Bug Fixes, README update and Version bump to v1.6.0

- Version bump and Readme update
 - Binary RPM update
 - Fix AES-CCM in Openssl_3.2 provider
 - SVM aes-gcm testapp invalid ptr fix
 - Clean up duplicate mutex unlocks
 - Fix for system openssl sm3 compilation warns

Signed-off-by: Nagha Abirami <[email protected]>
Co-authored-by: Jaya Naga Venkata Sudhakar <[email protected]>
Co-authored-by: Yogaraj Alamenda <[email protected]>

Author: 3 people

README.md

@@ -164,21 +164,20 @@ QAT gen4 devices.
 </details>
 </details>
 <details>
-<summary>Install OpenSSL*    (Note this step is not required if OpenSSL* 1.1.1 or 3.0 is already installed)</summary>
+<summary>Install OpenSSL*    (Note this step is not required if OpenSSL* is already installed)</summary>
 
 ## Build OpenSSL\*
 
 This step is not required if building the Intel&reg; QAT OpenSSL\* Engine
-against system prebuilt OpenSSL\* 1.1.1 or 3.0. When using the prebuild system OpenSSL library
+against system prebuilt OpenSSL\* . When using the prebuild system OpenSSL library
 the engine library is installed in the system OpenSSL engines directory.
 
 Clone OpenSSL\* from Github\* at the following location:
 
     git clone https://github.com/openssl/openssl.git
 
 It is recommended to checkout and build against the OpenSSL\* git tag
-specified in the Software Requirements section. OpenSSL\* Version 1.1.1
-and 3.0 are only supported.
+specified in the Software Requirements section.
 
 Due to the nature of the Intel&reg; QAT OpenSSL\* Engine being a dynamic engine
 it can only be used with shared library builds of OpenSSL\*.
@@ -282,7 +281,7 @@ Here are a few example builds that demonstrate how the Intel&reg; QAT OpenSSL\*
 Engine can be configured to use qat_hw and/or qat_sw.
 
 <details>
-<summary>Example 1: qat_hw target with OpenSSL\* 1.1.1 or 3.0 built from source</summary>
+<summary>Example 1: qat_hw target with OpenSSL\* built from source</summary>
 <br>
 
 The following example is assuming:
@@ -291,7 +290,7 @@ The following example is assuming:
   of the drive: `/`.
 * The Intel&reg; QAT Driver version 1.7 or 2.0 was unpacked within `/QAT` and using
   the USDM component.
-* OpenSSL\* 1.1.1 or 3.0 built from source is being used and installed to `/usr/local/ssl`.
+* OpenSSL\* built from source is being used and installed to `/usr/local/ssl`.
 
 To build and install the Intel&reg; QAT OpenSSL\* Engine:
 
@@ -305,7 +304,7 @@ make install
 ```
 
 In the above example this will create the file `qatengine.so` and copy it to
-`/usr/local/ssl/lib/engines-1.1`.
+`/usr/local/ssl/lib64/engines-3`.
 
 For building QAT Engine against qatlib(intree driver) from source which is
 installed to default location "/usr/local" use `--with-qat_hw_dir=/usr/local`
@@ -319,7 +318,7 @@ libraries and headers from the default location `/usr/lib64`.
 </details>
 
 <details>
-<summary>Example 2: qat_hw target with Prebuilt OpenSSL\* 1.1.1 or 3.0</summary>
+<summary>Example 2: qat_hw target with Prebuilt OpenSSL\* </summary>
 <br>
 
 The following example is assuming:
@@ -328,7 +327,7 @@ The following example is assuming:
 * The Intel&reg; QAT Driver was unpacked within `/QAT` and using
   the USDM component.
 * Prebuilt OpenSSL\* (both library and devel RPM packages) are installed in
-  the system and the OpenSSL\* version is in the `1.1.1 or 3.0` series.
+  the system and the OpenSSL\* version is `3.0` or above.
 
 To build and install the Intel&reg; QAT OpenSSL\* Engine:
 
@@ -351,7 +350,7 @@ libraries and headers from the default location `/usr/lib64`.
 </details>
 
 <details>
-<summary>Example 3: qat_hw + qat_sw target with Prebuilt OpenSSL\* 1.1.1 or 3.0</summary>
+<summary>Example 3: qat_hw + qat_sw target with Prebuilt OpenSSL\* </summary>
 <br>
 
 The following example is assuming:
@@ -361,7 +360,7 @@ The following example is assuming:
 * The Intel&reg; QAT Driver was unpacked within `/QAT` and using
   the USDM component.
 * Intel&reg; Multi-Buffer Crypto for IPsec Library was installed to the default path
-* OpenSSL\* 1.1.1 or 3.0 built from source is being used and installed to `/usr/local/ssl`.
+* OpenSSL\* built from source is being used and installed to `/usr/local/ssl`.
 
 To build and install the Intel&reg; QAT OpenSSL\* Engine:
 
@@ -376,15 +375,15 @@ make install
 ```
 
 - In the above example this will create the file `qatengine.so` and copy it to
-  `/usr/local/ssl/lib/engines-1.1`.
+  `/usr/local/ssl/lib64/engines-3`.
 - AES-GCM operations are handled by qat_sw
 - Other cryptographic operations are handled by qat_hw
 
 <br>
 </details>
 
 <details>
-<summary>Example 4: qat_sw target with Prebuilt OpenSSL\* 1.1.1 or 3.0 </summary>
+<summary>Example 4: qat_sw target with Prebuilt OpenSSL\* </summary>
 <br>
 
 The following example is assuming:
@@ -395,7 +394,7 @@ The following example is assuming:
   (/usr/local).
 * The Intel&reg; Multi-Buffer crypto for IPsec Library was installed to its
   default path (/usr/). (Optional if QAT SW AES-GCM support is not needed).
-* Prebuilt OpenSSL\* 1.1.1 or 3.0 from the system is used.
+* Prebuilt OpenSSL\* from the system is used.
 
 To build and install the Intel&reg; QAT OpenSSL\* Engine with QAT Software support:
 
@@ -661,8 +660,6 @@ Additional information for testapp tests available with the help option
 
 
 
-## Key Protection Technology(KPT) feature
-Please refer to: [KPT README](docs/KPT_Feature.md)
 
 ## Troubleshooting
 Troubleshooting information is available [here](docs/troubleshooting.md).

configure.ac

@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.68])
-AC_INIT([qatengine], [1.5.0], [])
+AC_INIT([qatengine], [1.6.0], [])
 AC_CONFIG_SRCDIR([config.h.in])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_AUX_DIR([.])
@@ -638,6 +638,16 @@ then
         fi
     fi
 fi
+#System OpenSSL
+if test "x$with_openssl_install_dir" = "x"
+then
+  AC_CHECK_LIB([crypto],[EVP_sm3],[with_sm3_support_h=yes],[with_sm3_support_h=no])
+  if test "x$with_sm3_support_h" = "xno"
+  then
+    AC_SUBST([cflags_qat_hw], ["${cflags_qat_hw} -DOPENSSL_NO_SM2_SM3"])
+    AC_MSG_NOTICE([SM3 support not available in system OpenSSL])
+  fi
+fi
 
 #Enable additional QAT_HW & QAT_SW flags
 AS_IF([test "x$enable_qat_debug" = "xyes"], 
@@ -830,8 +840,11 @@ echo "QAT_SW ALGORITHMS :" [$cflags_qat_sw]
 echo "ADDITIONAL FLAGS  :" [$cflags_common $cflags_openssl_3 $cflags_boringssl]
 if test "x$cflags_qat_hw" != "x"
 then
+  if test "x$cflags_qat_hw_intree" = "x"
+  then
   AC_CHECK_FILE(${with_qat_hw_dir}/build/libqat_s.so, [],
                 [echo "QAT_HW Driver library not found in $with_qat_hw_dir/build. Install it & try again or proceed with 'make depend' target to install dependencies"])
+  fi
 fi
 if test "x$cflags_qat_sw" != "x"
 then

docs/config_options.md

@@ -161,7 +161,7 @@ The following is a list of the options that can be used with the
     Disable/Enable Intel(R) QAT Hardware SM4-CBC acceleration.(disabled by default)
     This flag is valid only on 4xxx(QAT gen 4 devices) as the support is not available
     for earlier generations of QAT devices (e.g. c62x, dh895xxcc, etc.) and QAT Engine
-    is built with BabaSSL only
+    is built with Tongsuo only
 
 --disable-qat_hw_sha3/--enable-qat_hw_sha3
     Disable/Enable Intel(R) QAT Hardware SHA-3 acceleration (disabled by default).
@@ -222,19 +222,19 @@ The following is a list of the options that can be used with the
 --disable-qat_sw_sm4_cbc/--enable-qat_sw_sm4_cbc
     Disable/Enable Intel(R) QAT Software SM4-CBC acceleration.
     This flag is valid only when QAT SW acceleration is enabled using the
-    flag '--enable-qat_sw' and QAT Engine is built with BabaSSL only
+    flag '--enable-qat_sw' and QAT Engine is built with Tongsuo only
     (disabled by default if qat_sw is enabled).
 
 --disable-qat_sw_sm4_gcm/--enable-qat_sw_sm4_gcm
     Disable/Enable Intel(R) QAT Software SM4-GCM acceleration.
     This flag is valid only when QAT SW acceleration is enabled using the
-    flag '--enable-qat_sw' and QAT Engine is built with BabaSSL only
+    flag '--enable-qat_sw' and QAT Engine is built with Tongsuo only
     (disabled by default if qat_sw is enabled).
 
 --disable-qat_sw_sm4_ccm/--enable-qat_sw_sm4_ccm
     Disable/Enable Intel(R) QAT Software SM4-CCM acceleration.
     This flag is valid only when QAT SW acceleration is enabled using the
-    flag '--enable-qat_sw' and QAT Engine is built with BabaSSL only
+    flag '--enable-qat_sw' and QAT Engine is built with Tongsuo only
     (disabled by default if qat_sw is enabled).
 
 --enable-qat_small_pkt_offload
@@ -310,7 +310,7 @@ The following is a list of the options that can be used with the
 
 --enable-qat_ntls
     Enable ntls in engine for handing NTLS requests which is needed for SMx
-    with BabaSSL (disabled by default).
+    with Tongsuo (disabled by default).
 
 --enable-qat_insecure_algorithms
     Enables insecure algorithms RSA < 2048, DH, DSA, ECDH curves with bitlen

docs/features.md

@@ -48,9 +48,9 @@ Please refer [here](qat_hw_algo.md) for supported platforms list and default beh
         * NIST Prime Curves: P-256/P-384
         * SM2
     * SM3 Hash Support using 16 Multibuffer requests (Experimental)
-    * SM4-CBC Support using 16 Multibuffer requests (BabaSSL only)
-    * SM4-GCM Support using 16 Multibuffer requests (BabaSSL only)
-    * SM4-CCM Support using 16 Multibuffer requests (BabaSSL only)
+    * SM4-CBC Support using 16 Multibuffer requests (Tongsuo only)
+    * SM4-GCM Support using 16 Multibuffer requests (Tongsuo only)
+    * SM4-CCM Support using 16 Multibuffer requests (Tongsuo only)
     * AES128-GCM, AES192-GCM and AES256-GCM
 
 ## Common Features to qat_hw & qat_sw

docs/limitations.md

@@ -11,7 +11,7 @@
 * **qat_contig_mem** memory driver is not supported when running under FreeBSD
   Operating system or in the qatlib RPM. The default is to use the USDM memory
   driver supplied as part of the Intel® QAT Driver.
-* **SM2, SM3 & SM4** application testing is done using BabaSSL only since OpenSSL
+* **SM2, SM3 & SM4** application testing is done using Tongsuo only since OpenSSL
   doesn't support SMx cipher suites.
 * QAT Engine doesn't support **ENCRYPT_THEN_MAC**(default) mode of operation meaning
   when Encrypt then MAC is negotiated for symmetric ciphers say AES-CBC, the requests will not
@@ -38,9 +38,8 @@
   algorithm support.
 * QAT Engine built for OpenSSL3.0 is only compatible with dependent libraries also linked with OpenSSL3.0
   libraries due to [OpenSSL#17112][1]. Same applies for OpenSSL 1.1.1.
-* SM4-GCM and SM4-CCM are only supported with BabaSSL versions based on OpenSSL 1.1.1.
-  They are not supported with OpenSSL 1.1.1, OpenSSL 3.0 and BabaSSL versions based
-  on OpenSSL 3.0.
+* SM4-GCM, SM4-CCM and SM4-CBC are only supported with Tongsuo and they are not supported with OpenSSL.
+* Handshake Failures with X25519/X448 which is fixed in [Tongsuo#563][7] and SM2 init Failure in Speed test is fixed in [Tongsuo#590][8]. These issues observed in Tongsuo only and not in OpenSSL.
 * HKDF based on SM3 is not supported in QAT_HW, The request will fallback to OpenSSL software if
   fallback been enabled otherwise failures are observed.
 * There is a limitation with thread specific USDM: *memory allocated in one thread
@@ -112,6 +111,7 @@
 * Nginx Handshake Performance in OpenSSL3.0 is slightly slower compared to OpenSSL 1.1.1. The same
   behaviour is observed in OpenSSL_SW as well [OpenSSL#21833][6].
 * Performance scaling is not linear in QAT2.0 supported platforms in ECDSA and chacha-poly algorithms.
+* Performance drop observed with ECDSAP256 algorithm in the OpenSSL speed tests with FreeBSD 14 intree driver.
 
   Articles:
 
@@ -127,3 +127,5 @@
 [4]:https://github.com/openssl/openssl/issues/21622
 [5]:https://github.com/openssl/openssl/issues/18509
 [6]:https://github.com/openssl/openssl/issues/21833
+[7]:https://github.com/Tongsuo-Project/Tongsuo/pull/563
+[8]:https://github.com/Tongsuo-Project/Tongsuo/pull/590

docs/openssl_config.md

@@ -113,8 +113,8 @@ an additional `init` setting that is out of scope of the documentation here.
 
 For further details on using the OpenSSL\* configuration file please see the
 OpenSSL\* online documentation located at:
-<https://www.openssl.org/docs/man1.1.0/apps/config.html>
+<https://www.openssl.org/docs/man3.0/man5/config.html>
 
 By setting up the configuration file as above it is possible for instance to run
 the OpenSSL\* speed application to use the Intel&reg; QAT OpenSSL\* Engine
-without needing to specify `-engine qatengine` as a command line option.
+without needing to specify `-engine qatengine` as a command line option.

docs/qat_common.md

@@ -25,8 +25,8 @@ and the default if not specified will use engine interface.
 | SHA3-384 | QAT_HW |
 | SHA3-512 | QAT_HW |
 | ChachaPoly | QAT_HW |
-| SM4-GCM (BabaSSL only) | QAT_SW |
-| SM4-CCM (BabaSSL only) | QAT_SW |
+| SM4-GCM (Tongsuo only) | QAT_SW |
+| SM4-CCM (Tongsuo only) | QAT_SW |
 | SM4-CBC | QAT_HW & QAT_SW |
 | SM3 | QAT_HW & QAT_SW |
 | AES-CCM | QAT_HW |

docs/qat_hw_algo.md

@@ -34,6 +34,6 @@
 \* Enabled in the default build of qatengine for the specified platforms when `--with-qat_hw_dir` is provided in qatengine/qatprovider build configure.<br>
 \** Insecure algorithms which are disabled by default in QAT_HW driver version 1.7 & 1.8 and qatengine/qatprovider. Can be enabled using configure flag `--enable-qat_insecure_algorithms`. Driver will also needs to be built with the flag `./configure --enable-legacy-algorithms` to enable these algorithms at driver.<br>
 \*** Algorithms disabled by default as those are experimental.<br>
-\# Disabled by default as it is specific to BabaSSL and not applicable to OpenSSL. To be enabled when qatengine is built with BabaSSL.
+\# Disabled by default as it is specific to Tongsuo and not applicable to OpenSSL. To be enabled when qatengine is built with Tongsuo.
 
 Please refer [config_options](config_options.md) on details about algorithm enable/disable flags.

docs/software_requirements.md

@@ -6,12 +6,14 @@ that supports OpenSSL\* 1.1.1 or OpenSSL\* 3.0 or BoringSSL\* and Intel® Qui
 Technology Driver for Linux or Intel®  QuickAssist Technology
 Driver for FreeBSD. This release was validated on the following:
 
-* Intel® QuickAssist Technology Driver for Linux\* HW Version 2.0 (RHEL\* 8.6) - **QAT20.L.1.0.50-00003**
-* Intel® QuickAssist Technology Driver for Linux\* HW Version 1.7 & 1.8 (CentOS\* 8.4 & Ubuntu\* 20.04.2) - **QAT.L.4.23.0-00001**
+* Intel® QuickAssist Technology Driver for Linux\* HW Version 2.0 (RHEL\* 8.6) - **QAT20.L.1.1.4000018**
+* Intel® QuickAssist Technology Driver for Linux\* HW Version 1.7 & 1.8 (CentOS\* 8.4 & Ubuntu\* 20.04.2) - **QAT.L.4.24.0-00005**
 * Intel® QuickAssist Technology Driver for FreeBSD\* HW Version 1.7 (FreeBSD\* 12.4) - **QAT.B.3.12.0-00004**
-* OpenSSL\* 1.1.1w (for FreeBSD only) & 3.0.12
+* Intel® QATlib for Linux - **QATlib 24.02.0**
+* Intel® QATlib for FreeBSD (FreeBSD 14)- **FreeBSD QATlib 23.09.0**
+* OpenSSL\* 1.1.1w (for FreeBSD only) & 3.0.13
 * BoringSSL\* commit - [23ed9d3][1]
-* BabaSSL - 8.3.3 for qatengine and 8.4-stable for qatprovider
+* Tongsuo - 8.4.0 (BabaSSL)
 
 ## qat_sw Requirements
 Successful operation of the Intel® QAT Software acceleration requires a
@@ -29,11 +31,11 @@ This release was validated on the following:
 
 * Operating system: Ubuntu\* 20.04.2 LTS
 * Intel® Crypto Multi-buffer library from the [ipp-crypto][2] release
-  version **IPP Crypto 2021.10**
+  version **IPP Crypto 2021.11** for OpenSSL & Tongsuo-8.4.0 (BabaSSL) and **IPP Crypto 2021.10** for BoringSSL
 * Intel® Multi-Buffer crypto for IPsec Library release version **v1.5**
-* OpenSSL\* 3.0.12
+* OpenSSL\* 3.0.13
 * BoringSSL\* commit - [23ed9d3][1]
-* BabaSSL - 8.3.3 for qatengine and 8.4-stable for qatprovider
+* Tongsuo - 8.4.0 (BabaSSL)
 
 [1]:https://github.com/google/boringssl/commit/23ed9d3852bbc738bebeaa0fe4a0782f91d7873c
 [2]:https://github.com/intel/ipp-crypto

driver_install.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 
 #QAT_HW OOT driver Location
-QAT17_DRIVER=https://downloadmirror.intel.com/788561/QAT.L.4.23.0-00001.tar.gz
-QAT20_DRIVER=https://downloadmirror.intel.com/783270/QAT20.L.1.0.50-00003.tar.gz
+QAT17_DRIVER=https://downloadmirror.intel.com/795697/QAT.L.4.24.0-00005.tar.gz
+QAT20_DRIVER=https://downloadmirror.intel.com/818498/QAT20.L.1.1.40-00018.tar.gz
 
 #Supported Devices
 numC62xDevice=`lspci -vnd 8086: | grep -c "37c8\|37c9"`

e_qat.c

@@ -164,13 +164,13 @@ int qat_fips_kat_test;
 const char *engine_qat_id = STR(QAT_ENGINE_ID);
 #if defined(QAT_HW) && defined(QAT_SW)
 const char *engine_qat_name =
-    "Reference implementation of QAT crypto engine(qat_hw & qat_sw) v1.5.0";
+    "Reference implementation of QAT crypto engine(qat_hw & qat_sw) v1.6.0";
 #elif QAT_HW
 const char *engine_qat_name =
-    "Reference implementation of QAT crypto engine(qat_hw) v1.5.0";
+    "Reference implementation of QAT crypto engine(qat_hw) v1.6.0";
 #else
 const char *engine_qat_name =
-    "Reference implementation of QAT crypto engine(qat_sw) v1.5.0";
+    "Reference implementation of QAT crypto engine(qat_sw) v1.6.0";
 #endif
 unsigned int engine_inited = 0;
 int fallback_to_openssl = 0;
@@ -607,6 +607,7 @@ int qat_engine_init(ENGINE *e)
         if (!qat_hw_init(e)) {
 # ifdef ENABLE_QAT_FIPS
             fprintf(stderr, "QAT_HW initialization Failed\n");
+            qat_pthread_mutex_unlock();
             return 0;
 # else
 #  ifdef QAT_SW /* Co-Existence mode: Don't return failure when QAT HW initialization Failed. */
@@ -627,6 +628,7 @@ int qat_engine_init(ENGINE *e)
         if (!qat_sw_init(e)) {
 # ifdef ENABLE_QAT_FIPS
             fprintf(stderr, "QAT_SW initialization Failed\n");
+            qat_pthread_mutex_unlock();
             return 0;
 # else
             WARN("QAT SW initialization Failed, switching to OpenSSL.\n");

ipp-crypto

@@ -379,7 +379,11 @@ const EVP_MD *qat_sw_create_sm3_meth(int nid , int key_type)
 #else
     qat_sw_sm3_offload = 0;
     DEBUG("QAT SW SM3 is disabled, using OpenSSL SW\n");
+# ifdef OPENSSL_NO_SM2_SM3
+    return NULL;
+# else
     return (EVP_MD *)EVP_sm3();
+# endif
 #endif
 }
 

openssl

@@ -992,7 +992,7 @@ static int qat_chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX * ctx, unsigned char
             if (op_done.status == CPA_STATUS_FAIL) {
                 CRYPTO_QAT_LOG("Verification of result failed for qat inst_num %d device_id %d - %s\n",
                                cp_ctx->inst_num,
-                               qat_instance_details[cp_ctx->_inst_num].qat_instance_info.physInstId.packageId, __func__);
+                               qat_instance_details[cp_ctx->inst_num].qat_instance_info.physInstId.packageId, __func__);
                 qat_cleanup_op_done(&op_done);
                 goto tls_cipher_err;
             }
@@ -1322,7 +1322,7 @@ static int qat_chacha20_poly1305_do_cipher(EVP_CIPHER_CTX * ctx, unsigned char *
                     if (op_done.status == CPA_STATUS_FAIL) {
                         CRYPTO_QAT_LOG("Verification of result failed for qat inst_num %d device_id %d - %s\n",
                                        cp_ctx->inst_num,
-                                       qat_instance_details[cp_ctx->_inst_num].qat_instance_info.physInstId.packageId, __func__);
+                                       qat_instance_details[cp_ctx->inst_num].qat_instance_info.physInstId.packageId, __func__);
                         qat_cleanup_op_done(&op_done);
                         goto do_cipher_err;
                     }