@@ -35,6 +35,9 @@ endif
ifeq ($(CONFIG_RTE_LIBRTE_PMD_QAT_SYM),y)
LDLIBS += -lrte_cryptodev
LDLIBS += -lcrypto
+ifeq ($(CONFIG_RTE_LIBRTE_SECURITY),y)
+ LDLIBS += -lrte_net
+endif
CFLAGS += -DBUILD_QAT_SYM
SRCS-y += qat_sym.c
SRCS-y += qat_sym_session.c
@@ -8,6 +8,8 @@ reason = '' # sentinal value to suppress printout
dep = dependency('libcrypto', required: false)
qat_includes += include_directories('.')
qat_deps += 'cryptodev'
+qat_deps += 'net'
+qat_deps += 'security'
if dep.found()
# Add our sources files to the list
qat_sources += files('qat_sym_pmd.c',
@@ -9,6 +9,9 @@
#include <rte_crypto_sym.h>
#include <rte_bus_pci.h>
#include <rte_byteorder.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_net_crc.h>
+#endif
#include "qat_sym.h"
@@ -44,11 +47,10 @@ bpi_cipher_decrypt(uint8_t *src, uint8_t *dst,
static inline uint32_t
-qat_bpicipher_preprocess(struct qat_sym_session *ctx,
- struct rte_crypto_op *op)
+qat_bpicipher_preprocess(struct qat_sym_session *ctx, struct rte_crypto_op *op,
+ struct rte_crypto_sym_op *sym_op)
{
int block_len = qat_cipher_get_block_size(ctx->qat_cipher_alg);
- struct rte_crypto_sym_op *sym_op = op->sym;
uint8_t last_block_len = block_len > 0 ?
sym_op->cipher.data.length % block_len : 0;
@@ -99,6 +101,29 @@ qat_bpicipher_preprocess(struct qat_sym_session *ctx,
return sym_op->cipher.data.length - last_block_len;
}
+#ifdef RTE_LIBRTE_SECURITY
+static inline void
+qat_crc_generate(struct qat_sym_session *ctx,
+ struct rte_security_docsis_op *doc_op,
+ struct rte_crypto_sym_op *sym_op)
+{
+ uint8_t *crc_data;
+ uint32_t *crc;
+
+ if (ctx->qat_dir == ICP_QAT_HW_CIPHER_ENCRYPT &&
+ doc_op != NULL &&
+ doc_op->crc.length != 0) {
+
+ crc_data = (uint8_t *) rte_pktmbuf_mtod_offset(
+ sym_op->m_src, uint8_t *,
+ doc_op->crc.offset);
+ crc = (uint32_t *)(crc_data + doc_op->crc.length);
+ *crc = rte_net_crc_calc(crc_data, doc_op->crc.length,
+ RTE_NET_CRC32_ETH);
+ }
+}
+#endif
+
static inline void
set_cipher_iv(uint16_t iv_length, uint16_t iv_offset,
struct icp_qat_fw_la_cipher_req_params *cipher_param,
@@ -162,25 +187,56 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
uint8_t do_sgl = 0;
uint8_t in_place = 1;
int alignment_adjustment = 0;
+ struct rte_crypto_sym_op *sym;
+#ifdef RTE_LIBRTE_SECURITY
+ struct rte_security_op *sec_op;
+ struct rte_security_docsis_op *doc_op = NULL;
+#endif
+
struct rte_crypto_op *op = (struct rte_crypto_op *)in_op;
struct qat_sym_op_cookie *cookie =
(struct qat_sym_op_cookie *)op_cookie;
- if (unlikely(op->type != RTE_CRYPTO_OP_TYPE_SYMMETRIC)) {
- QAT_DP_LOG(ERR, "QAT PMD only supports symmetric crypto "
- "operation requests, op (%p) is not a "
- "symmetric operation.", op);
- return -EINVAL;
- }
-
if (unlikely(op->sess_type == RTE_CRYPTO_OP_SESSIONLESS)) {
QAT_DP_LOG(ERR, "QAT PMD only supports session oriented"
" requests, op (%p) is sessionless.", op);
return -EINVAL;
}
- ctx = (struct qat_sym_session *)get_sym_session_private_data(
- op->sym->session, cryptodev_qat_driver_id);
+ if (likely(op->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
+ op->sess_type == RTE_CRYPTO_OP_WITH_SESSION)) {
+ sym = op->sym;
+ ctx = (struct qat_sym_session *)get_sym_session_private_data(
+ sym->session, cryptodev_qat_driver_id);
+#ifdef RTE_LIBRTE_SECURITY
+ } else if (op->type == RTE_CRYPTO_OP_TYPE_SECURITY &&
+ op->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) {
+ sec_op = (struct rte_security_op *)&op->security;
+ if (sec_op->type == RTE_SECURITY_OP_TYPE_DOCSIS) {
+ doc_op = &sec_op->docsis;
+ sym = &doc_op->crypto_sym;
+ ctx = (struct qat_sym_session *)
+ get_sec_session_private_data(sym->sec_session);
+ } else {
+ QAT_DP_LOG(ERR, "QAT PMD only supports security"
+ " operation requests for DOCSIS, op"
+ " (%p) is not for DOCSIS.", op);
+ return -EINVAL;
+ }
+#endif
+ } else {
+ QAT_DP_LOG(ERR, "QAT PMD only supports symmetric crypto "
+ "%soperation requests, op (%p) is not a "
+ "symmetric %soperation or the associated "
+ "session type is invalid.",
+#ifdef RTE_LIBRTE_SECURITY
+ "and security ", op, "or security "
+#else
+ "", op, ""
+#endif
+ );
+ return -EINVAL;
+ }
if (unlikely(ctx == NULL)) {
QAT_DP_LOG(ERR, "Session was not created for this device");
@@ -231,27 +287,34 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
ICP_QAT_HW_CIPHER_ALGO_ZUC_3G_128_EEA3) {
if (unlikely(
- (op->sym->cipher.data.length % BYTE_LENGTH != 0) ||
- (op->sym->cipher.data.offset % BYTE_LENGTH != 0))) {
+ (sym->cipher.data.length % BYTE_LENGTH != 0) ||
+ (sym->cipher.data.offset % BYTE_LENGTH != 0))) {
QAT_DP_LOG(ERR,
"SNOW3G/KASUMI/ZUC in QAT PMD only supports byte aligned values");
op->status = RTE_CRYPTO_OP_STATUS_INVALID_ARGS;
return -EINVAL;
}
- cipher_len = op->sym->cipher.data.length >> 3;
- cipher_ofs = op->sym->cipher.data.offset >> 3;
+ cipher_len = sym->cipher.data.length >> 3;
+ cipher_ofs = sym->cipher.data.offset >> 3;
} else if (ctx->bpi_ctx) {
- /* DOCSIS - only send complete blocks to device
+ /* DOCSIS processing */
+
+#ifdef RTE_LIBRTE_SECURITY
+ /* Calculate CRC */
+ qat_crc_generate(ctx, doc_op, sym);
+#endif
+
+ /* Only send complete blocks to device.
* Process any partial block using CFB mode.
* Even if 0 complete blocks, still send this to device
* to get into rx queue for post-process and dequeuing
*/
- cipher_len = qat_bpicipher_preprocess(ctx, op);
- cipher_ofs = op->sym->cipher.data.offset;
+ cipher_len = qat_bpicipher_preprocess(ctx, op, sym);
+ cipher_ofs = sym->cipher.data.offset;
} else {
- cipher_len = op->sym->cipher.data.length;
- cipher_ofs = op->sym->cipher.data.offset;
+ cipher_len = sym->cipher.data.length;
+ cipher_ofs = sym->cipher.data.offset;
}
set_cipher_iv(ctx->cipher_iv.length, ctx->cipher_iv.offset,
@@ -428,58 +491,58 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
min_ofs = op->sym->aead.data.offset;
}
- if (op->sym->m_src->nb_segs > 1 ||
- (op->sym->m_dst && op->sym->m_dst->nb_segs > 1))
+ if (sym->m_src->nb_segs > 1 ||
+ (sym->m_dst && sym->m_dst->nb_segs > 1))
do_sgl = 1;
/* adjust for chain case */
if (do_cipher && do_auth)
min_ofs = cipher_ofs < auth_ofs ? cipher_ofs : auth_ofs;
- if (unlikely(min_ofs >= rte_pktmbuf_data_len(op->sym->m_src) && do_sgl))
+ if (unlikely(min_ofs >= rte_pktmbuf_data_len(sym->m_src) && do_sgl))
min_ofs = 0;
- if (unlikely((op->sym->m_dst != NULL) &&
- (op->sym->m_dst != op->sym->m_src))) {
+ if (unlikely((sym->m_dst != NULL) &&
+ (sym->m_dst != sym->m_src))) {
/* Out-of-place operation (OOP)
* Don't align DMA start. DMA the minimum data-set
* so as not to overwrite data in dest buffer
*/
in_place = 0;
src_buf_start =
- rte_pktmbuf_iova_offset(op->sym->m_src, min_ofs);
+ rte_pktmbuf_iova_offset(sym->m_src, min_ofs);
dst_buf_start =
- rte_pktmbuf_iova_offset(op->sym->m_dst, min_ofs);
+ rte_pktmbuf_iova_offset(sym->m_dst, min_ofs);
} else {
/* In-place operation
* Start DMA at nearest aligned address below min_ofs
*/
src_buf_start =
- rte_pktmbuf_iova_offset(op->sym->m_src, min_ofs)
+ rte_pktmbuf_iova_offset(sym->m_src, min_ofs)
& QAT_64_BTYE_ALIGN_MASK;
- if (unlikely((rte_pktmbuf_iova(op->sym->m_src) -
- rte_pktmbuf_headroom(op->sym->m_src))
+ if (unlikely((rte_pktmbuf_iova(sym->m_src) -
+ rte_pktmbuf_headroom(sym->m_src))
> src_buf_start)) {
/* alignment has pushed addr ahead of start of mbuf
* so revert and take the performance hit
*/
src_buf_start =
- rte_pktmbuf_iova_offset(op->sym->m_src,
+ rte_pktmbuf_iova_offset(sym->m_src,
min_ofs);
}
dst_buf_start = src_buf_start;
/* remember any adjustment for later, note, can be +/- */
alignment_adjustment = src_buf_start -
- rte_pktmbuf_iova_offset(op->sym->m_src, min_ofs);
+ rte_pktmbuf_iova_offset(sym->m_src, min_ofs);
}
if (do_cipher || do_aead) {
cipher_param->cipher_offset =
(uint32_t)rte_pktmbuf_iova_offset(
- op->sym->m_src, cipher_ofs) - src_buf_start;
+ sym->m_src, cipher_ofs) - src_buf_start;
cipher_param->cipher_length = cipher_len;
} else {
cipher_param->cipher_offset = 0;
@@ -557,8 +620,8 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
ICP_QAT_FW_COMN_PTR_TYPE_SET(qat_req->comn_hdr.comn_req_flags,
QAT_COMN_PTR_TYPE_SGL);
- ret = qat_sgl_fill_array(op->sym->m_src,
- (int64_t)(src_buf_start - rte_pktmbuf_iova(op->sym->m_src)),
+ ret = qat_sgl_fill_array(sym->m_src,
+ (int64_t)(src_buf_start - rte_pktmbuf_iova(sym->m_src)),
&cookie->qat_sgl_src,
qat_req->comn_mid.src_length,
QAT_SYM_SGL_MAX_NUMBER);
@@ -599,9 +662,9 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
/* Handle Single-Pass GCM */
if (ctx->is_single_pass) {
- cipher_param->spc_aad_addr = op->sym->aead.aad.phys_addr;
+ cipher_param->spc_aad_addr = sym->aead.aad.phys_addr;
cipher_param->spc_auth_res_addr =
- op->sym->aead.digest.phys_addr;
+ sym->aead.digest.phys_addr;
}
#if RTE_LOG_DP_LEVEL >= RTE_LOG_DEBUG
@@ -6,6 +6,9 @@
#define _QAT_SYM_H_
#include <rte_cryptodev_pmd.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_net_crc.h>
+#endif
#ifdef BUILD_QAT_SYM
#include <openssl/evp.h>
@@ -76,10 +79,10 @@ bpi_cipher_encrypt(uint8_t *src, uint8_t *dst,
static inline uint32_t
qat_bpicipher_postprocess(struct qat_sym_session *ctx,
- struct rte_crypto_op *op)
+ struct rte_crypto_op *op,
+ struct rte_crypto_sym_op *sym_op)
{
int block_len = qat_cipher_get_block_size(ctx->qat_cipher_alg);
- struct rte_crypto_sym_op *sym_op = op->sym;
uint8_t last_block_len = block_len > 0 ?
sym_op->cipher.data.length % block_len : 0;
@@ -132,14 +135,52 @@ qat_bpicipher_postprocess(struct qat_sym_session *ctx,
return sym_op->cipher.data.length - last_block_len;
}
+#ifdef RTE_LIBRTE_SECURITY
static inline void
-qat_sym_process_response(void **op, uint8_t *resp)
+qat_crc_verify(struct qat_sym_session *ctx, struct rte_crypto_op *op,
+ struct rte_security_docsis_op *doc_op,
+ struct rte_crypto_sym_op *sym_op)
{
+ uint32_t crc = 0;
+ uint8_t *crc_data;
+ uint32_t crc_offset;
+
+ if (ctx->qat_dir == ICP_QAT_HW_CIPHER_DECRYPT &&
+ doc_op != NULL &&
+ doc_op->crc.length != 0) {
+
+ crc_offset = doc_op->crc.offset;
+ crc_data = (uint8_t *) rte_pktmbuf_mtod_offset(
+ sym_op->m_src, uint8_t *, crc_offset);
+
+ if (unlikely((sym_op->m_dst != NULL)
+ && (sym_op->m_dst != sym_op->m_src)))
+ /* out-of-place operation (OOP) */
+ crc_data = (uint8_t *) rte_pktmbuf_mtod_offset(
+ sym_op->m_dst, uint8_t *, crc_offset);
+
+ crc = rte_net_crc_calc(crc_data, doc_op->crc.length,
+ RTE_NET_CRC32_ETH);
+ if (crc != *(uint32_t *)(crc_data + doc_op->crc.length))
+ op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
+ }
+}
+#endif
+
+static inline void
+qat_sym_process_response(void **op, uint8_t *resp)
+{
struct icp_qat_fw_comn_resp *resp_msg =
(struct icp_qat_fw_comn_resp *)resp;
struct rte_crypto_op *rx_op = (struct rte_crypto_op *)(uintptr_t)
(resp_msg->opaque_data);
+ struct rte_crypto_sym_op *sym_op;
+ struct qat_sym_session *sess;
+#ifdef RTE_LIBRTE_SECURITY
+ struct rte_security_op *sec_op;
+ struct rte_security_docsis_op *doc_op = NULL;
+#endif
#if RTE_LOG_DP_LEVEL >= RTE_LOG_DEBUG
QAT_DP_HEXDUMP_LOG(DEBUG, "qat_response:", (uint8_t *)resp_msg,
@@ -152,15 +193,36 @@ qat_sym_process_response(void **op, uint8_t *resp)
rx_op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
} else {
- struct qat_sym_session *sess = (struct qat_sym_session *)
- get_sym_session_private_data(
- rx_op->sym->session,
- cryptodev_qat_driver_id);
-
+#ifdef RTE_LIBRTE_SECURITY
+ if (unlikely(rx_op->type == RTE_CRYPTO_OP_TYPE_SECURITY)) {
+ /*
+ * Assuming at this point that if it's a security
+ * op, that this is for DOCSIS
+ */
+ sec_op = (struct rte_security_op *)&rx_op->security;
+ doc_op = &sec_op->docsis;
+ sess = (struct qat_sym_session *)
+ get_sec_session_private_data(
+ doc_op->crypto_sym.sec_session);
+ sym_op = &doc_op->crypto_sym;
+ } else
+#endif
+ {
+ sess = (struct qat_sym_session *)
+ get_sym_session_private_data(
+ rx_op->sym->session,
+ cryptodev_qat_driver_id);
+ sym_op = rx_op->sym;
+ }
- if (sess->bpi_ctx)
- qat_bpicipher_postprocess(sess, rx_op);
rx_op->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
+
+ if (sess->bpi_ctx) {
+ qat_bpicipher_postprocess(sess, rx_op, sym_op);
+#ifdef RTE_LIBRTE_SECURITY
+ qat_crc_verify(sess, rx_op, doc_op, sym_op);
+#endif
+ }
}
*op = (void *)rx_op;
}
@@ -699,4 +699,48 @@
}, } \
}
+#ifdef RTE_LIBRTE_SECURITY
+#define QAT_SECURITY_SYM_CAPABILITIES \
+ { /* AES DOCSIS BPI */ \
+ .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC, \
+ {.sym = { \
+ .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER, \
+ {.cipher = { \
+ .algo = RTE_CRYPTO_CIPHER_AES_DOCSISBPI,\
+ .block_size = 16, \
+ .key_size = { \
+ .min = 16, \
+ .max = 32, \
+ .increment = 16 \
+ }, \
+ .iv_size = { \
+ .min = 16, \
+ .max = 16, \
+ .increment = 0 \
+ } \
+ }, } \
+ }, } \
+ }
+
+#define QAT_SECURITY_CAPABILITIES(sym) \
+ [0] = { /* DOCSIS Uplink */ \
+ .action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL, \
+ .protocol = RTE_SECURITY_PROTOCOL_DOCSIS, \
+ .docsis = { \
+ .direction = RTE_SECURITY_DOCSIS_UPLINK, \
+ .crc_size = RTE_ETHER_CRC_LEN \
+ }, \
+ .crypto_capabilities = (sym) \
+ }, \
+ [1] = { /* DOCSIS Downlink */ \
+ .action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL, \
+ .protocol = RTE_SECURITY_PROTOCOL_DOCSIS, \
+ .docsis = { \
+ .direction = RTE_SECURITY_DOCSIS_DOWNLINK, \
+ .crc_size = RTE_ETHER_CRC_LEN \
+ }, \
+ .crypto_capabilities = (sym) \
+ }
+#endif
+
#endif /* _QAT_SYM_CAPABILITIES_H_ */
@@ -8,6 +8,9 @@
#include <rte_malloc.h>
#include <rte_pci.h>
#include <rte_cryptodev_pmd.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_security_driver.h>
+#endif
#include "qat_logs.h"
#include "qat_sym.h"
@@ -29,6 +32,21 @@ static const struct rte_cryptodev_capabilities qat_gen2_sym_capabilities[] = {
RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
};
+#ifdef RTE_LIBRTE_SECURITY
+static const struct rte_cryptodev_capabilities
+ qat_security_sym_capabilities[] = {
+ QAT_SECURITY_SYM_CAPABILITIES,
+ RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
+};
+
+static const struct rte_security_capability qat_security_capabilities[] = {
+ QAT_SECURITY_CAPABILITIES(qat_security_sym_capabilities),
+ {
+ .action = RTE_SECURITY_ACTION_TYPE_NONE
+ }
+};
+#endif
+
static int qat_sym_qp_release(struct rte_cryptodev *dev,
uint16_t queue_pair_id);
@@ -237,6 +255,23 @@ static struct rte_cryptodev_ops crypto_qat_ops = {
.sym_session_clear = qat_sym_session_clear
};
+#ifdef RTE_LIBRTE_SECURITY
+static const struct rte_security_capability *
+qat_security_cap_get(void *device __rte_unused)
+{
+ return qat_security_capabilities;
+}
+
+static struct rte_security_ops security_qat_ops = {
+ .session_create = qat_security_session_create,
+ .session_update = NULL,
+ .session_stats_get = NULL,
+ .session_destroy = qat_security_session_destroy,
+ .set_pkt_metadata = NULL,
+ .capabilities_get = qat_security_cap_get
+};
+#endif
+
static uint16_t
qat_sym_pmd_enqueue_op_burst(void *qp, struct rte_crypto_op **ops,
uint16_t nb_ops)
@@ -276,6 +311,9 @@ qat_sym_dev_create(struct qat_pci_device *qat_pci_dev,
char name[RTE_CRYPTODEV_NAME_MAX_LEN];
struct rte_cryptodev *cryptodev;
struct qat_sym_dev_private *internals;
+#ifdef RTE_LIBRTE_SECURITY
+ struct rte_security_ctx *security_instance;
+#endif
snprintf(name, RTE_CRYPTODEV_NAME_MAX_LEN, "%s_%s",
qat_pci_dev->name, "sym");
@@ -308,7 +346,20 @@ qat_sym_dev_create(struct qat_pci_device *qat_pci_dev,
RTE_CRYPTODEV_FF_OOP_SGL_IN_LB_OUT |
RTE_CRYPTODEV_FF_OOP_LB_IN_SGL_OUT |
RTE_CRYPTODEV_FF_OOP_LB_IN_LB_OUT |
- RTE_CRYPTODEV_FF_DIGEST_ENCRYPTED;
+ RTE_CRYPTODEV_FF_DIGEST_ENCRYPTED |
+ RTE_CRYPTODEV_FF_SECURITY;
+
+#ifdef RTE_LIBRTE_SECURITY
+ security_instance = rte_malloc("qat_sec",
+ sizeof(struct rte_security_ctx), 0);
+ if (security_instance == NULL)
+ QAT_LOG(ERR, "rte_security_ctx memory alloc failed\n");
+
+ security_instance->device = (void *)cryptodev;
+ security_instance->ops = &security_qat_ops;
+ security_instance->sess_cnt = 0;
+ cryptodev->security_ctx = security_instance;
+#endif
internals = cryptodev->data->dev_private;
internals->qat_dev = qat_pci_dev;
@@ -7,7 +7,11 @@
#ifdef BUILD_QAT_SYM
+#include <rte_ether.h>
#include <rte_cryptodev.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_security.h>
+#endif
#include "qat_sym_capabilities.h"
#include "qat_device.h"
@@ -14,6 +14,9 @@
#include <rte_log.h>
#include <rte_malloc.h>
#include <rte_crypto_sym.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_security.h>
+#endif
#include "qat_logs.h"
#include "qat_sym_session.h"
@@ -2092,3 +2095,148 @@ int qat_sym_validate_zuc_key(int key_len, enum icp_qat_hw_cipher_algo *alg)
}
return 0;
}
+
+#ifdef RTE_LIBRTE_SECURITY
+static int
+qat_sec_session_check_docsis(struct rte_security_session_conf *conf)
+{
+ struct rte_crypto_sym_xform *crypto_sym = conf->crypto_xform;
+ struct rte_security_docsis_xform *docsis = &conf->docsis;
+
+ /* CRC generate -> Cipher encrypt */
+ if (docsis->direction == RTE_SECURITY_DOCSIS_DOWNLINK) {
+
+ if (crypto_sym != NULL &&
+ crypto_sym->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
+ crypto_sym->cipher.op == RTE_CRYPTO_CIPHER_OP_ENCRYPT &&
+ crypto_sym->cipher.algo ==
+ RTE_CRYPTO_CIPHER_AES_DOCSISBPI &&
+ (crypto_sym->cipher.key.length ==
+ ICP_QAT_HW_AES_128_KEY_SZ ||
+ crypto_sym->cipher.key.length ==
+ ICP_QAT_HW_AES_256_KEY_SZ) &&
+ crypto_sym->cipher.iv.length == ICP_QAT_HW_AES_BLK_SZ &&
+ crypto_sym->next == NULL &&
+ docsis->crc_size == RTE_ETHER_CRC_LEN) {
+ return 0;
+ }
+ /* Cipher decrypt -> CRC verify */
+ } else if (docsis->direction == RTE_SECURITY_DOCSIS_UPLINK) {
+
+ if (crypto_sym != NULL &&
+ crypto_sym->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
+ crypto_sym->cipher.op == RTE_CRYPTO_CIPHER_OP_DECRYPT &&
+ crypto_sym->cipher.algo ==
+ RTE_CRYPTO_CIPHER_AES_DOCSISBPI &&
+ (crypto_sym->cipher.key.length ==
+ ICP_QAT_HW_AES_128_KEY_SZ ||
+ crypto_sym->cipher.key.length ==
+ ICP_QAT_HW_AES_256_KEY_SZ) &&
+ crypto_sym->cipher.iv.length == ICP_QAT_HW_AES_BLK_SZ &&
+ crypto_sym->next == NULL &&
+ docsis->crc_size == RTE_ETHER_CRC_LEN) {
+ return 0;
+ }
+ }
+
+ return -EINVAL;
+}
+
+static int
+qat_sec_session_set_docsis_parameters(struct rte_cryptodev *dev,
+ struct rte_security_session_conf *conf, void *session_private)
+{
+ int ret;
+ int qat_cmd_id;
+ struct rte_crypto_sym_xform *xform = NULL;
+ struct qat_sym_session *session = session_private;
+
+ ret = qat_sec_session_check_docsis(conf);
+ if (ret) {
+ QAT_LOG(ERR, "Unsupported DOCSIS security configuration");
+ return ret;
+ }
+
+ xform = conf->crypto_xform;
+
+ /* Set context descriptor physical address */
+ session->cd_paddr = rte_mempool_virt2iova(session) +
+ offsetof(struct qat_sym_session, cd);
+
+ session->min_qat_dev_gen = QAT_GEN1;
+
+ /* Get requested QAT command id */
+ qat_cmd_id = qat_get_cmd_id(xform);
+ if (qat_cmd_id < 0 || qat_cmd_id >= ICP_QAT_FW_LA_CMD_DELIMITER) {
+ QAT_LOG(ERR, "Unsupported xform chain requested");
+ return -ENOTSUP;
+ }
+ session->qat_cmd = (enum icp_qat_fw_la_cmd_id)qat_cmd_id;
+ switch (session->qat_cmd) {
+ case ICP_QAT_FW_LA_CMD_CIPHER:
+ ret = qat_sym_session_configure_cipher(dev, xform, session);
+ if (ret < 0)
+ return ret;
+ break;
+ default:
+ QAT_LOG(ERR, "Unsupported Service %u",
+ session->qat_cmd);
+ return -ENOTSUP;
+ }
+
+ return 0;
+}
+
+int
+qat_security_session_create(void *dev,
+ struct rte_security_session_conf *conf,
+ struct rte_security_session *sess,
+ struct rte_mempool *mempool)
+{
+ void *sess_private_data;
+ struct rte_cryptodev *cdev = (struct rte_cryptodev *)dev;
+ int ret;
+
+ if (rte_mempool_get(mempool, &sess_private_data)) {
+ QAT_LOG(ERR, "Couldn't get object from session mempool");
+ return -ENOMEM;
+ }
+
+ if (conf->protocol != RTE_SECURITY_PROTOCOL_DOCSIS) {
+ QAT_LOG(ERR, "Invalid security protocol");
+ return -EINVAL;
+ }
+
+ ret = qat_sec_session_set_docsis_parameters(cdev, conf,
+ sess_private_data);
+ if (ret != 0) {
+ QAT_LOG(ERR, "Failed to configure session parameters");
+ /* Return session to mempool */
+ rte_mempool_put(mempool, sess_private_data);
+ return ret;
+ }
+
+ set_sec_session_private_data(sess, sess_private_data);
+
+ return ret;
+}
+
+int
+qat_security_session_destroy(void *dev __rte_unused,
+ struct rte_security_session *sess)
+{
+ void *sess_priv = get_sec_session_private_data(sess);
+ struct qat_sym_session *s = (struct qat_sym_session *)sess_priv;
+
+ if (sess_priv) {
+ if (s->bpi_ctx)
+ bpi_cipher_ctx_free(s->bpi_ctx);
+ memset(s, 0, qat_sym_session_get_private_size(dev));
+ struct rte_mempool *sess_mp = rte_mempool_from_obj(sess_priv);
+
+ set_sec_session_private_data(sess, NULL);
+ rte_mempool_put(sess_mp, sess_priv);
+ }
+ return 0;
+}
+#endif
@@ -6,6 +6,9 @@
#include <rte_crypto.h>
#include <rte_cryptodev_pmd.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_security.h>
+#endif
#include "qat_common.h"
#include "icp_qat_hw.h"
@@ -156,4 +159,13 @@ qat_cipher_get_block_size(enum icp_qat_hw_cipher_algo qat_cipher_alg);
int
qat_sym_validate_zuc_key(int key_len, enum icp_qat_hw_cipher_algo *alg);
+#ifdef RTE_LIBRTE_SECURITY
+int
+qat_security_session_create(void *dev, struct rte_security_session_conf *conf,
+ struct rte_security_session *sess, struct rte_mempool *mempool);
+int
+qat_security_session_destroy(void *dev __rte_unused,
+ struct rte_security_session *sess);
+#endif
+
#endif /* _QAT_SYM_SESSION_H_ */