[v1] crypto/qat: fix IPsec MB header include for ARM

[v1] crypto/qat: fix IPsec MB header include for ARM

[Emma Finn]

Update the header file to always include the platform-specific
IPsec MB header.

Fixes: 03c475d609eb ("crypto/qat: require IPsec MB for HMAC precomputes")

Reported-by: Thomas Monjalon <thomas@monjalon.net>
Signed-off-by: Emma Finn <emma.finn@intel.com>
---
 drivers/crypto/qat/qat_sym_session.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/qat/qat_sym_session.h b/drivers/crypto/qat/qat_sym_session.h
index 0c7b9cc6cf..b18673a1f7 100644
--- a/drivers/crypto/qat/qat_sym_session.h
+++ b/drivers/crypto/qat/qat_sym_session.h
@@ -14,11 +14,11 @@
 #include "icp_qat_fw.h"
 #include "icp_qat_fw_la.h"
 
-#ifndef RTE_QAT_OPENSSL
-#ifndef RTE_ARCH_ARM
+#ifdef RTE_ARCH_ARM
+#include <ipsec-mb.h>
+#else
 #include <intel-ipsec-mb.h>
 #endif
-#endif
 
 /*
  * Key Modifier (KM) value used in KASUMI algorithm in F9 mode to XOR
-- 
2.43.0

Re: [v1] crypto/qat: fix IPsec MB header include for ARM

[Thomas Monjalon]

30/06/2026 12:01, Emma Finn:
> Update the header file to always include the platform-specific
> IPsec MB header.
> 
> Fixes: 03c475d609eb ("crypto/qat: require IPsec MB for HMAC precomputes")
> 
> Reported-by: Thomas Monjalon <thomas@monjalon.net>
> Signed-off-by: Emma Finn <emma.finn@intel.com>

It solves the previous error, but there is another one:
build-arm64-generic-gcc/../../dpdk/drivers/crypto/qat/qat_sym.h:187:
undefined reference to `des_cfb_one'

It seems des_cfb_one() is not supported on Arm.

[v2] crypto/qat: fix IPsec MB header include for ARM

[Emma Finn]

Update the header file to always include the platform-specific
IPsec MB header. Additionally, guard DOCSIS BPI-related fields
that depend on IPsec MB so they are not included for ARM build.

Fixes: 03c475d609eb ("crypto/qat: require IPsec MB for HMAC precomputes")

Reported-by: Thomas Monjalon <thomas@monjalon.net>
Signed-off-by: Emma Finn <emma.finn@intel.com>
---
v2:
* Add guards around DOCSIS BPI
---
 drivers/crypto/qat/dev/qat_crypto_pmd_gens.h | 2 ++
 drivers/crypto/qat/qat_sym.h                 | 6 +++++-
 drivers/crypto/qat/qat_sym_session.c         | 8 +++++++-
 drivers/crypto/qat/qat_sym_session.h         | 6 +++---
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/crypto/qat/dev/qat_crypto_pmd_gens.h b/drivers/crypto/qat/dev/qat_crypto_pmd_gens.h
index 22ee0fe4fe..40d5594453 100644
--- a/drivers/crypto/qat/dev/qat_crypto_pmd_gens.h
+++ b/drivers/crypto/qat/dev/qat_crypto_pmd_gens.h
@@ -99,9 +99,11 @@ qat_bpicipher_preprocess(struct qat_sym_session *ctx,
 		op_bpi_cipher_decrypt(last_block, dst, iv, block_len,
 				last_block_len, ctx->bpi_ctx);
 #else
+#ifndef RTE_ARCH_ARM
 		bpi_cipher_ipsec(last_block, dst, iv, last_block_len, ctx->expkey,
 			ctx->mb_mgr, ctx->docsis_key_len);
 #endif
+#endif
 #if RTE_LOG_DP_LEVEL >= RTE_LOG_DEBUG
 		QAT_DP_HEXDUMP_LOG(DEBUG, "BPI: src after pre-process:",
 			last_block, last_block_len);
diff --git a/drivers/crypto/qat/qat_sym.h b/drivers/crypto/qat/qat_sym.h
index 849e047615..c4e9d16828 100644
--- a/drivers/crypto/qat/qat_sym.h
+++ b/drivers/crypto/qat/qat_sym.h
@@ -175,6 +175,7 @@ bpi_cipher_encrypt(uint8_t *src, uint8_t *dst,
 	return -EINVAL;
 }
 #else
+#ifndef RTE_ARCH_ARM
 static __rte_always_inline void
 bpi_cipher_ipsec(uint8_t *src, uint8_t *dst, uint8_t *iv, int srclen,
 		uint64_t *expkey, IMB_MGR *m, uint8_t docsis_key_len)
@@ -186,7 +187,8 @@ bpi_cipher_ipsec(uint8_t *src, uint8_t *dst, uint8_t *iv, int srclen,
 	else if (docsis_key_len == ICP_QAT_HW_DES_KEY_SZ)
 		des_cfb_one(dst, src, (uint64_t *)iv, expkey, srclen);
 }
-#endif
+#endif /* RTE_ARCH_ARM */
+#endif /* RTE_QAT_OPENSSL */
 
 static inline uint32_t
 qat_bpicipher_postprocess(struct qat_sym_session *ctx,
@@ -237,9 +239,11 @@ qat_bpicipher_postprocess(struct qat_sym_session *ctx,
 		bpi_cipher_encrypt(last_block, dst, iv, block_len,
 				last_block_len, ctx->bpi_ctx);
 #else
+#ifndef RTE_ARCH_ARM
 		bpi_cipher_ipsec(last_block, dst, iv, last_block_len, ctx->expkey,
 			ctx->mb_mgr, ctx->docsis_key_len);
 #endif
+#endif
 #if RTE_LOG_DP_LEVEL >= RTE_LOG_DEBUG
 		QAT_DP_HEXDUMP_LOG(DEBUG, "BPI: src after post-process:",
 				last_block, last_block_len);
diff --git a/drivers/crypto/qat/qat_sym_session.c b/drivers/crypto/qat/qat_sym_session.c
index 486eb5b54a..6dce9ca786 100644
--- a/drivers/crypto/qat/qat_sym_session.c
+++ b/drivers/crypto/qat/qat_sym_session.c
@@ -204,6 +204,7 @@ bpi_cipher_ctx_init(enum rte_crypto_cipher_algorithm cryptodev_algo,
 #endif
 
 #ifndef RTE_QAT_OPENSSL
+#ifndef RTE_ARCH_ARM
 /** Creates a context in either AES or DES in ECB mode
  */
 static int
@@ -245,7 +246,8 @@ ipsec_mb_ctx_init(const uint8_t *key, uint16_t key_length,
 	}
 	return ret;
 }
-#endif
+#endif /* RTE_ARCH_ARM */
+#endif /* RTE_QAT_OPENSSL */
 
 static int
 qat_is_cipher_alg_supported(enum rte_crypto_cipher_algorithm algo,
@@ -477,6 +479,7 @@ qat_sym_session_configure_cipher(struct rte_cryptodev *dev,
 					cipher_xform->key.length,
 					&session->bpi_ctx);
 #else
+#ifndef RTE_ARCH_ARM
 		session->docsis_key_len = cipher_xform->key.length;
 		ret = ipsec_mb_ctx_init(
 					cipher_xform->key.data,
@@ -485,6 +488,7 @@ qat_sym_session_configure_cipher(struct rte_cryptodev *dev,
 					session->expkey,
 					session->dust,
 					&session->mb_mgr);
+#endif
 #endif
 		if (ret != 0) {
 			QAT_LOG(ERR, "failed to create DES BPI ctx");
@@ -507,6 +511,7 @@ qat_sym_session_configure_cipher(struct rte_cryptodev *dev,
 					cipher_xform->key.length,
 					&session->bpi_ctx);
 #else
+#ifndef RTE_ARCH_ARM
 		session->docsis_key_len = cipher_xform->key.length;
 		ret = ipsec_mb_ctx_init(
 					cipher_xform->key.data,
@@ -515,6 +520,7 @@ qat_sym_session_configure_cipher(struct rte_cryptodev *dev,
 					session->expkey,
 					session->dust,
 					&session->mb_mgr);
+#endif
 #endif
 		if (ret != 0) {
 			QAT_LOG(ERR, "failed to create AES BPI ctx");
diff --git a/drivers/crypto/qat/qat_sym_session.h b/drivers/crypto/qat/qat_sym_session.h
index 0c7b9cc6cf..b18673a1f7 100644
--- a/drivers/crypto/qat/qat_sym_session.h
+++ b/drivers/crypto/qat/qat_sym_session.h
@@ -14,11 +14,11 @@
 #include "icp_qat_fw.h"
 #include "icp_qat_fw_la.h"
 
-#ifndef RTE_QAT_OPENSSL
-#ifndef RTE_ARCH_ARM
+#ifdef RTE_ARCH_ARM
+#include <ipsec-mb.h>
+#else
 #include <intel-ipsec-mb.h>
 #endif
-#endif
 
 /*
  * Key Modifier (KM) value used in KASUMI algorithm in F9 mode to XOR
-- 
2.43.0

Re: [v2] crypto/qat: fix IPsec MB header include for ARM

[Thomas Monjalon]

06/07/2026 13:27, Emma Finn:
> Update the header file to always include the platform-specific
> IPsec MB header. Additionally, guard DOCSIS BPI-related fields
> that depend on IPsec MB so they are not included for ARM build.
> 
> Fixes: 03c475d609eb ("crypto/qat: require IPsec MB for HMAC precomputes")
> 
> Reported-by: Thomas Monjalon <thomas@monjalon.net>
> Signed-off-by: Emma Finn <emma.finn@intel.com>
> ---
> v2:
> * Add guards around DOCSIS BPI

The guards skip some code, leaving some variables unused or unset.
I've fixed them:

--- a/drivers/crypto/qat/dev/qat_crypto_pmd_gens.h
+++ b/drivers/crypto/qat/dev/qat_crypto_pmd_gens.h
@@ -102,6 +102,9 @@ qat_bpicipher_preprocess(struct qat_sym_session *ctx,
 #ifndef RTE_ARCH_ARM
                bpi_cipher_ipsec(last_block, dst, iv, last_block_len, ctx->expkey,
                        ctx->mb_mgr, ctx->docsis_key_len);
+#else
+               RTE_SET_USED(dst);
+               RTE_SET_USED(iv);
 #endif
 #endif
 #if RTE_LOG_DP_LEVEL >= RTE_LOG_DEBUG

--- a/drivers/crypto/qat/qat_sym.h
+++ b/drivers/crypto/qat/qat_sym.h
@@ -242,6 +242,9 @@ qat_bpicipher_postprocess(struct qat_sym_session *ctx,
 #ifndef RTE_ARCH_ARM
                bpi_cipher_ipsec(last_block, dst, iv, last_block_len, ctx->expkey,
                        ctx->mb_mgr, ctx->docsis_key_len);
+#else
+               RTE_SET_USED(dst);
+               RTE_SET_USED(iv);
 #endif
 #endif
 #if RTE_LOG_DP_LEVEL >= RTE_LOG_DEBUG

--- a/drivers/crypto/qat/qat_sym_session.c
+++ b/drivers/crypto/qat/qat_sym_session.c
@@ -387,7 +387,8 @@ qat_sym_session_configure_cipher(struct rte_cryptodev *dev,
        struct rte_crypto_cipher_xform *cipher_xform = NULL;
        enum qat_device_gen qat_dev_gen =
                                internals->qat_dev->qat_dev_gen;
-       int ret, is_wireless = 0;
+       int ret = 0;
+       int is_wireless = 0;
        struct icp_qat_fw_la_bulk_req *req_tmpl = &session->fw_req;
        struct icp_qat_fw_comn_req_hdr *header = &req_tmpl->comn_hdr;

Applied, thanks.