[dpdk-users] IPsec offload for ixgbe/i40e drivers

[dpdk-users] IPsec offload for ixgbe/i40e drivers

[Avi Cohen (A)]

Hi,
These Intel  NIC's:  X540, 82599, I40E - supports IPsec offload               
But I don't see that the drivers  supplied by Intel - handle it (??)       
Also I don't see any reference in the DPDK userspace drivers  librte_pmd_ixgbe.c ..             
Can someone tell if this is supported somewhere ?               
Best Regards           
Avi

Re: [dpdk-users] [ovs-discuss] IPsec offload for ixgbe/i40e drivers

[Greg Rose]

On 10/03/2017 05:35 AM, Avi Cohen (A) wrote:
> Hi,
> These Intel  NIC's:  X540, 82599, I40E - supports IPsec offload
> But I don't see that the drivers  supplied by Intel - handle it (??)
> Also I don't see any reference in the DPDK userspace drivers  librte_pmd_ixgbe.c ..
> Can someone tell if this is supported somewhere ?
> Best Regards
> Avi

Maybe ask the guys at Intel?

https://lists.osuosl.org/mailman/listinfo/intel-wired-lan

Regards,

- Greg

> _______________________________________________
> discuss mailing list
> discuss@openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
> 

Re: [dpdk-users] [ovs-discuss] IPsec offload for ixgbe/i40e drivers

[Stokes, Ian]

> On 10/03/2017 05:35 AM, Avi Cohen (A) wrote:
> > Hi,
> > These Intel  NIC's:  X540, 82599, I40E - supports IPsec offload But I
> > don't see that the drivers  supplied by Intel - handle it (??) Also I
> > don't see any reference in the DPDK userspace drivers
> librte_pmd_ixgbe.c ..
> > Can someone tell if this is supported somewhere ?
> > Best Regards
> > Avi
> 

Hi Avi,

The NICs do support the IPsec offload feature but currently this is not supported in DPDK.

There is ongoing work with regards the RTE_SECURITY interfaces which will be used to handle this type of offload in the DPDK community . It will not be just Intel nics supporting this feature and is expected that all nics that do support it with DPDK will use the RTE_SECURITY framework. There is an ongoing discussion on the DPDK ML with regards to its design and use below

http://dpdk.org/dev/patchwork/patch/29835/

Currently I'm also looking at implementing IPsec (non-offload, look aside only) using VPMDs and QAT devices in OVS with DPDK although this work is at early stages. It may be of use to you as I would hope to integrate it with offload functionality down the line.

If you have any feedback I would be interested to hear.

https://mail.openvswitch.org/pipermail/ovs-dev/2017-August/337919.html

Thanks
Ian
> Maybe ask the guys at Intel?
> 
> https://lists.osuosl.org/mailman/listinfo/intel-wired-lan
> 
> Regards,
> 
> - Greg

> 
> > _______________________________________________
> > discuss mailing list
> > discuss@openvswitch.org
> > https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
> >
> 
> _______________________________________________
> discuss mailing list
> discuss@openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-discuss

Re: [dpdk-users] [ovs-discuss] IPsec offload for ixgbe/i40e drivers

[Avi Cohen (A)]

Thank You Ian
I'll look into it and update you
Best Regards
Avi

> -----Original Message-----
> From: Stokes, Ian [mailto:ian.stokes@intel.com]
> Sent: Monday, 09 October, 2017 1:10 PM
> To: Greg Rose; Avi Cohen (A); users@dpdk.org; ovs-discuss@openvswitch.org
> Subject: RE: [ovs-discuss] IPsec offload for ixgbe/i40e drivers
> 
> > On 10/03/2017 05:35 AM, Avi Cohen (A) wrote:
> > > Hi,
> > > These Intel  NIC's:  X540, 82599, I40E - supports IPsec offload But
> > > I don't see that the drivers  supplied by Intel - handle it (??)
> > > Also I don't see any reference in the DPDK userspace drivers
> > librte_pmd_ixgbe.c ..
> > > Can someone tell if this is supported somewhere ?
> > > Best Regards
> > > Avi
> >
> 
> Hi Avi,
> 
> The NICs do support the IPsec offload feature but currently this is not supported
> in DPDK.
> 
> There is ongoing work with regards the RTE_SECURITY interfaces which will be
> used to handle this type of offload in the DPDK community . It will not be just
> Intel nics supporting this feature and is expected that all nics that do support it
> with DPDK will use the RTE_SECURITY framework. There is an ongoing
> discussion on the DPDK ML with regards to its design and use below
> 
> http://dpdk.org/dev/patchwork/patch/29835/
> 
> Currently I'm also looking at implementing IPsec (non-offload, look aside only)
> using VPMDs and QAT devices in OVS with DPDK although this work is at early
> stages. It may be of use to you as I would hope to integrate it with offload
> functionality down the line.
> 
> If you have any feedback I would be interested to hear.
> 
> https://mail.openvswitch.org/pipermail/ovs-dev/2017-August/337919.html
> 
> Thanks
> Ian
> > Maybe ask the guys at Intel?
> >
> > https://lists.osuosl.org/mailman/listinfo/intel-wired-lan
> >
> > Regards,
> >
> > - Greg
> 
> >
> > > _______________________________________________
> > > discuss mailing list
> > > discuss@openvswitch.org
> > > https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
> > >
> >
> > _______________________________________________
> > discuss mailing list
> > discuss@openvswitch.org
> > https://mail.openvswitch.org/mailman/listinfo/ovs-discuss

Re: [dpdk-users] [ovs-discuss] IPsec offload for ixgbe/i40e drivers

[Stokes, Ian]

> Thank You Ian
> I'll look into it and update you
> Best Regards
> Avi

No problem Avi,

One minor correction to my original reply, I don't the X710/XL710 i40e devices support ipsec offload functionality (at least not from what I can see in their data sheets). The Intel X540 and 82599 family of NICs do have support. Their datasheets have the specifics with regards to capabilities.

Thanks
Ian
> 
> > -----Original Message-----
> > From: Stokes, Ian [mailto:ian.stokes@intel.com]
> > Sent: Monday, 09 October, 2017 1:10 PM
> > To: Greg Rose; Avi Cohen (A); users@dpdk.org;
> > ovs-discuss@openvswitch.org
> > Subject: RE: [ovs-discuss] IPsec offload for ixgbe/i40e drivers
> >
> > > On 10/03/2017 05:35 AM, Avi Cohen (A) wrote:
> > > > Hi,
> > > > These Intel  NIC's:  X540, 82599, I40E - supports IPsec offload
> > > > But I don't see that the drivers  supplied by Intel - handle it
> > > > (??) Also I don't see any reference in the DPDK userspace drivers
> > > librte_pmd_ixgbe.c ..
> > > > Can someone tell if this is supported somewhere ?
> > > > Best Regards
> > > > Avi
> > >
> >
> > Hi Avi,
> >
> > The NICs do support the IPsec offload feature but currently this is
> > not supported in DPDK.
> >
> > There is ongoing work with regards the RTE_SECURITY interfaces which
> > will be used to handle this type of offload in the DPDK community . It
> > will not be just Intel nics supporting this feature and is expected
> > that all nics that do support it with DPDK will use the RTE_SECURITY
> > framework. There is an ongoing discussion on the DPDK ML with regards
> > to its design and use below
> >
> > http://dpdk.org/dev/patchwork/patch/29835/
> >
> > Currently I'm also looking at implementing IPsec (non-offload, look
> > aside only) using VPMDs and QAT devices in OVS with DPDK although this
> > work is at early stages. It may be of use to you as I would hope to
> > integrate it with offload functionality down the line.
> >
> > If you have any feedback I would be interested to hear.
> >
> > https://mail.openvswitch.org/pipermail/ovs-dev/2017-August/337919.html
> >
> > Thanks
> > Ian
> > > Maybe ask the guys at Intel?
> > >
> > > https://lists.osuosl.org/mailman/listinfo/intel-wired-lan
> > >
> > > Regards,
> > >
> > > - Greg
> >
> > >
> > > > _______________________________________________
> > > > discuss mailing list
> > > > discuss@openvswitch.org
> > > > https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
> > > >
> > >
> > > _______________________________________________
> > > discuss mailing list
> > > discuss@openvswitch.org
> > > https://mail.openvswitch.org/mailman/listinfo/ovs-discuss