From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id ACEC94568A; Wed, 24 Jul 2024 19:09:02 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id C5D2C40B97; Wed, 24 Jul 2024 19:09:01 +0200 (CEST) Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) by mails.dpdk.org (Postfix) with ESMTP id C82234026F for ; Wed, 24 Jul 2024 19:08:59 +0200 (CEST) Received: from mail.maildlp.com (unknown [172.18.186.231]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4WTgQx0Spgz6K9YV; Thu, 25 Jul 2024 01:06:33 +0800 (CST) Received: from frapeml100005.china.huawei.com (unknown [7.182.85.132]) by mail.maildlp.com (Postfix) with ESMTPS id E52B6140A71; Thu, 25 Jul 2024 01:08:57 +0800 (CST) Received: from frapeml500007.china.huawei.com (7.182.85.172) by frapeml100005.china.huawei.com (7.182.85.132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.39; Wed, 24 Jul 2024 19:08:57 +0200 Received: from frapeml500007.china.huawei.com ([7.182.85.172]) by frapeml500007.china.huawei.com ([7.182.85.172]) with mapi id 15.01.2507.039; Wed, 24 Jul 2024 19:08:57 +0200 From: Konstantin Ananyev To: Aakash Sasidharan CC: Akhil Goyal , Jerin Jacob , "Anoob Joseph" , Vidya Sagar Velumuri , "dev@dpdk.org" , "konstantin.v.ananyev@yandex.ru" , "vladimir.medvedkin@intel.com" Subject: RE: [PATCH v2] doc: announce rte_ipsec API changes Thread-Topic: [PATCH v2] doc: announce rte_ipsec API changes Thread-Index: AQHa3QWCQfapjcxCd02Y70ZuvvBjv7IEeVHAgAEQOwCAAIizUA== Date: Wed, 24 Jul 2024 17:08:57 +0000 Message-ID: <114420e03fba4aa7a650c2753758d7f6@huawei.com> References: <20240723130254.2128028-1-asasidharan@marvell.com> <20240723133706.2150828-1-asasidharan@marvell.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.206.138.42] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org > > > In case of event mode operations where event device can help in atomi= c > > > sequence number increment across cores, sequence number need to be > > > provided by the application instead of being updated in rte_ipsec or > > > the PMD. To support this, a new flag > > > ``RTE_IPSEC_SAFLAG_SQN_ASSIGN_DISABLE`` > > > will be added to disable sequence number update inside IPsec library > > > and the API rte_ipsec_pkt_crypto_prepare will be extended to include > > > ``sqn`` as an additional parameter to specify sequence number to be > > > used for IPsec from the application. > > > > Could you probably elaborate a bit more: > > Why such change is necessary for event-dev mode, what exactly will be > > affected in librte_ipsec (would it be for outbound mode, or both), etc. > > >=20 > [Aakash] When using eventdev, it is possible to have multiple cores proce= ss packets from the same flow at the same time, but still > have ordering maintained. >=20 > Sequence for IPsec would be like below, > 1. Ethdev Rx computes flow hash and submits packets to an ORDERED eventde= v queue. > One flow would always hit one event dev queue. > One eventdev queue can be attached to multiple eventdev ports. > 2. Lcores receives packets via these eventdev ports. > Lcores can now process the packets from the same flow in parallel. > 3. Lcores submit the packets to an ATOMIC queue > This is needed as IPsec seq no update needs to be done atomically. > 4. After seq no update, packets are moved to ORDERED queue. > Lcores can now processes the packets in parallel again. > 5. During Tx, eventdev ensures packet ordering based on ORDERED queue. >=20 > Since lib IPsec takes care of sequence number assignment, complete rte_ip= sec_pkt_crypto_prepare() routine need to be made as > ATOMIC stage. > But apart from seq no update, rest of the operations can be done in paral= lel. Thanks for explanation. Basically you are seeking ability to split rte_ipsec_pkt_crypto_prepare() f= or outbound into two stages: 1. update sqn 2. all other preps To be able to do step #2 in parallel, correct? My thought always was that step #2 is not that expensive in terms of perfor= mance, and there probably not much point to make it parallel. But I suppose you measured step#2 overhead on your platform and concluded that it worth it... One concern I have with the way you suggested - now we need to store/update sa.sqn by some external entity. Another thing - don't really want to pollute crypto_prepare() API with new parameters which meaning is a bit obscure and depends on other API calls... =20 Wouldn't it be easier and probably more straightforward to just introduce 2= new functions here that would represent step #1 and step #2? Then we can keep crypto_prepare() intact, and user will have a choice: - either use original crypto_prepare() - nothing needs to be changed - or instead call these new functions on his own, if he wants to. > In addition, we are also looking at another use case when a set of packet= s from a session can be IPsec processed by rte_security > device and some packets from the same session would need to be SW process= ed with lib IPsec. Here again the sequence number > assignment would need to occur at central place so that sequence number i= s not repeated. Interesting, and how SW/HW SQN will be synchronized in that case?=20 =20 > Initially we are looking at outbound only. But similar kind of use case w= ould be applicable for inbound also. >=20 > > > > > > Signed-off-by: Aakash Sasidharan > > > --- > > > doc/guides/rel_notes/deprecation.rst | 7 +++++++ > > > 1 file changed, 7 insertions(+) > > > > > > diff --git a/doc/guides/rel_notes/deprecation.rst > > > b/doc/guides/rel_notes/deprecation.rst > > > index 6948641ff6..bc1d93cca7 100644 > > > --- a/doc/guides/rel_notes/deprecation.rst > > > +++ b/doc/guides/rel_notes/deprecation.rst > > > @@ -133,6 +133,13 @@ Deprecation Notices > > > Since these functions are not called directly by the application, > > > the API remains unaffected. > > > > > > +* ipsec: The rte_ipsec library is updated to support sequence number > > > +provided > > > + by application. A new flag ``RTE_IPSEC_SAFLAG_SQN_ASSIGN_DISABLE`` > > > +is introduced > > > + to disable sequence number assignment in lib IPsec. > > > + The API rte_ipsec_pkt_crypto_prepare is extended to include ``sqn`= ` > > > +as an > > > + additional parameter allowing application to specify the sequence > > > +number to be > > > + used for the IPsec operation. > > > + > > > * pipeline: The pipeline library legacy API (functions rte_pipeline_= *) > > > will be deprecated and subsequently removed in DPDK 24.11 release. > > > Before this, the new pipeline library API (functions > > > rte_swx_pipeline_*) > > > -- > > > 2.25.1 >=20