diff --git a/doc/guides/cryptodevs/dpaa_sec.rst b/doc/guides/cryptodevs/dpaa_sec.rst
index bac82421bc..0c8d6cf3da 100644
--- a/doc/guides/cryptodevs/dpaa_sec.rst
+++ b/doc/guides/cryptodevs/dpaa_sec.rst
@@ -123,3 +123,13 @@ For enabling logs, use the following EAL parameter:
 
 Using ``pmd.crypto.dpaa`` as log matching criteria, all Crypto PMD logs can be
 enabled which are lower than logging ``level``.
+
+Enabling debug prints
+---------------------
+
+Use dev arg option ``drv_dump_mode=x`` to dump useful debug prints on HW sec
+error. There are 3 dump modes available 0, 1 and 2. Mode 0 means no dump print
+on error, mode 1 means dump HW error code and mode 2 means dump HW error code
+along with other useful debugging information like session, queue, descriptor
+data.
+e.g. ``dpaa_bus:dpaa_sec-1,drv_dump_mode=1``
diff --git a/drivers/bus/dpaa/dpaa_bus.c b/drivers/bus/dpaa/dpaa_bus.c
index 5546a9cb8d..e442bc4c33 100644
--- a/drivers/bus/dpaa/dpaa_bus.c
+++ b/drivers/bus/dpaa/dpaa_bus.c
@@ -429,6 +429,7 @@ rte_dpaa_bus_parse(const char *name, void *out)
 {
 	unsigned int i, j;
 	size_t delta;
+	size_t max_name_len;
 
 	/* There are two ways of passing device name, with and without
 	 * separator. "dpaa_bus:fm1-mac3" with separator, and "fm1-mac3"
@@ -444,14 +445,21 @@ rte_dpaa_bus_parse(const char *name, void *out)
 		delta = 5;
 	}
 
-	if (sscanf(&name[delta], "fm%u-mac%u", &i, &j) != 2 ||
-	    i >= 2 || j >= 16) {
-		return -EINVAL;
+	if (strncmp("dpaa_sec", &name[delta], 8) == 0) {
+		if (sscanf(&name[delta], "dpaa_sec-%u", &i) != 1 ||
+				i < 1 || i > 4)
+			return -EINVAL;
+		max_name_len = sizeof("dpaa_sec-.") - 1;
+	} else {
+		if (sscanf(&name[delta], "fm%u-mac%u", &i, &j) != 2 ||
+				i >= 2 || j >= 16)
+			return -EINVAL;
+
+		max_name_len = sizeof("fm.-mac..") - 1;
 	}
 
 	if (out != NULL) {
 		char *out_name = out;
-		const size_t max_name_len = sizeof("fm.-mac..") - 1;
 
 		/* Do not check for truncation, either name ends with
 		 * '\0' or the device name is followed by parameters and there
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.c b/drivers/crypto/dpaa_sec/dpaa_sec.c
index 75e437f696..ed12d6663b 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.c
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.c
@@ -27,6 +27,7 @@
 #include <rte_memcpy.h>
 #include <rte_string_fns.h>
 #include <rte_spinlock.h>
+#include <rte_hexdump.h>
 
 #include <fsl_usd.h>
 #include <fsl_qman.h>
@@ -45,6 +46,17 @@
 #include <dpaa_sec_log.h>
 #include <dpaax_iova_table.h>
 
+#define DRIVER_DUMP_MODE "drv_dump_mode"
+
+/* DPAA_SEC_DP_DUMP levels */
+enum dpaa_sec_dump_levels {
+	DPAA_SEC_DP_NO_DUMP,
+	DPAA_SEC_DP_ERR_DUMP,
+	DPAA_SEC_DP_FULL_DUMP
+};
+
+uint8_t dpaa_sec_dp_dump = DPAA_SEC_DP_ERR_DUMP;
+
 uint8_t dpaa_cryptodev_driver_id;
 
 static inline void
@@ -649,6 +661,139 @@ dpaa_sec_prep_cdb(dpaa_sec_session *ses)
 	return 0;
 }
 
+static void
+dpaa_sec_dump(struct dpaa_sec_op_ctx *ctx, struct dpaa_sec_qp *qp)
+{
+	struct dpaa_sec_job *job = &ctx->job;
+	struct rte_crypto_op *op = ctx->op;
+	dpaa_sec_session *sess = NULL;
+	struct sec_cdb c_cdb, *cdb;
+	uint8_t bufsize;
+	struct rte_crypto_sym_op *sym_op;
+	struct qm_sg_entry sg[2];
+
+	if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION)
+		sess = (dpaa_sec_session *)
+			get_sym_session_private_data(
+					op->sym->session,
+					dpaa_cryptodev_driver_id);
+#ifdef RTE_LIBRTE_SECURITY
+	else if (op->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION)
+		sess = (dpaa_sec_session *)
+			get_sec_session_private_data(
+					op->sym->sec_session);
+#endif
+	if (sess == NULL) {
+		printf("session is NULL\n");
+		goto mbuf_dump;
+	}
+
+	cdb = &sess->cdb;
+	rte_memcpy(&c_cdb, cdb, sizeof(struct sec_cdb));
+#ifdef RTE_LIBRTE_SECURITY
+	printf("\nsession protocol type = %d\n", sess->proto_alg);
+#endif
+	printf("\n****************************************\n"
+		"session params:\n\tContext type:\t%d\n\tDirection:\t%s\n"
+		"\tCipher alg:\t%d\n\tAuth alg:\t%d\n\tAead alg:\t%d\n"
+		"\tCipher key len:\t%"PRIu64"\n\tCipher alg:\t%d\n"
+		"\tCipher algmode:\t%d\n", sess->ctxt,
+		(sess->dir == DIR_ENC) ? "DIR_ENC" : "DIR_DEC",
+		sess->cipher_alg, sess->auth_alg, sess->aead_alg,
+		(uint64_t)sess->cipher_key.length, sess->cipher_key.alg,
+		sess->cipher_key.algmode);
+		rte_hexdump(stdout, "cipher key", sess->cipher_key.data,
+				sess->cipher_key.length);
+		rte_hexdump(stdout, "auth key", sess->auth_key.data,
+				sess->auth_key.length);
+	printf("\tAuth key len:\t%"PRIu64"\n\tAuth alg:\t%d\n"
+		"\tAuth algmode:\t%d\n\tIV len:\t\t%d\n\tIV offset:\t%d\n"
+		"\tdigest length:\t%d\n\tauth only len:\t\t%d\n"
+		"\taead cipher text:\t%d\n",
+		(uint64_t)sess->auth_key.length, sess->auth_key.alg,
+		sess->auth_key.algmode,
+		sess->iv.length, sess->iv.offset,
+		sess->digest_length, sess->auth_only_len,
+		sess->auth_cipher_text);
+#ifdef RTE_LIBRTE_SECURITY
+	printf("PDCP session params:\n"
+		"\tDomain:\t\t%d\n\tBearer:\t\t%d\n\tpkt_dir:\t%d\n\thfn_ovd:"
+		"\t%d\n\tsn_size:\t%d\n\tsdap_enabled:\t%d\n\thfn_ovd_offset:"
+		"\t%d\n\thfn:\t\t%d\n"
+		"\thfn_threshold:\t0x%x\n", sess->pdcp.domain,
+		sess->pdcp.bearer, sess->pdcp.pkt_dir, sess->pdcp.hfn_ovd,
+		sess->pdcp.sn_size, sess->pdcp.sdap_enabled,
+		sess->pdcp.hfn_ovd_offset, sess->pdcp.hfn,
+		sess->pdcp.hfn_threshold);
+#endif
+	c_cdb.sh_hdr.hi.word = rte_be_to_cpu_32(c_cdb.sh_hdr.hi.word);
+	c_cdb.sh_hdr.lo.word = rte_be_to_cpu_32(c_cdb.sh_hdr.lo.word);
+	bufsize = c_cdb.sh_hdr.hi.field.idlen;
+
+	printf("cdb = %p\n\n", cdb);
+	printf("Descriptor size = %d\n", bufsize);
+	int m;
+	for (m = 0; m < bufsize; m++)
+		printf("0x%x\n", rte_be_to_cpu_32(c_cdb.sh_desc[m]));
+
+	printf("\n");
+mbuf_dump:
+	sym_op = op->sym;
+	if (sym_op->m_src) {
+		printf("Source mbuf:\n");
+		rte_pktmbuf_dump(stdout, sym_op->m_src,
+				 sym_op->m_src->data_len);
+	}
+	if (sym_op->m_dst) {
+		printf("Destination mbuf:\n");
+		rte_pktmbuf_dump(stdout, sym_op->m_dst,
+				 sym_op->m_dst->data_len);
+	}
+
+	printf("Session address = %p\ncipher offset: %d, length: %d\n"
+		"auth offset: %d, length:  %d\n aead offset: %d, length: %d\n",
+		sym_op->session, sym_op->cipher.data.offset,
+		sym_op->cipher.data.length,
+		sym_op->auth.data.offset, sym_op->auth.data.length,
+		sym_op->aead.data.offset, sym_op->aead.data.length);
+	printf("\n");
+
+	printf("******************************************************\n");
+	printf("ctx info:\n");
+	printf("job->sg[0] output info:\n");
+	memcpy(&sg[0], &job->sg[0], sizeof(sg[0]));
+	printf("\taddr = %"PRIx64",\n\tlen = %d,\n\tfinal = %d,\n\textention = %d"
+		"\n\tbpid = %d\n\toffset = %d\n",
+		(uint64_t)sg[0].addr, sg[0].length, sg[0].final,
+		sg[0].extension, sg[0].bpid, sg[0].offset);
+	printf("\njob->sg[1] input info:\n");
+	memcpy(&sg[1], &job->sg[1], sizeof(sg[1]));
+	hw_sg_to_cpu(&sg[1]);
+	printf("\taddr = %"PRIx64",\n\tlen = %d,\n\tfinal = %d,\n\textention = %d"
+		"\n\tbpid = %d\n\toffset = %d\n",
+		(uint64_t)sg[1].addr, sg[1].length, sg[1].final,
+		sg[1].extension, sg[1].bpid, sg[1].offset);
+
+	printf("\nctx pool addr = %p\n", ctx->ctx_pool);
+	if (ctx->ctx_pool)
+		printf("ctx pool available counts = %d\n",
+			rte_mempool_avail_count(ctx->ctx_pool));
+
+	printf("\nop pool addr = %p\n", op->mempool);
+	if (op->mempool)
+		printf("op pool available counts = %d\n",
+			rte_mempool_avail_count(op->mempool));
+
+	printf("********************************************************\n");
+	printf("Queue data:\n");
+	printf("\tFQID = 0x%x\n\tstate = %d\n\tnb_desc = %d\n"
+		"\tctx_pool = %p\n\trx_pkts = %d\n\ttx_pkts"
+	       "= %d\n\trx_errs = %d\n\ttx_errs = %d\n\n",
+		qp->outq.fqid, qp->outq.state, qp->outq.nb_desc,
+		qp->ctx_pool, qp->rx_pkts, qp->tx_pkts,
+		qp->rx_errs, qp->tx_errs);
+}
+
 /* qp is lockless, should be accessed by only one thread */
 static int
 dpaa_sec_deq(struct dpaa_sec_qp *qp, struct rte_crypto_op **ops, int nb_ops)
@@ -716,7 +861,12 @@ dpaa_sec_deq(struct dpaa_sec_qp *qp, struct rte_crypto_op **ops, int nb_ops)
 		if (!ctx->fd_status) {
 			op->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
 		} else {
-			DPAA_SEC_DP_WARN("SEC return err:0x%x", ctx->fd_status);
+			if (dpaa_sec_dp_dump > DPAA_SEC_DP_NO_DUMP) {
+				DPAA_SEC_DP_WARN("SEC return err:0x%x\n",
+						  ctx->fd_status);
+				if (dpaa_sec_dp_dump > DPAA_SEC_DP_ERR_DUMP)
+					dpaa_sec_dump(ctx, qp);
+			}
 			op->status = RTE_CRYPTO_OP_STATUS_ERROR;
 		}
 		ops[pkts++] = op;
@@ -3458,6 +3608,42 @@ dpaa_sec_uninit(struct rte_cryptodev *dev)
 	return 0;
 }
 
+static int
+check_devargs_handler(__rte_unused const char *key, const char *value,
+		      __rte_unused void *opaque)
+{
+	dpaa_sec_dp_dump = atoi(value);
+	if (dpaa_sec_dp_dump > DPAA_SEC_DP_FULL_DUMP) {
+		DPAA_SEC_WARN("WARN: DPAA_SEC_DP_DUMP_LEVEL is not "
+			      "supported, changing to FULL error prints\n");
+		dpaa_sec_dp_dump = DPAA_SEC_DP_FULL_DUMP;
+	}
+
+	return 0;
+}
+
+static void
+dpaa_sec_get_devargs(struct rte_devargs *devargs, const char *key)
+{
+	struct rte_kvargs *kvlist;
+
+	if (!devargs)
+		return;
+
+	kvlist = rte_kvargs_parse(devargs->args, NULL);
+	if (!kvlist)
+		return;
+
+	if (!rte_kvargs_count(kvlist, key)) {
+		rte_kvargs_free(kvlist);
+		return;
+	}
+
+	rte_kvargs_process(kvlist, key,
+				check_devargs_handler, NULL);
+	rte_kvargs_free(kvlist);
+}
+
 static int
 dpaa_sec_dev_init(struct rte_cryptodev *cryptodev)
 {
@@ -3533,6 +3719,8 @@ dpaa_sec_dev_init(struct rte_cryptodev *cryptodev)
 		}
 	}
 
+	dpaa_sec_get_devargs(cryptodev->device->devargs, DRIVER_DUMP_MODE);
+
 	RTE_LOG(INFO, PMD, "%s cryptodev init\n", cryptodev->data->name);
 	return 0;
 
@@ -3649,4 +3837,6 @@ static struct cryptodev_driver dpaa_sec_crypto_drv;
 RTE_PMD_REGISTER_DPAA(CRYPTODEV_NAME_DPAA_SEC_PMD, rte_dpaa_sec_driver);
 RTE_PMD_REGISTER_CRYPTO_DRIVER(dpaa_sec_crypto_drv, rte_dpaa_sec_driver.driver,
 		dpaa_cryptodev_driver_id);
+RTE_PMD_REGISTER_PARAM_STRING(CRYPTODEV_NAME_DPAA_SEC_PMD,
+		DRIVER_DUMP_MODE "=<int>");
 RTE_LOG_REGISTER(dpaa_logtype_sec, pmd.crypto.dpaa, NOTICE);
