Hi,
I have a question regarding the capabilities of the Synopsys
SPAcc (Security Protocol Accelerator) in this driver series.
From the documentation, SPAcc appears to be more than a generic
crypto engine and is described as supporting protocol-level
acceleration (e.g., IPsec, TLS). I would like to clarify the
exact scope of its offload capabilities, specifically for IPsec
ESP processing.
Is SPAcc capable of handling full ESP packet processing (i.e.,
beyond basic encryption/decryption and authentication)?
For example:
Can it parse ESP packets and perform decapsulation
(removing ESP headers/trailers and returning the inner
payload)?
Does it handle sequence number processing and/or
anti-replay checks?
Or is it limited to crypto operations where the
driver/software stack (e.g., Linux XFRM) must handle all
protocol-level processing such as SA lookup, replay
protection, and packet decapsulation?
In other words, should SPAcc be treated as:
a protocol-aware data-path accelerator for ESP
(with partial packet processing), or
a pure crypto offload engine where all IPsec
semantics remain in software?
Clarifying this would help understand how the driver is
expected to integrate with the Linux IPsec/XFRM framework.
Thanks.
Tony
On Wed, Mar 18, 2026 at 3:22 PM Pavitrakumar Managutte
<pavitrakumarm@vayavyalabs.com> wrote:
>
> Add the driver for SPAcc(Security Protocol Accelerator), which is a
> crypto acceleration IP from Synopsys. The SPAcc supports multiple ciphers,
> hashes and AEAD algorithms with various modes. The driver currently supports
> below
>
> hash:
> - cmac(aes)
> - xcbc(aes)
> - cmac(sm4)
> - xcbc(sm4)
> - hmac(md5)
> - md5
> - hmac(sha1)
> - sha1
> - sha224
> - sha256
> - sha384
> - sha512
> - hmac(sha224)
> - hmac(sha256)
> - hmac(sha384)
> - hmac(sha512)
> - sha3-224
> - sha3-256
> - sha3-384
> - sha3-512
> - hmac(sm3)
> - sm3
> - michael_mic
>
> changelog:
> v1->v2 changes:
> - Added local_bh_disable() and local_bh_enable() for the below calls.
> a. for ciphers skcipher_request_complete()
> b. for aead aead_request_complete()
> c. for hash ahash_request_complete()
> - dt-bindings updates
> a. removed snps,vspacc-priority and made it into config option
> b. renamed snps,spacc-wdtimer to snps,spacc-internal-counter
> c. Added description to all properties
> - Updated corresponding dt-binding changes to code
>
> v2->v3 changes:
> - cra_init and cra_exit replaced with init_tfm and exit_tfm for hashes.
> - removed mutex_lock/unlock for spacc_skcipher_fallback call
> - dt-bindings updates
> a. updated SOC related information
> b. renamed compatible string as per SOC
> - Updated corresponding dt-binding changes to code
>
> v3->v4 changes:
> - removed snps,vspacc-id from the dt-bindings
> - removed mutex_lock from ciphers
> - replaced magic numbers with macros
> - removed sw_fb variable from struct mode_tab and associated code from the
> hashes
> - polling code is replaced by wait_event_interruptible
>
> v4->v5 changes:
> - Updated to register with the crypto-engine
> - Used semaphore to manage SPAcc device hardware context pool
> - This patchset supports Hashes only
> - Dropping the support for Ciphers and AEADs in this patchset
> - Added Reviewed-by tag on the Device tree patch since it was reviewed on
> v4 patch by Krzysztof Kozlowski and Rob Herring (Arm)
>
> v5->v6 changes:
> - Removed CRYPTO_DEV_SPACC_CIPHER and CRYPTO_DEV_SPACC_AEAD Kconfig options,
> since the cipher and aead support is not part of this patchset
> - Dropped spacc_skcipher.o and spacc_aead.o from Makefile to fix build errors
> reported by kernel test robot
> - Added Reported-by and Closes tags as suggested
>
> v6->v7 changes:
> - Fixed build error reported by Kernel test robot
> - Added Reported-by and Closes tags as suggested
>
> v7->v8 changes:
> - Fixed misleading comment: Clarified that only HMAC key pre-processing
> is done in software, while the actual HMAC operation is performed by
> hardware
> - Simplified do_shash() function signature by removing unused parameters
> - Updated all do_shash() call sites to use new simplified signature
> - Fixed commit message formatting by adding "crypto: spacc - <subject>" to
> all patches
> - used __free() for scope based resource management
>
> v8->v9 changes:
> - Updated the software fallback implementation to use HASH_FBREQ_ON_STACK
> - Corrected dynamic allocation of statesize and reqsize in init_tfm
> - Fixed synchronization issues in the digest request
>
> v9->v10 changes:
> - Fixed unused variable warning
>
> v10->v11 changes:
> - Removed the redundant crypto_alloc_ahash in the init_tfm function
> - Removed the redundant crypto_free_ahash in exit_tfm function
> - Removed the redundant crypto_ahash_setkey call in setkey function
>
> Pavitrakumar Managutte (4):
> dt-bindings: crypto: Document support for SPAcc
> crypto: spacc - Add SPAcc ahash support
> Add SPAcc AUTODETECT Support
> crypto: spacc - Add SPAcc Kconfig and Makefile
>
> .../bindings/crypto/snps,dwc-spacc.yaml | 50 +
> drivers/crypto/Kconfig | 1 +
> drivers/crypto/Makefile | 1 +
> drivers/crypto/dwc-spacc/Kconfig | 88 +
> drivers/crypto/dwc-spacc/Makefile | 8 +
> drivers/crypto/dwc-spacc/spacc_ahash.c | 886 ++++++
> drivers/crypto/dwc-spacc/spacc_core.c | 2413 +++++++++++++++++
> drivers/crypto/dwc-spacc/spacc_core.h | 827 ++++++
> drivers/crypto/dwc-spacc/spacc_device.c | 276 ++
> drivers/crypto/dwc-spacc/spacc_device.h | 236 ++
> drivers/crypto/dwc-spacc/spacc_hal.c | 374 +++
> drivers/crypto/dwc-spacc/spacc_hal.h | 114 +
> drivers/crypto/dwc-spacc/spacc_interrupt.c | 328 +++
> drivers/crypto/dwc-spacc/spacc_manager.c | 610 +++++
> 14 files changed, 6212 insertions(+)
> create mode 100644 Documentation/devicetree/bindings/crypto/snps,dwc-spacc.yaml
> create mode 100644 drivers/crypto/dwc-spacc/Kconfig
> create mode 100644 drivers/crypto/dwc-spacc/Makefile
> create mode 100644 drivers/crypto/dwc-spacc/spacc_ahash.c
> create mode 100644 drivers/crypto/dwc-spacc/spacc_core.c
> create mode 100644 drivers/crypto/dwc-spacc/spacc_core.h
> create mode 100644 drivers/crypto/dwc-spacc/spacc_device.c
> create mode 100644 drivers/crypto/dwc-spacc/spacc_device.h
> create mode 100644 drivers/crypto/dwc-spacc/spacc_hal.c
> create mode 100644 drivers/crypto/dwc-spacc/spacc_hal.h
> create mode 100644 drivers/crypto/dwc-spacc/spacc_interrupt.c
> create mode 100644 drivers/crypto/dwc-spacc/spacc_manager.c
>
>
> base-commit: c708d3fad4217f23421b8496e231b0c5cee617a0
> --
> 2.25.1
>
>