diff mbox

[dpdk-dev] doc: announce ABI change for cryptodev and ethdev

Message ID 20170803153211.23073-1-akhil.goyal@nxp.com (mailing list archive)
State Accepted, archived
Delegated to: Pablo de Lara Guarch
Headers

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Akhil Goyal Aug. 3, 2017, 3:32 p.m. UTC 
  Support for security operations is planned to be added
in ethdev and cryptodev for the 17.11 release.

For this following changes are required.
- rte_cryptodev and rte_eth_dev structures need to be added
new parameter rte_security_ops which extend support for
security ops to the corresponding driver.
- rte_cryptodev_info and rte_ethd_dev_info need to be added
with rte_security_capabilities to identify the capabilities of
the corresponding driver.

Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
---
 doc/guides/rel_notes/deprecation.rst | 10 ++++++++++
 1 file changed, 10 insertions(+)

Comments

Hemant Agrawal Aug. 4, 2017, 5:26 a.m. UTC | #1 
On 8/3/2017 9:02 PM, Akhil Goyal wrote:
> Support for security operations is planned to be added
> in ethdev and cryptodev for the 17.11 release.
>
> For this following changes are required.
> - rte_cryptodev and rte_eth_dev structures need to be added
> new parameter rte_security_ops which extend support for
> security ops to the corresponding driver.
> - rte_cryptodev_info and rte_ethd_dev_info need to be added
> with rte_security_capabilities to identify the capabilities of
> the corresponding driver.
>
> Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
> ---
>  doc/guides/rel_notes/deprecation.rst | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst
> index f6bd910..2393b4c 100644
> --- a/doc/guides/rel_notes/deprecation.rst
> +++ b/doc/guides/rel_notes/deprecation.rst
> @@ -69,3 +69,13 @@ Deprecation Notices
>    be removed in 17.11:
>
>    - ``rte_cryptodev_create_vdev``
> +
> +* cryptodev: new parameters - ``rte_security_capabilities`` and
> +  ``rte_security_ops`` will be added to ``rte_cryptodev_info`` and
> +  ``rte_cryptodev`` respectively to support security protocol offloaded
> +  operations.
> +
> +* ethdev: new parameters - ``rte_security_capabilities`` and
> +  ``rte_security_ops`` will be added to ``rte_eth_dev_info`` and
> +  ``rte_eth_dev`` respectively  to support security operations like
> +  ipsec inline.
>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
De Lara Guarch, Pablo Aug. 4, 2017, 9:28 a.m. UTC | #2 
> -----Original Message-----
> From: Akhil Goyal [mailto:akhil.goyal@nxp.com]
> Sent: Thursday, August 3, 2017 4:32 PM
> To: dev@dpdk.org; Doherty, Declan <declan.doherty@intel.com>;
> thomas@monjalon.net; Nicolau, Radu <radu.nicolau@intel.com>;
> aviadye@mellanox.com; borisp@mellanox.com;
> hemant.agrawal@nxp.com; De Lara Guarch, Pablo
> <pablo.de.lara.guarch@intel.com>
> Cc: Akhil Goyal <akhil.goyal@nxp.com>
> Subject: [PATCH] doc: announce ABI change for cryptodev and ethdev
> 
> Support for security operations is planned to be added in ethdev and
> cryptodev for the 17.11 release.
> 
> For this following changes are required.
> - rte_cryptodev and rte_eth_dev structures need to be added new
> parameter rte_security_ops which extend support for security ops to the
> corresponding driver.
> - rte_cryptodev_info and rte_ethd_dev_info need to be added with
> rte_security_capabilities to identify the capabilities of the corresponding
> driver.
> 
> Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>

Boris, Aviad, could you review this patch?

Thanks,
Pablo
De Lara Guarch, Pablo Aug. 4, 2017, 3:25 p.m. UTC | #3 
> -----Original Message-----
> From: Akhil Goyal [mailto:akhil.goyal@nxp.com]
> Sent: Thursday, August 3, 2017 4:32 PM
> To: dev@dpdk.org; Doherty, Declan <declan.doherty@intel.com>;
> thomas@monjalon.net; Nicolau, Radu <radu.nicolau@intel.com>;
> aviadye@mellanox.com; borisp@mellanox.com;
> hemant.agrawal@nxp.com; De Lara Guarch, Pablo
> <pablo.de.lara.guarch@intel.com>
> Cc: Akhil Goyal <akhil.goyal@nxp.com>
> Subject: [PATCH] doc: announce ABI change for cryptodev and ethdev
> 
> Support for security operations is planned to be added in ethdev and
> cryptodev for the 17.11 release.
> 
> For this following changes are required.
> - rte_cryptodev and rte_eth_dev structures need to be added new
> parameter rte_security_ops which extend support for security ops to the
> corresponding driver.
> - rte_cryptodev_info and rte_ethd_dev_info need to be added with
> rte_security_capabilities to identify the capabilities of the corresponding
> driver.
> 
> Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>

Not sure if this needed to be split into two patches, as this affects two libraries.
At least, from cryptodev side:

Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Thomas Monjalon Aug. 7, 2017, 5:41 p.m. UTC | #4 
04/08/2017 07:26, Hemant Agrawal:
> On 8/3/2017 9:02 PM, Akhil Goyal wrote:
> > Support for security operations is planned to be added
> > in ethdev and cryptodev for the 17.11 release.
> >
> > For this following changes are required.
> > - rte_cryptodev and rte_eth_dev structures need to be added
> > new parameter rte_security_ops which extend support for
> > security ops to the corresponding driver.
> > - rte_cryptodev_info and rte_ethd_dev_info need to be added
> > with rte_security_capabilities to identify the capabilities of
> > the corresponding driver.

It is not explained what is the fundamental difference between
rte_security and rte_crypto?
It looks to be just a technical workaround.

Why the ABI would be changed by rte_security additions?

> > Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
> >
> Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>

No more opinions outside of NXP?
It seems there is not yet a consensus on how to manage IPsec offloading.
I heard there were some phone calls about these stuff but nothing clear
appears publicly on the mailing list.
Looks to be a community failure.
Boris Pismenny Aug. 7, 2017, 6:07 p.m. UTC | #5 
> From: Thomas Monjalon [mailto:thomas@monjalon.net]
> 04/08/2017 07:26, Hemant Agrawal:
> > On 8/3/2017 9:02 PM, Akhil Goyal wrote:
> > > Support for security operations is planned to be added in ethdev and
> > > cryptodev for the 17.11 release.
> > >
> > > For this following changes are required.
> > > - rte_cryptodev and rte_eth_dev structures need to be added new
> > > parameter rte_security_ops which extend support for security ops to
> > > the corresponding driver.
> > > - rte_cryptodev_info and rte_ethd_dev_info need to be added with
> > > rte_security_capabilities to identify the capabilities of the
> > > corresponding driver.
> 
> It is not explained what is the fundamental difference between rte_security
> and rte_crypto?
> It looks to be just a technical workaround.

rte_security is a layer between crypto and NIC.

Today crypto sessions are created exclusively against crypto devices, but they don't use network related fields, while the network namespace doesn't use crypto related fields. We expect this API to represent crypto sessions that combine network fields and allow to add/delete them for all devices.

For NICs we will use rte_flow with rte_security for inline/full crypto protocol offload such as ESP.

> 
> Why the ABI would be changed by rte_security additions?
> 
> > > Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
> > >
> > Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
> 
> No more opinions outside of NXP?
> It seems there is not yet a consensus on how to manage IPsec offloading.
> I heard there were some phone calls about these stuff but nothing clear
> appears publicly on the mailing list.
> Looks to be a community failure.

We agreed to go ahead with this approach on one such phone call. I hope we could use the dpdk github for development. 

Acked-by: Boris Pismenny <borisp@mellanox.com>
Shahaf Shuler Aug. 8, 2017, 5:03 a.m. UTC | #6 
Monday, August 7, 2017 9:07 PM, Boris Pismenny:
> > From: Thomas Monjalon [mailto:thomas@monjalon.net]
> > 04/08/2017 07:26, Hemant Agrawal:
> > > On 8/3/2017 9:02 PM, Akhil Goyal wrote:
> > > > Support for security operations is planned to be added in ethdev
> > > > and cryptodev for the 17.11 release.
> > > >
> > > > For this following changes are required.
> > > > - rte_cryptodev and rte_eth_dev structures need to be added new
> > > > parameter rte_security_ops which extend support for security ops
> > > > to the corresponding driver.
> > > > - rte_cryptodev_info and rte_ethd_dev_info need to be added with
> > > > rte_security_capabilities to identify the capabilities of the
> > > > corresponding driver.
> >
> > It is not explained what is the fundamental difference between
> > rte_security and rte_crypto?
> > It looks to be just a technical workaround.
> 
> rte_security is a layer between crypto and NIC.
> 
> Today crypto sessions are created exclusively against crypto devices, but
> they don't use network related fields, while the network namespace doesn't
> use crypto related fields. We expect this API to represent crypto sessions
> that combine network fields and allow to add/delete them for all devices.
> 
> For NICs we will use rte_flow with rte_security for inline/full crypto protocol
> offload such as ESP.
> 
> >
> > Why the ABI would be changed by rte_security additions?
> >
> > > > Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
> > > >
> > > Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
> >
> > No more opinions outside of NXP?
> > It seems there is not yet a consensus on how to manage IPsec offloading.
> > I heard there were some phone calls about these stuff but nothing
> > clear appears publicly on the mailing list.
> > Looks to be a community failure.
> 
> We agreed to go ahead with this approach on one such phone call. I hope we
> could use the dpdk github for development.
> 
> Acked-by: Boris Pismenny <borisp@mellanox.com>

Acked-by: Shahaf Shuler <shahafs@mellanox.com>
Akhil Goyal Aug. 8, 2017, 6:54 a.m. UTC | #7 
Hi Pablo/Declan,

On 8/4/2017 8:55 PM, De Lara Guarch, Pablo wrote:
> 
> 
>> -----Original Message-----
>> From: Akhil Goyal [mailto:akhil.goyal@nxp.com]
>> Sent: Thursday, August 3, 2017 4:32 PM
>> To: dev@dpdk.org; Doherty, Declan <declan.doherty@intel.com>;
>> thomas@monjalon.net; Nicolau, Radu <radu.nicolau@intel.com>;
>> aviadye@mellanox.com; borisp@mellanox.com;
>> hemant.agrawal@nxp.com; De Lara Guarch, Pablo
>> <pablo.de.lara.guarch@intel.com>
>> Cc: Akhil Goyal <akhil.goyal@nxp.com>
>> Subject: [PATCH] doc: announce ABI change for cryptodev and ethdev
>>
>> Support for security operations is planned to be added in ethdev and
>> cryptodev for the 17.11 release.
>>
>> For this following changes are required.
>> - rte_cryptodev and rte_eth_dev structures need to be added new
>> parameter rte_security_ops which extend support for security ops to the
>> corresponding driver.
>> - rte_cryptodev_info and rte_ethd_dev_info need to be added with
>> rte_security_capabilities to identify the capabilities of the corresponding
>> driver.
>>
>> Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
> 
> Not sure if this needed to be split into two patches, as this affects two libraries.
> At least, from cryptodev side:
> 
> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
> 

We would be needing one more ABI change, Can I send it now. I discovered 
it after I sent this patch.

In the struct rte_crypto_sym_op, we would need to add a pointer to a 
security session in the union of session and xform.

Also, Do I need to split this patch into two for crypto and eth?

Regards,
Akhil
Thomas Monjalon Aug. 8, 2017, 10 a.m. UTC | #8 
08/08/2017 07:03, Shahaf Shuler:
> Monday, August 7, 2017 9:07 PM, Boris Pismenny:
> > > From: Thomas Monjalon [mailto:thomas@monjalon.net]
> > > 04/08/2017 07:26, Hemant Agrawal:
> > > > On 8/3/2017 9:02 PM, Akhil Goyal wrote:
> > > > > Support for security operations is planned to be added in ethdev
> > > > > and cryptodev for the 17.11 release.
> > > > >
> > > > > For this following changes are required.
> > > > > - rte_cryptodev and rte_eth_dev structures need to be added new
> > > > > parameter rte_security_ops which extend support for security ops
> > > > > to the corresponding driver.
> > > > > - rte_cryptodev_info and rte_ethd_dev_info need to be added with
> > > > > rte_security_capabilities to identify the capabilities of the
> > > > > corresponding driver.
> > >
> > > It is not explained what is the fundamental difference between
> > > rte_security and rte_crypto?
> > > It looks to be just a technical workaround.
> > 
> > rte_security is a layer between crypto and NIC.
> > 
> > Today crypto sessions are created exclusively against crypto devices, but
> > they don't use network related fields, while the network namespace doesn't
> > use crypto related fields. We expect this API to represent crypto sessions
> > that combine network fields and allow to add/delete them for all devices.
> > 
> > For NICs we will use rte_flow with rte_security for inline/full crypto protocol
> > offload such as ESP.
> > 
> > >
> > > Why the ABI would be changed by rte_security additions?
> > >
> > > > > Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
> > > > >
> > > > Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
> > >
> > > No more opinions outside of NXP?
> > > It seems there is not yet a consensus on how to manage IPsec offloading.
> > > I heard there were some phone calls about these stuff but nothing
> > > clear appears publicly on the mailing list.
> > > Looks to be a community failure.
> > 
> > We agreed to go ahead with this approach on one such phone call. I hope we
> > could use the dpdk github for development.
> > 
> > Acked-by: Boris Pismenny <borisp@mellanox.com>
> 
> Acked-by: Shahaf Shuler <shahafs@mellanox.com>

Applied
It means you have a chance to do this change in 17.11.
It does not mean you can be sure that the patches will be accepted.

This is introducing a new complexity.
It must be discussed with the technical board before approving
the final design in 17.11.
diff mbox

Patch

diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst
index f6bd910..2393b4c 100644
--- a/doc/guides/rel_notes/deprecation.rst
+++ b/doc/guides/rel_notes/deprecation.rst
@@ -69,3 +69,13 @@  Deprecation Notices
   be removed in 17.11:
 
   - ``rte_cryptodev_create_vdev``
+
+* cryptodev: new parameters - ``rte_security_capabilities`` and
+  ``rte_security_ops`` will be added to ``rte_cryptodev_info`` and
+  ``rte_cryptodev`` respectively to support security protocol offloaded
+  operations.
+
+* ethdev: new parameters - ``rte_security_capabilities`` and
+  ``rte_security_ops`` will be added to ``rte_eth_dev_info`` and
+  ``rte_eth_dev`` respectively  to support security operations like
+  ipsec inline.