mbox series

[0/3] add support for DOCSIS protocol to security library

Message ID 20200604151324.50704-1-david.coyle@intel.com (mailing list archive)
Headers
Series add support for DOCSIS protocol to security library |

Message

Coyle, David June 4, 2020, 3:13 p.m. UTC 
  Introduction
============

This patchset adds support for the DOCSIS protocol to the DPDK Security
API (rte_security), to be used by the AESNI-MB and QAT crypto devices to
combine and accelerate Crypto and CRC functions of the DOCSIS protocol
into a single operation.

Performing these functions in parallel as a single operation can enable a
significant performance improvement in a DPDK-based DOCSIS MAC pipeline.

PLEASE NOTE: this patchset only includes the proposed API changes. The
implementation will follow in the next version.

Background
==========

A number of approaches to combine DOCSIS Crypto and CRC functions have
been discussed in the DPDK community to date, namely:
1) adding a new rte_accelerator API, to provide a generic interface for
   combining operations of different types
2) using rawdev through a multi-function interface, again to provide a
   generic interface for combining operations of different types
3) adding support for DOCSIS Crypto-CRC to rte_security

The third option above is the preferred approach for the following
reasons:
- it addresses the immediate use case to add DOCSIS Crypto-CRC support to
  DPDK so that it can be consumed easily by cable equipment vendors
- it uses an already existing framework in DPDK
- it will mean much less code churn in DOCSIS applications, which already
  use rte_cryptodev for encryption/decryption


Use Cases
=========

The primary use case for this proposal has already been mentioned, namely
to add DOCSIS Crypto-CRC support to DPDK:

- DOCSIS MAC: Crypto-CRC
	- Order:
		- Downstream: CRC, Encrypt
		- Upstream: Decrypt, CRC
	- Specifications:
		- Crypto: 128-bit AES-CFB encryption variant for DOCSIS as
		  described in section 11.1 of DOCSIS 3.1 Security
		  Specification
		  (https://apps.cablelabs.com/specification/CM-SP-SECv3.1)
		- CRC: Ethernet 32-bit CRC as defined in
		  Ethernet/[ISO/IEC 8802-3]

Note that support for this chained operations is already available in the
Intel IPSec Multi-Buffer library.

However, other DOCSIS protocol functions could be optimized too in the
future using the same rte_security API for DOCSIS (e.g. Header Checksum
(HCS) calculation).

v1:
* added proposed API changes
* added security capabilities to aesni_mb crypto PMD

David Coyle (3):
  security: add support for DOCSIS protocol
  cryptodev: add security operation to crypto operation
  crypto/aesni_mb: add support for DOCSIS protocol

 drivers/crypto/aesni_mb/meson.build           |   2 +-
 .../crypto/aesni_mb/rte_aesni_mb_pmd_ops.c    |  63 ++++++++++
 lib/librte_cryptodev/rte_crypto.h             |  11 +-
 lib/librte_security/rte_security.h            | 114 ++++++++++++++++++
 4 files changed, 188 insertions(+), 2 deletions(-)