From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id B674AA0350; Tue, 23 Jun 2020 12:36:33 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 841C41D5F8; Tue, 23 Jun 2020 12:36:32 +0200 (CEST) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by dpdk.org (Postfix) with ESMTP id B2B0B1D5EF for ; Tue, 23 Jun 2020 12:36:30 +0200 (CEST) IronPort-SDR: gbC2JXfaNfqqpAXPiJLb+lwiS/snispMHJGAbo89n/QGjr8m7EWQwk8//upc5Tn8ZIK3x+tJQs aRrmLJ3xVVJQ== X-IronPort-AV: E=McAfee;i="6000,8403,9660"; a="205529710" X-IronPort-AV: E=Sophos;i="5.75,271,1589266800"; d="scan'208";a="205529710" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Jun 2020 03:36:29 -0700 IronPort-SDR: wuLzhdtuyFIYygHe6A2Cy+iLSjpaJaBXJxpVdF+qtDIr9stKT+27/NAUA7sl4k7mq7/ZlTQdxD 2mT2XqXILAwA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,271,1589266800"; d="scan'208";a="264755981" Received: from silpixa00399912.ir.intel.com (HELO silpixa00399912.ger.corp.intel.com) ([10.237.223.64]) by fmsmga008.fm.intel.com with ESMTP; 23 Jun 2020 03:36:24 -0700 From: David Coyle To: akhil.goyal@nxp.com, declan.doherty@intel.com, pablo.de.lara.guarch@intel.com, fiona.trahe@intel.com, roy.fan.zhang@intel.com, konstantin.ananyev@intel.com Cc: dev@dpdk.org, thomas@monjalon.net, ferruh.yigit@intel.com, brendan.ryan@intel.com, hemant.agrawal@nxp.com, anoobj@marvell.com, ruifeng.wang@arm.com, lironh@marvell.com, rnagadheeraj@marvell.com, jsrikanth@marvell.com, G.Singh@nxp.com, jianjay.zhou@huawei.com, ravi1.kumar@amd.com, bruce.richardson@intel.com, olivier.matz@6wind.com, honnappa.nagarahalli@arm.com, stephen@networkplumber.org, alexr@mellanox.com, jerinj@marvell.com, David Coyle Date: Tue, 23 Jun 2020 11:14:17 +0100 Message-Id: <20200623101423.9215-1-david.coyle@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200604151324.50704-1-david.coyle@intel.com> References: <20200604151324.50704-1-david.coyle@intel.com> Subject: [dpdk-dev] [PATCH v2 0/6] add support for DOCSIS protocol X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Introduction ============ This patchset adds support for the DOCSIS protocol to the DPDK Security API (rte_security), to be used by the AESNI-MB and QAT crypto devices to combine and accelerate Crypto and CRC functions of the DOCSIS protocol into a single operation. Performing these functions in parallel as a single operation can enable a significant performance improvement in a DPDK-based DOCSIS MAC pipeline. Background ========== A number of approaches to combine DOCSIS Crypto and CRC functions have been discussed in the DPDK community to date, namely: 1) adding a new rte_accelerator API, to provide a generic interface for combining operations of different types 2) using rawdev through a multi-function interface, again to provide a generic interface for combining operations of different types 3) adding support for DOCSIS Crypto-CRC to rte_security The third option above is the preferred approach for the following reasons: - it addresses the immediate use case to add DOCSIS Crypto-CRC support to DPDK so that it can be consumed easily by cable equipment vendors - it uses an already existing framework in DPDK - it will mean much less code churn in DOCSIS applications, which already use rte_cryptodev for encryption/decryption Use Cases ========= The primary use case for this proposal has already been mentioned, namely to add DOCSIS Crypto-CRC support to DPDK: - DOCSIS MAC: Crypto-CRC - Order: - Downstream: CRC, Encrypt - Upstream: Decrypt, CRC - Specifications: - Crypto: 128-bit and 256-bit AES-CFB encryption variant for DOCSIS as described in section 11.1 of DOCSIS 3.1 Security Specification (https://apps.cablelabs.com/specification/CM-SP-SECv3.1) - CRC: Ethernet 32-bit CRC as defined in Ethernet/[ISO/IEC 8802-3] Note that support for these chained operations is already available in the Intel IPSec Multi-Buffer library. However, other DOCSIS protocol functions could be optimized too in the future using the same rte_security API for DOCSIS (e.g. Header Checksum (HCS) calculation). v1: * added proposed API changes * added security capabilities to aesni_mb crypto PMD v2: * added rte_security and rte_cryptodev code changes * added AESNI MB crypto PMD code changes * added QAT SYM crypto PMD code changes * added crypto unit tests * added security unit tests David Coyle (6): cryptodev: add security operation to crypto operation security: add support for DOCSIS protocol crypto/aesni_mb: add support for DOCSIS protocol crypto/qat: add support for DOCSIS protocol test/crypto: add DOCSIS security test cases test/security: add DOCSIS capability check tests app/test/test_cryptodev.c | 552 ++++++ ...t_cryptodev_security_docsis_test_vectors.h | 1544 +++++++++++++++++ app/test/test_security.c | 139 ++ drivers/common/qat/Makefile | 3 + .../crypto/aesni_mb/aesni_mb_pmd_private.h | 19 +- drivers/crypto/aesni_mb/meson.build | 2 +- drivers/crypto/aesni_mb/rte_aesni_mb_pmd.c | 316 +++- .../crypto/aesni_mb/rte_aesni_mb_pmd_ops.c | 127 ++ drivers/crypto/qat/meson.build | 2 + drivers/crypto/qat/qat_sym.c | 139 +- drivers/crypto/qat/qat_sym.h | 82 +- drivers/crypto/qat/qat_sym_capabilities.h | 44 + drivers/crypto/qat/qat_sym_pmd.c | 53 +- drivers/crypto/qat/qat_sym_pmd.h | 4 + drivers/crypto/qat/qat_sym_session.c | 148 ++ drivers/crypto/qat/qat_sym_session.h | 12 + lib/librte_cryptodev/rte_crypto.h | 19 +- lib/librte_cryptodev/rte_cryptodev.c | 5 +- lib/librte_security/rte_security.c | 7 + lib/librte_security/rte_security.h | 116 +- 20 files changed, 3271 insertions(+), 62 deletions(-) create mode 100644 app/test/test_cryptodev_security_docsis_test_vectors.h -- 2.17.1