[PATCH v3 2/4] crypto/ipsec_mb: add support for 256-NxA4/5/6 algorithms

[Cornu, Marcel D]

> -731,6 +808,67 @@ aesni_mb_set_session_aead_parameters(IMB_MGR
> *mb_mgr,
>  		sess->template_job.enc_keys = &sess->cipher.gcm_key;
>  		sess->template_job.dec_keys = &sess->cipher.gcm_key;
>  		break;
> +#if IMB_VERSION(3, 0, 0) <= IMB_VERSION_NUM
> +	case RTE_CRYPTO_AEAD_SNOW5G_NCA4:
> +		sess->template_job.cipher_mode =
> IMB_CIPHER_SNOW5G_NCA4;
> +		sess->template_job.hash_alg = IMB_AUTH_SNOW5G_NCA4;
> +		sess->template_job.u.GCM.aad_len_in_bytes = xform-
> >aead.aad_length;
> +		if (xform->aead.key.length != 32) {
> +			IPSEC_MB_LOG(ERR, "Invalid key length");
> +			return -EINVAL;
> +		}
> +		sess->template_job.key_len_in_bytes = 32;
> +		memcpy(sess->cipher.nxa_cipher_key, xform->aead.key.data,
> 32);
> +		sess->template_job.enc_keys = sess->cipher.nxa_cipher_key;
> +		sess->template_job.dec_keys = sess->cipher.nxa_cipher_key;
> +		/* digest size must be between 4 and 16 */
> +		if (sess->auth.req_digest_len < 4 ||
> +				sess->auth.req_digest_len > 16) {
> +			IPSEC_MB_LOG(ERR, "Invalid digest size");
> +			return -EINVAL;
> +		}
> +		break;
> +	case RTE_CRYPTO_AEAD_AES_NCA5:
> +		sess->template_job.cipher_mode = IMB_CIPHER_AES_NCA5;
> +		sess->template_job.hash_alg = IMB_AUTH_AES_NCA5;
> +		sess->template_job.u.GCM.aad_len_in_bytes = xform-
> >aead.aad_length;
Should be setting u.NCA.aad_len_in_bytes and u.NCA.aad, instead of u.GCM.
Same for other NCA algos.

> @@ -1775,6 +1947,31 @@ set_mb_job_params(IMB_JOB *job, struct
> ipsec_mb_qp *qp,
>  		job->iv = rte_crypto_op_ctod_offset(op, uint8_t *,
>  				session->iv.offset);
>  		break;
> +#if IMB_VERSION(3, 0, 0) <= IMB_VERSION_NUM
> +	case IMB_AUTH_SNOW5G_NCA4:
> +	case IMB_AUTH_AES_NCA5:
> +	case IMB_AUTH_ZUC_NCA6:
> +		job->hash_start_src_offset_in_bytes =
> +				op->sym->aead.data.offset;
> +		job->msg_len_to_hash_in_bytes =
> +				op->sym->aead.data.length;
> +		job->cipher_start_src_offset_in_bytes =
> +			op->sym->aead.data.offset;
> +		job->msg_len_to_cipher_in_bytes = op->sym-
> >aead.data.length;
> +		job->iv = rte_crypto_op_ctod_offset(op, uint8_t *,
> +			session->iv.offset);
> +		break;
> +	case IMB_AUTH_SNOW5G_NIA4:
> +	case IMB_AUTH_AES_NIA5:
> +	case IMB_AUTH_ZUC_NIA6:
> +		job->hash_start_src_offset_in_bytes =
> +				op->sym->auth.data.offset >> 3;
> +		job->msg_len_to_hash_in_bytes =
> +				op->sym->auth.data.length >> 3;
> +		job->iv = rte_crypto_op_ctod_offset(op, uint8_t *,
> +			session->iv.offset);
> +		break;
> +#endif
Should use job->u.NIA._iv instead of job->iv for NIA algos.

> 
>  	default:
>  		job->hash_start_src_offset_in_bytes = auth_start_offset( @@
> -1831,6 +2028,15 @@ set_mb_job_params(IMB_JOB *job, struct
> ipsec_mb_qp *qp,
>  	case IMB_CIPHER_SM4_GCM:
>  		job->msg_len_to_cipher_in_bytes = op->sym-
> >aead.data.length;
>  		break;
> +#if IMB_VERSION(3, 0, 0) <= IMB_VERSION_NUM
> +	case IMB_CIPHER_SNOW5G_NCA4:
> +	case IMB_CIPHER_AES_NCA5:
> +	case IMB_CIPHER_ZUC_NCA6:
> +		job->cipher_start_src_offset_in_bytes =
> +			op->sym->aead.data.offset;
> +		job->msg_len_to_cipher_in_bytes = op->sym-
> >aead.data.length;
> +		break;
> +#endif
>  	default:
>  		job->cipher_start_src_offset_in_bytes =
>  					op->sym->cipher.data.offset;
Does the default case need to be converted bytes for 3.0? All algos now expect byte len messages and offsets.

> @@ -1048,6 +1275,8 @@ struct __rte_cache_aligned aesni_mb_session {
>  			/* *< Expanded GCM key */
>  			uint8_t zuc_cipher_key[32];
>  			/* *< ZUC cipher key */
> +			uint8_t nxa_cipher_key[32];
> +			/* *< NxA cipher key */
>  			snow3g_key_schedule_t pKeySched_snow3g_cipher;
>  			/* *< SNOW3G scheduled cipher key */
>  			kasumi_key_sched_t pKeySched_kasumi_cipher; @@
> -1101,6 +1330,8 @@ struct __rte_cache_aligned aesni_mb_session {
>  			/* *< Expanded XCBC authentication keys */
>  			uint8_t zuc_auth_key[32];
>  			/* *< ZUC authentication key */
> +			uint8_t snow5g_auth_key[32];
> +			/* *< SNOW5G authentication key */
>  			snow3g_key_schedule_t pKeySched_snow3g_auth;
>  			/* *< SNOW3G scheduled authentication key */
>  			kasumi_key_sched_t pKeySched_kasumi_auth;
> --
Should there be a separate expanded_aes_keys in the auth struct for NIA5? Currently it's using cipher.expanded_key which may not work for chaining AES cipher with NIA5 auth.