|WARNING| crypto/ipsec_mb: require minimum version 2.0 for IPsec MB

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/167478

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-08-11

# DPDK Patch Review

## Summary
This patch updates the minimum required Intel IPsec Multi-Buffer library version from 1.4.0 to 2.0.0 and removes conditional compilation code for older versions. The patch is mostly correct, but has one **Error** and two **Warnings**.

---

## Errors

### Resource Leak / Error Path Issue

**File:** `drivers/common/qat/meson.build`

**Issue:** The comment `# Check for IPsec MB library (required)` was removed along with the version check logic. However, the error handling path for when the library is not found or doesn't link correctly is still present but now lacks the check that would trigger it. This creates a potential logic gap where `libipsecmb` might not be found but the code continues.

**Location:**
```python
libipsecmb = cc.find_library('IPSec_MB', required: false)
if libipsecmb.found() and cc.links(
        'int main(void) {return 0;}', dependencies: libipsecmb)
```

The `cc.find_library()` call uses `required: false`, meaning it won't fail if not found, but there's no subsequent check to verify the version is >= 2.0.0 before proceeding. The old code likely had additional version verification that was removed.

**Fix:** Verify that the meson build system will properly fail if IPsec MB < 2.0.0 is found, or add an explicit version check that matches the new requirement.

---

## Warnings

### 1. Release Notes Placement

**File:** `doc/guides/rel_notes/release_26_11.rst`

**Issue:** The release note is placed under "Removed Items" section, but the change is not strictly a removal--it's a version requirement increase. This might be better categorized under a "Updated" or "Changed" section if one exists, or the wording should clarify this is about dropping support for old versions rather than removing the driver itself.

**Current:**
```rst
* **Updated AESNI_MB crypto driver.**

  * Remove support for versions older than 2.0 of IPsec MB Library.
```

**Suggested:**
```rst
* **Updated crypto/ipsec_mb drivers.**

  * Increased minimum required Intel IPsec Multi-Buffer library version to 2.0.
    Support for older versions has been removed.
```

This better reflects that multiple PMDs are affected (aesni_mb, aesni_gcm, snow3g, zuc) and is more precise about the nature of the change.

---

### 2. Documentation Version Table Consistency

**Files:** Multiple `.rst` files in `doc/guides/cryptodevs/`

**Issue:** The version compatibility tables now show overlapping ranges that could be clearer. For example:

```rst
24.11 - 26.07  Multi-buffer library 1.4  - 2.0
26.11+         Multi-buffer library 2.0+
```

The range `24.11 - 26.07` includes release `26.07`, and the next line starts at `26.11`. This is correct but could be misread. Consider whether the upper bound should be `26.07` or `<26.11` for absolute clarity, depending on whether 26.07 actually supported 2.0 or not.

**Current state is acceptable** but verify the version numbers align with actual DPDK releases and whether 26.07 truly supported up to 2.0.

---

## Code Quality Observations (Info Level)

### 1. Consistent Cleanup Pattern

The removal of `#if IMB_VERSION(1, 5, 0)` conditionals is done consistently throughout the code. All instances appear to have been cleaned up properly, removing both the `#if` and `#endif` directives while keeping the code that was conditionally compiled for newer versions.

### 2. Authentication Precompute Comment Removal

In `drivers/common/qat/meson.build`, the comment cleanup removed the line:
```python
# Check for IPsec MB library (required)
```

While this is consistent with the simplification, a comment explaining that IPsec MB is required for HMAC precomputes might still be useful for future maintainers. The existing comment above (`# IPsec MB is REQUIRED for HMAC precomputes...`) provides this context, so the removal is acceptable.

### 3. SM4 Algorithm Support

The patch properly removes version checks around SM4 cipher modes (CBC, ECB, CTR) and SM4-GCM AEAD mode. The code structure after removal is clean and consistent with other cipher modes.

---

## Verification Checklist

- [x] Lines <=100 characters (meson.build files and documentation are within acceptable limits)
- [x] No trailing whitespace
- [x] Proper include order (no changes to includes)
- [x] No forbidden tokens
- [x] No deprecated API usage
- [x] Documentation matches code changes
- [x] Release notes updated (present, though placement could be improved)
- [x] C coding style consistent
- [x] Meson formatting consistent (4-space indentation)
- [ ] Build system properly enforces minimum version requirement (needs verification)

---

## Recommendations

1. **Fix the error:** Ensure meson build will fail gracefully with a clear message if IPsec MB library < 2.0.0 is detected
2. **Improve release notes:** Use more precise wording about version requirement change
3. **Verify version table:** Confirm the DPDK release versions in documentation tables are accurate

The patch is otherwise well-structured and removes legacy code cleanly. The primary concern is ensuring the build system properly enforces the new minimum version requirement.