Re: [dpdk-dev v2 1/2] build: add in option for qat use intel ipsec-mb lib

[Ferruh Yigit <ferruh.yigit@amd.com>]

On 5/19/2022 10:22 AM, Zhang, Roy Fan wrote:

> 
>> -----Original Message-----
>> From: Ferruh Yigit <ferruh.yigit@xilinx.com>
>> Sent: Wednesday, May 18, 2022 11:26 AM
>> To: Richardson, Bruce <bruce.richardson@intel.com>; Ji, Kai
>> <kai.ji@intel.com>
>> Cc: dev@dpdk.org; Zhang, Roy Fan <roy.fan.zhang@intel.com>
>> Subject: Re: [dpdk-dev v2 1/2] build: add in option for qat use intel ipsec-mb
>> lib
>>
>> On 5/18/2022 9:04 AM, Bruce Richardson wrote:
>>> On Tue, May 17, 2022 at 10:16:51PM +0800, Kai Ji wrote:
>>>> Add in build option for QAT pmd use intel ipsec-mb lib
>>>> instead openssl for precompute partial hash & aes.
>>>>
>>>> Signed-off-by: Kai Ji <kai.ji@intel.com>
>>>> ---
>>>>    drivers/common/qat/meson.build | 12 ++++++++++++
>>>>    meson_options.txt              |  2 ++
>>>>    2 files changed, 14 insertions(+)
>>>>
>>>> diff --git a/drivers/common/qat/meson.build
>> b/drivers/common/qat/meson.build
>>>> index b7027f3164..d6eaff3e0e 100644
>>>> --- a/drivers/common/qat/meson.build
>>>> +++ b/drivers/common/qat/meson.build
>>>> @@ -35,6 +35,18 @@ if qat_crypto and not libcrypto.found()
>>>>                'missing dependency, libcrypto')
>>>>    endif
>>>>
>>>> +if get_option('qat_libipsecmb')
>>>> +    IMB_required_ver = '1.0.0'
>>>> +    libipsecmb = cc.find_library('IPSec_MB', required: false)
>>>> +    if not lib.found()
>>>> +        build = false
>>>> +        reason = 'missing dependency, "libIPSec_MB"'
>>>> +    else
>>>> +        ext_deps += libipsecmb
>>>> +        dpdk_conf.set('RTE_QAT_LIBIPSECMB', true)
>>>> +    endif
>>>> +endif
>>>> +
>>>
>>> In general it's not a good idea for individual drivers to add top-level
>>> meson.build options. If every driver does this for all its options we will
>>> have an unmanageable set of hundreds of options. Unfortunately, though,
>> I
>>> don't see a really good way to replace this with something other than a
>>> build option - I assume it's not just good enough to check which of the
>>> dependencies is found/not-found? Is there some way that this can be a
>>> generic option, that may be applicable to other drivers? Could the option
>>> be instead to prioritize FIPs compatibility?
>>>
>>
>> +1 to not have top level meson option for a driver.
>>
>> Will it work to give priority to intel-ipsec-mb lib, like when ipsec-mb
>> library exists use it, else use openssl?
> 
> Hi Ferruh,
> 
> If both ipsec-mb and openssl3.0 presents in the system.
> - Choose openssl 3.0 will result in deprecated API warnings.
> - Choose ipsec-mb will ruin the FIPs compliance of QAT PMD.
> That's why we think it shall be up to user to select which way to do small cipher/hash op.
> 

Hi Fan, got it. So the runtime devarg option Bruce mentioned can be a 
solution, if it works.