* [PATCH] crypto/ipsec_mb: require minimum version 2.0 for IPsec MB
@ 2026-08-11 11:26 Radu Nicolau
2026-08-11 15:53 ` Stephen Hemminger
0 siblings, 1 reply; 3+ messages in thread
From: Radu Nicolau @ 2026-08-11 11:26 UTC (permalink / raw)
To: dev; +Cc: Radu Nicolau, Kai Ji, Pablo de Lara
Increase the minimum required IPsec MB library version to 2.0
As a consequence, clean up the aesni_mb PMD code.
Signed-off-by: Radu Nicolau <radu.nicolau@intel.com>
---
doc/guides/cryptodevs/aesni_gcm.rst | 7 +++---
doc/guides/cryptodevs/aesni_mb.rst | 7 +++---
doc/guides/cryptodevs/qat.rst | 2 +-
doc/guides/cryptodevs/snow3g.rst | 3 ++-
doc/guides/cryptodevs/zuc.rst | 3 ++-
doc/guides/rel_notes/release_26_11.rst | 4 +++
drivers/common/qat/meson.build | 4 +--
drivers/crypto/ipsec_mb/meson.build | 2 +-
drivers/crypto/ipsec_mb/pmd_aesni_mb.c | 28 +++------------------
drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h | 8 ------
10 files changed, 23 insertions(+), 45 deletions(-)
diff --git a/doc/guides/cryptodevs/aesni_gcm.rst b/doc/guides/cryptodevs/aesni_gcm.rst
index 4683e9dd86..aefc1cedcb 100644
--- a/doc/guides/cryptodevs/aesni_gcm.rst
+++ b/doc/guides/cryptodevs/aesni_gcm.rst
@@ -40,8 +40,8 @@ Installation
To build DPDK with the AESNI_GCM_PMD the user is required to download the multi-buffer
library from `here <https://github.com/01org/intel-ipsec-mb>`_
and compile it on their user system before building DPDK.
-The latest version of the library supported by this PMD is v1.5, which
-can be downloaded in `<https://github.com/01org/intel-ipsec-mb/archive/v1.5.zip>`_.
+The latest version of the library supported by this PMD is v2.0, which
+can be downloaded from `<https://github.com/01org/intel-ipsec-mb/archive/v2.0.zip>`_.
For Arm system, ARM64 port of the multi-buffer library can be downloaded from
https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main/.
@@ -77,7 +77,8 @@ and the external crypto libraries supported by them:
============= ================================
20.11 - 21.08 Multi-buffer library 0.53 - 1.3
21.11 - 24.07 Multi-buffer library 1.0 - 1.5
- 24.11+ Multi-buffer library 1.4+
+ 24.11 - 26.07 Multi-buffer library 1.4 - 2.0
+ 26.11+ Multi-buffer library 2.0+
============= ================================
Initialization
diff --git a/doc/guides/cryptodevs/aesni_mb.rst b/doc/guides/cryptodevs/aesni_mb.rst
index ab7a6138a8..add3c03b74 100644
--- a/doc/guides/cryptodevs/aesni_mb.rst
+++ b/doc/guides/cryptodevs/aesni_mb.rst
@@ -96,8 +96,8 @@ Installation
To build DPDK with the AESNI_MB_PMD the user is required to download the multi-buffer
library from `here <https://github.com/01org/intel-ipsec-mb>`_
and compile it on their user system before building DPDK.
-The latest version of the library supported by this PMD is v1.5, which
-can be downloaded from `<https://github.com/01org/intel-ipsec-mb/archive/v1.5.zip>`_.
+The latest version of the library supported by this PMD is v2.0, which
+can be downloaded from `<https://github.com/01org/intel-ipsec-mb/archive/v2.0.zip>`_.
For Arm system, ARM64 port of the multi-buffer library can be downloaded from
https://gitlab.arm.com/arm-reference-solutions/ipsec-mb/-/tree/main/.
@@ -132,7 +132,8 @@ and the Multi-Buffer library version supported by them:
============== ============================
20.11 - 21.08 0.53 - 1.3
21.11 - 24.07 1.0 - 1.5
- 24.11+ 1.4+
+ 24.11 - 26.07 1.4 - 2.0
+ 26.11+ 2.0+
============== ============================
Initialization
diff --git a/doc/guides/cryptodevs/qat.rst b/doc/guides/cryptodevs/qat.rst
index 6c96c5f88d..1738152435 100644
--- a/doc/guides/cryptodevs/qat.rst
+++ b/doc/guides/cryptodevs/qat.rst
@@ -360,7 +360,7 @@ that were previously used for HMAC precomputes.
**On x86 platforms:**
-* Intel IPsec MB library (v1.4.0+) is required for HMAC precomputes.
+* Intel IPsec MB library (v2.0+) is required for HMAC precomputes.
* OpenSSL (3.0+) is optional for DOCSIS BPI cipher fallback.
**On ARM platforms:**
diff --git a/doc/guides/cryptodevs/snow3g.rst b/doc/guides/cryptodevs/snow3g.rst
index e1db5d39ad..e3a47263e1 100644
--- a/doc/guides/cryptodevs/snow3g.rst
+++ b/doc/guides/cryptodevs/snow3g.rst
@@ -82,7 +82,8 @@ and the external crypto libraries supported by them:
============= ================================
20.02 - 21.08 Multi-buffer library 0.53 - 1.3
21.11 - 24.07 Multi-buffer library 1.0 - 1.5
- 24.11+ Multi-buffer library 1.4+
+ 24.11 - 26.07 Multi-buffer library 1.4 - 2.0
+ 26.11+ Multi-buffer library 2.0+
============= ================================
Initialization
diff --git a/doc/guides/cryptodevs/zuc.rst b/doc/guides/cryptodevs/zuc.rst
index 91b7267362..22b70bc750 100644
--- a/doc/guides/cryptodevs/zuc.rst
+++ b/doc/guides/cryptodevs/zuc.rst
@@ -81,7 +81,8 @@ and the external crypto libraries supported by them:
============= ================================
20.02 - 21.08 Multi-buffer library 0.53 - 1.3
21.11 - 24.07 Multi-buffer library 1.0 - 1.5
- 24.11+ Multi-buffer library 1.4+
+ 24.11 - 26.07 Multi-buffer library 1.4 - 2.0
+ 26.11+ Multi-buffer library 2.0+
============= ================================
Initialization
diff --git a/doc/guides/rel_notes/release_26_11.rst b/doc/guides/rel_notes/release_26_11.rst
index c8cc86295d..7fc97ca4c9 100644
--- a/doc/guides/rel_notes/release_26_11.rst
+++ b/doc/guides/rel_notes/release_26_11.rst
@@ -59,6 +59,10 @@ New Features
Removed Items
-------------
+* **Updated AESNI_MB crypto driver.**
+
+ * Remove support for versions older than 2.0 of IPsec MB Library.
+
.. This section should contain removed items in this release. Sample format:
* Add a short 1-2 sentence description of the removed item
diff --git a/drivers/common/qat/meson.build b/drivers/common/qat/meson.build
index b946354a42..17526d3940 100644
--- a/drivers/common/qat/meson.build
+++ b/drivers/common/qat/meson.build
@@ -38,7 +38,7 @@ endif
# IPsec MB is REQUIRED for HMAC precomputes (no OpenSSL 3.0 alternative)
# OpenSSL is OPTIONAL for DOCSIS BPI cipher fallback
-IMB_required_ver = '1.4.0'
+IMB_required_ver = '2.0.0'
# Only check IPsec MB if qat_crypto wasn't already disabled
if qat_crypto
@@ -47,8 +47,6 @@ if qat_crypto
else
IMB_header = '#include<intel-ipsec-mb.h>'
endif
-
- # Check for IPsec MB library (required)
libipsecmb = cc.find_library('IPSec_MB', required: false)
if libipsecmb.found() and cc.links(
'int main(void) {return 0;}', dependencies: libipsecmb)
diff --git a/drivers/crypto/ipsec_mb/meson.build b/drivers/crypto/ipsec_mb/meson.build
index eb2085725b..41362c2f4f 100644
--- a/drivers/crypto/ipsec_mb/meson.build
+++ b/drivers/crypto/ipsec_mb/meson.build
@@ -9,7 +9,7 @@ endif
cflags += no_wvla_cflag
-IMB_required_ver = '1.4.0'
+IMB_required_ver = '2.0.0'
IMB_header = '#include<intel-ipsec-mb.h>'
if arch_subdir == 'arm'
IMB_header = '#include<ipsec-mb.h>'
diff --git a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
index 4c5b6e70b5..02bacd020b 100644
--- a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
+++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
@@ -20,10 +20,8 @@ is_aead_algo(IMB_HASH_ALG hash_alg, IMB_CIPHER_MODE cipher_mode)
{
return (hash_alg == IMB_AUTH_CHACHA20_POLY1305 ||
hash_alg == IMB_AUTH_AES_CCM ||
- cipher_mode == IMB_CIPHER_GCM
-#if IMB_VERSION(1, 5, 0) < IMB_VERSION_NUM
- || cipher_mode == IMB_CIPHER_SM4_GCM
-#endif
+ cipher_mode == IMB_CIPHER_GCM ||
+ cipher_mode == IMB_CIPHER_SM4_GCM
);
}
@@ -295,14 +293,12 @@ aesni_mb_set_session_auth_parameters(IMB_MGR *mb_mgr,
sess->template_job.hash_alg = IMB_AUTH_SHA_512;
auth_precompute = 0;
break;
-#if IMB_VERSION(1, 5, 0) <= IMB_VERSION_NUM
case RTE_CRYPTO_AUTH_SM3:
sess->template_job.hash_alg = IMB_AUTH_SM3;
break;
case RTE_CRYPTO_AUTH_SM3_HMAC:
sess->template_job.hash_alg = IMB_AUTH_HMAC_SM3;
break;
-#endif
default:
IPSEC_MB_LOG(ERR,
"Unsupported authentication algorithm selection");
@@ -353,9 +349,7 @@ aesni_mb_set_session_cipher_parameters(const IMB_MGR *mb_mgr,
uint8_t is_zuc = 0;
uint8_t is_snow3g = 0;
uint8_t is_kasumi = 0;
-#if IMB_VERSION(1, 5, 0) <= IMB_VERSION_NUM
uint8_t is_sm4 = 0;
-#endif
if (xform == NULL) {
sess->template_job.cipher_mode = IMB_CIPHER_NULL;
@@ -426,7 +420,6 @@ aesni_mb_set_session_cipher_parameters(const IMB_MGR *mb_mgr,
sess->iv.offset = xform->cipher.iv.offset;
sess->template_job.iv_len_in_bytes = xform->cipher.iv.length;
return 0;
-#if IMB_VERSION(1, 5, 0) <= IMB_VERSION_NUM
case RTE_CRYPTO_CIPHER_SM4_CBC:
sess->template_job.cipher_mode = IMB_CIPHER_SM4_CBC;
is_sm4 = 1;
@@ -435,13 +428,10 @@ aesni_mb_set_session_cipher_parameters(const IMB_MGR *mb_mgr,
sess->template_job.cipher_mode = IMB_CIPHER_SM4_ECB;
is_sm4 = 1;
break;
-#endif
-#if IMB_VERSION(1, 5, 0) < IMB_VERSION_NUM
case RTE_CRYPTO_CIPHER_SM4_CTR:
sess->template_job.cipher_mode = IMB_CIPHER_SM4_CNTR;
is_sm4 = 1;
break;
-#endif
default:
IPSEC_MB_LOG(ERR, "Unsupported cipher mode parameter");
return -ENOTSUP;
@@ -576,7 +566,6 @@ aesni_mb_set_session_cipher_parameters(const IMB_MGR *mb_mgr,
&sess->cipher.pKeySched_kasumi_cipher);
sess->template_job.enc_keys = &sess->cipher.pKeySched_kasumi_cipher;
sess->template_job.dec_keys = &sess->cipher.pKeySched_kasumi_cipher;
-#if IMB_VERSION(1, 5, 0) <= IMB_VERSION_NUM
} else if (is_sm4) {
sess->template_job.key_len_in_bytes = IMB_KEY_128_BYTES;
IMB_SM4_KEYEXP(mb_mgr, xform->cipher.key.data,
@@ -584,7 +573,6 @@ aesni_mb_set_session_cipher_parameters(const IMB_MGR *mb_mgr,
sess->cipher.expanded_sm4_keys.decode);
sess->template_job.enc_keys = sess->cipher.expanded_sm4_keys.encode;
sess->template_job.dec_keys = sess->cipher.expanded_sm4_keys.decode;
-#endif
} else {
if (xform->cipher.key.length != 8) {
IPSEC_MB_LOG(ERR, "Invalid cipher key length");
@@ -724,7 +712,6 @@ aesni_mb_set_session_aead_parameters(IMB_MGR *mb_mgr,
return -EINVAL;
}
break;
-#if IMB_VERSION(1, 5, 0) < IMB_VERSION_NUM
case RTE_CRYPTO_AEAD_SM4_GCM:
sess->template_job.cipher_mode = IMB_CIPHER_SM4_GCM;
sess->template_job.hash_alg = IMB_AUTH_SM4_GCM;
@@ -739,7 +726,6 @@ aesni_mb_set_session_aead_parameters(IMB_MGR *mb_mgr,
sess->template_job.enc_keys = &sess->cipher.gcm_key;
sess->template_job.dec_keys = &sess->cipher.gcm_key;
break;
-#endif
default:
IPSEC_MB_LOG(ERR, "Unsupported aead mode parameter");
return -ENOTSUP;
@@ -1065,11 +1051,11 @@ set_cpu_mb_job_params(IMB_JOB *job, struct aesni_mb_session *session,
job->u.CHACHA20_POLY1305.aad = aad->va;
break;
-#if IMB_VERSION(1, 5, 0) < IMB_VERSION_NUM
+
case IMB_AUTH_SM4_GCM:
job->u.GCM.aad = aad->va;
break;
-#endif
+
default:
break;
@@ -1618,11 +1604,9 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
imb_set_session(mb_mgr, job);
}
break;
-#if IMB_VERSION(1, 5, 0) < IMB_VERSION_NUM
case IMB_AUTH_SM4_GCM:
job->u.GCM.aad = op->sym->aead.aad.data;
break;
-#endif
default:
break;
}
@@ -1753,7 +1737,6 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
job->iv = rte_crypto_op_ctod_offset(op, uint8_t *,
session->iv.offset);
break;
-#if IMB_VERSION(1, 5, 0) < IMB_VERSION_NUM
case IMB_AUTH_SM4_GCM:
job->hash_start_src_offset_in_bytes = 0;
/*
@@ -1766,7 +1749,6 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
job->iv = rte_crypto_op_ctod_offset(op, uint8_t *,
session->iv.offset);
break;
-#endif
default:
job->hash_start_src_offset_in_bytes = auth_start_offset(
@@ -1813,11 +1795,9 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
job->msg_len_to_cipher_in_bytes = 0;
job->cipher_start_src_offset_in_bytes = 0;
break;
-#if IMB_VERSION(1, 5, 0) < IMB_VERSION_NUM
case IMB_CIPHER_SM4_GCM:
job->msg_len_to_cipher_in_bytes = op->sym->aead.data.length;
break;
-#endif
default:
job->cipher_start_src_offset_in_bytes =
op->sym->cipher.data.offset;
diff --git a/drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h b/drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h
index 6dc90a9849..ad38a1e28a 100644
--- a/drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h
+++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb_priv.h
@@ -725,7 +725,6 @@ static const struct rte_cryptodev_capabilities aesni_mb_capabilities[] = {
}, }
}, }
},
-#if IMB_VERSION(1, 5, 0) <= IMB_VERSION_NUM
{ /* SM3 */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
@@ -804,8 +803,6 @@ static const struct rte_cryptodev_capabilities aesni_mb_capabilities[] = {
}, }
}, }
},
-#endif
-#if IMB_VERSION(1, 5, 0) < IMB_VERSION_NUM
{ /* SM4 CTR */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
@@ -856,7 +853,6 @@ static const struct rte_cryptodev_capabilities aesni_mb_capabilities[] = {
}, }
}, }
},
-#endif
RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
};
@@ -964,10 +960,8 @@ static const unsigned int auth_digest_byte_lengths[] = {
[IMB_AUTH_ZUC_EIA3_BITLEN] = 4,
[IMB_AUTH_SNOW3G_UIA2_BITLEN] = 4,
[IMB_AUTH_KASUMI_UIA1] = 4,
-#if IMB_VERSION(1, 5, 0) <= IMB_VERSION_NUM
[IMB_AUTH_SM3] = 32,
[IMB_AUTH_HMAC_SM3] = 32,
-#endif
/**< Vector mode dependent pointer table of the multi-buffer APIs */
};
@@ -1029,7 +1023,6 @@ struct __rte_cache_aligned aesni_mb_session {
/* *< SNOW3G scheduled cipher key */
kasumi_key_sched_t pKeySched_kasumi_cipher;
/* *< KASUMI scheduled cipher key */
-#if IMB_VERSION(1, 5, 0) <= IMB_VERSION_NUM
struct {
alignas(16) uint32_t encode[IMB_SM4_KEY_SCHEDULE_ROUNDS];
/* *< encode key */
@@ -1039,7 +1032,6 @@ struct __rte_cache_aligned aesni_mb_session {
/* *< Expanded SM4 keys - Original 128 bit key is
* expanded into 32 round keys, each 32 bits.
*/
-#endif
};
} cipher;
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] crypto/ipsec_mb: require minimum version 2.0 for IPsec MB
2026-08-11 11:26 [PATCH] crypto/ipsec_mb: require minimum version 2.0 for IPsec MB Radu Nicolau
@ 2026-08-11 15:53 ` Stephen Hemminger
2026-08-11 16:21 ` Radu Nicolau
0 siblings, 1 reply; 3+ messages in thread
From: Stephen Hemminger @ 2026-08-11 15:53 UTC (permalink / raw)
To: Radu Nicolau; +Cc: dev, Kai Ji, Pablo de Lara
On Tue, 11 Aug 2026 11:26:35 +0000
Radu Nicolau <radu.nicolau@intel.com> wrote:
> Increase the minimum required IPsec MB library version to 2.0
> As a consequence, clean up the aesni_mb PMD code.
>
> Signed-off-by: Radu Nicolau <radu.nicolau@intel.com>
> ---
What happens if user has out of date library?
Is it detected at build config time with reasonable warning?
What was release date?
Debian changelog says 2.0 was introduced in 18 Sep 2024
and is Debian stable (trixie).
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] crypto/ipsec_mb: require minimum version 2.0 for IPsec MB
2026-08-11 15:53 ` Stephen Hemminger
@ 2026-08-11 16:21 ` Radu Nicolau
0 siblings, 0 replies; 3+ messages in thread
From: Radu Nicolau @ 2026-08-11 16:21 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: dev, Kai Ji, Pablo de Lara
On 11-Aug-26 4:53 PM, Stephen Hemminger wrote:
> On Tue, 11 Aug 2026 11:26:35 +0000
> Radu Nicolau <radu.nicolau@intel.com> wrote:
>
>> Increase the minimum required IPsec MB library version to 2.0
>> As a consequence, clean up the aesni_mb PMD code.
>>
>> Signed-off-by: Radu Nicolau <radu.nicolau@intel.com>
>> ---
> What happens if user has out of date library?
> Is it detected at build config time with reasonable warning?
At config time the PMDs will be disabled with a warning explaining the
reason: "IPSec_MB version >= 2.0.0 is required, found version 1.5.0".
> What was release date?
> Debian changelog says 2.0 was introduced in 18 Sep 2024
> and is Debian stable (trixie).
According to
https://github.com/intel/intel-ipsec-mb/releases#release-v2.0 it's
November 2024
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-11 16:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-11 11:26 [PATCH] crypto/ipsec_mb: require minimum version 2.0 for IPsec MB Radu Nicolau
2026-08-11 15:53 ` Stephen Hemminger
2026-08-11 16:21 ` Radu Nicolau
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox