[2/2] crypto/ipsec_mb: enable IPsec on Arm platform
Checks
Commit Message
Arm port of ipsec_mb library [1] has different header file name than
the Intel ipsec_mb library. Proper header name is picked according to
the architecture to get the code compile when ipsec_mb is installed on
Arm platform.
And the Arm port currently supports ZUC and SNOW3g. Call to other
algorithms will be blocked.
[1] https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main
Signed-off-by: Ruifeng Wang <ruifeng.wang@arm.com>
---
app/test/test_cryptodev_hash_test_vectors.h | 4 ++++
doc/guides/cryptodevs/snow3g.rst | 14 ++++++++++----
doc/guides/cryptodevs/zuc.rst | 14 ++++++++++----
drivers/common/qat/meson.build | 6 +++++-
drivers/crypto/ipsec_mb/ipsec_mb_private.c | 6 ++++++
drivers/crypto/ipsec_mb/ipsec_mb_private.h | 4 ++++
drivers/crypto/ipsec_mb/meson.build | 6 +++++-
drivers/crypto/qat/qat_sym_session.c | 4 ++++
8 files changed, 48 insertions(+), 10 deletions(-)
Comments
On Wed, Jul 27, 2022 at 10:14 AM Ruifeng Wang <ruifeng.wang@arm.com> wrote:
>
> Arm port of ipsec_mb library [1] has different header file name than
> the Intel ipsec_mb library. Proper header name is picked according to
> the architecture to get the code compile when ipsec_mb is installed on
> Arm platform.
>
> And the Arm port currently supports ZUC and SNOW3g. Call to other
> algorithms will be blocked.
>
> [1] https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main
Is it planned to get this port merged in the original repo?
> -----Original Message-----
> From: David Marchand <david.marchand@redhat.com>
> Sent: Wednesday, July 27, 2022 4:34 PM
> To: Ruifeng Wang <Ruifeng.Wang@arm.com>
> Cc: Fan Zhang <roy.fan.zhang@intel.com>; Pablo de Lara
> <pablo.de.lara.guarch@intel.com>; Wang, Yipeng1
> <yipeng1.wang@intel.com>; Gobriel, Sameh <sameh.gobriel@intel.com>;
> Bruce Richardson <bruce.richardson@intel.com>; Vladimir Medvedkin
> <vladimir.medvedkin@intel.com>; Akhil Goyal <gakhil@marvell.com>; dev
> <dev@dpdk.org>; Honnappa Nagarahalli <Honnappa.Nagarahalli@arm.com>;
> nd <nd@arm.com>; thomas@monjalon.net
> Subject: Re: [PATCH 2/2] crypto/ipsec_mb: enable IPsec on Arm platform
>
> On Wed, Jul 27, 2022 at 10:14 AM Ruifeng Wang <ruifeng.wang@arm.com>
> wrote:
> >
> > Arm port of ipsec_mb library [1] has different header file name than
> > the Intel ipsec_mb library. Proper header name is picked according to
> > the architecture to get the code compile when ipsec_mb is installed on
> > Arm platform.
> >
> > And the Arm port currently supports ZUC and SNOW3g. Call to other
> > algorithms will be blocked.
> >
> > [1]
> > https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main
>
> Is it planned to get this port merged in the original repo?
Yes, it is intended to get this port merged in the original repo.
Efforts are being made. Code not merged yet.
>
>
> --
> David Marchand
Acked-by: Ashwin Sekhar T K <asekhar@marvell.com>
<snip>
> >
> > On Wed, Jul 27, 2022 at 10:14 AM Ruifeng Wang <ruifeng.wang@arm.com>
> > wrote:
> > >
> > > Arm port of ipsec_mb library [1] has different header file name than
> > > the Intel ipsec_mb library. Proper header name is picked according
> > > to the architecture to get the code compile when ipsec_mb is
> > > installed on Arm platform.
> > >
> > > And the Arm port currently supports ZUC and SNOW3g. Call to other
> > > algorithms will be blocked.
> > >
> > > [1]
> > > https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main
> >
> > Is it planned to get this port merged in the original repo?
We tried before forking, there were non-technical challenges. We hope it will get unified in the future at least. But for now, it is a separate repo which will be synced regularly with the original repo. This forked repo is fully supported by Arm.
>
> Yes, it is intended to get this port merged in the original repo.
> Efforts are being made. Code not merged yet.
> >
> >
> > --
> > David Marchand
>
@@ -6,8 +6,12 @@
#define TEST_CRYPTODEV_HASH_TEST_VECTORS_H_
#ifdef RTE_CRYPTO_AESNI_MB
+#if defined(RTE_ARCH_ARM)
+#include <ipsec-mb.h>
+#else
#include <intel-ipsec-mb.h>
#endif
+#endif
static const uint8_t plaintext_hash[] = {
"What a lousy earth! He wondered how many people "
@@ -33,11 +33,17 @@ Installation
------------
To build DPDK with the SNOW3G_PMD the user is required to download the multi-buffer
-library from `here <https://github.com/01org/intel-ipsec-mb>`_
-and compile it on their user system before building DPDK.
+library and compile it on their user system before building DPDK.
+
+For x86 system, the multi-buffer library is available
+`here <https://github.com/01org/intel-ipsec-mb>`_.
The latest version of the library supported by this PMD is v1.2, which
can be downloaded from `<https://github.com/01org/intel-ipsec-mb/archive/v1.2.zip>`_.
+For Arm system, ARM64 port of the multi-buffer library can be downloaded from
+`<https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main/>`_. The
+latest version of the library supported by this PMD is tagged as SECLIB-IPSEC-2022.05.25.
+
After downloading the library, the user needs to unpack and compile it
on their system before building DPDK:
@@ -46,8 +52,8 @@ on their system before building DPDK:
make
make install
-The library requires NASM to be built. Depending on the library version, it might
-require a minimum NASM version (e.g. v0.54 requires at least NASM 2.14).
+The library requires NASM to be built on x86. Depending on the library version,
+it might require a minimum NASM version (e.g. v0.54 requires at least NASM 2.14).
NASM is packaged for different OS. However, on some OS the version is too old,
so a manual installation is required. In that case, NASM can be downloaded from
@@ -33,11 +33,17 @@ Installation
------------
To build DPDK with the ZUC_PMD the user is required to download the multi-buffer
-library from `here <https://github.com/01org/intel-ipsec-mb>`_
-and compile it on their user system before building DPDK.
+library and compile it on their user system before building DPDK.
+
+For x86 system, the multi-buffer library is available
+`here <https://github.com/01org/intel-ipsec-mb>`_.
The latest version of the library supported by this PMD is v1.2, which
can be downloaded from `<https://github.com/01org/intel-ipsec-mb/archive/v1.2.zip>`_.
+For Arm system, ARM64 port of the multi-buffer library can be downloaded from
+`<https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main/>`_. The
+latest version of the library supported by this PMD is tagged as SECLIB-IPSEC-2022.05.25.
+
After downloading the library, the user needs to unpack and compile it
on their system before building DPDK:
@@ -46,8 +52,8 @@ on their system before building DPDK:
make
make install
-The library requires NASM to be built. Depending on the library version, it might
-require a minimum NASM version (e.g. v0.54 requires at least NASM 2.14).
+The library requires NASM to be built on x86. Depending on the library version,
+it might require a minimum NASM version (e.g. v0.54 requires at least NASM 2.14).
NASM is packaged for different OS. However, on some OS the version is too old,
so a manual installation is required. In that case, NASM can be downloaded from
@@ -36,11 +36,15 @@ if qat_crypto and not libcrypto.found()
endif
IMB_required_ver = '1.2.0'
+IMB_header = '#include<intel-ipsec-mb.h>'
+if arch_subdir == 'arm'
+ IMB_header = '#include<ipsec-mb.h>'
+endif
libipsecmb = cc.find_library('IPSec_MB', required: false)
if libipsecmb.found()
# version comes with quotes, so we split based on " and take the middle
imb_ver = cc.get_define('IMB_VERSION_STR',
- prefix : '#include<intel-ipsec-mb.h>').split('"')[1]
+ prefix : IMB_header).split('"')[1]
if (imb_ver.version_compare('>=' + IMB_required_ver))
ext_deps += libipsecmb
@@ -53,6 +53,12 @@ ipsec_mb_create(struct rte_vdev_device *vdev,
const char *name, *args;
int retval;
+#if defined(RTE_ARCH_ARM)
+ if ((pmd_type != IPSEC_MB_PMD_TYPE_SNOW3G) &&
+ (pmd_type != IPSEC_MB_PMD_TYPE_ZUC))
+ return -ENOTSUP;
+#endif
+
#if defined(RTE_ARCH_ARM64)
vector_mode = IPSEC_MB_ARM64;
#elif defined(RTE_ARCH_X86_64)
@@ -5,7 +5,11 @@
#ifndef _IPSEC_MB_PRIVATE_H_
#define _IPSEC_MB_PRIVATE_H_
+#if defined(RTE_ARCH_ARM)
+#include <ipsec-mb.h>
+#else
#include <intel-ipsec-mb.h>
+#endif
#include <cryptodev_pmd.h>
#include <rte_bus_vdev.h>
@@ -8,6 +8,10 @@ if is_windows
endif
IMB_required_ver = '1.0.0'
+IMB_header = '#include<intel-ipsec-mb.h>'
+if arch_subdir == 'arm'
+ IMB_header = '#include<ipsec-mb.h>'
+endif
lib = cc.find_library('IPSec_MB', required: false)
if not lib.found()
build = false
@@ -17,7 +21,7 @@ else
# version comes with quotes, so we split based on " and take the middle
imb_ver = cc.get_define('IMB_VERSION_STR',
- prefix : '#include<intel-ipsec-mb.h>').split('"')[1]
+ prefix : IMB_header).split('"')[1]
if (imb_ver == '') or (imb_ver.version_compare('<' + IMB_required_ver))
reason = 'IPSec_MB version >= @0@ is required, found version @1@'.format(
@@ -10,8 +10,12 @@
#include <openssl/evp.h> /* Needed for bpi runt block processing */
#ifdef RTE_QAT_LIBIPSECMB
+#if defined(RTE_ARCH_ARM)
+#include <ipsec-mb.h>
+#else
#include <intel-ipsec-mb.h>
#endif
+#endif
#include <rte_memcpy.h>
#include <rte_common.h>