1 .. SPDX-License-Identifier: BSD-3-Clause
2 Copyright(c) 2021 Marvell.
4 Marvell cnxk Crypto Poll Mode Driver
5 ====================================
7 The cnxk crypto poll mode driver provides support for offloading
8 cryptographic operations to cryptographic accelerator units on the
9 **Marvell OCTEON cnxk** SoC family.
11 The cnxk crypto PMD code is organized into different sets of files.
12 The file names starting with cn9k and cn10k provides support for CN9XX
13 and CN10XX respectively. The common code between the SoCs is present
14 in file names starting with cnxk.
16 More information about OCTEON cnxk SoCs may be obtained from `<https://www.marvell.com>`_
18 Supported OCTEON cnxk SoCs
19 --------------------------
27 The OCTEON cnxk crypto PMD has support for:
29 Symmetric Crypto Algorithms
30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
34 * ``RTE_CRYPTO_CIPHER_NULL``
35 * ``RTE_CRYPTO_CIPHER_3DES_CBC``
36 * ``RTE_CRYPTO_CIPHER_3DES_ECB``
37 * ``RTE_CRYPTO_CIPHER_AES_CBC``
38 * ``RTE_CRYPTO_CIPHER_AES_CTR``
39 * ``RTE_CRYPTO_CIPHER_AES_XTS``
40 * ``RTE_CRYPTO_CIPHER_DES_CBC``
41 * ``RTE_CRYPTO_CIPHER_KASUMI_F8``
42 * ``RTE_CRYPTO_CIPHER_SNOW3G_UEA2``
43 * ``RTE_CRYPTO_CIPHER_ZUC_EEA3``
47 * ``RTE_CRYPTO_AUTH_NULL``
48 * ``RTE_CRYPTO_AUTH_AES_GMAC``
49 * ``RTE_CRYPTO_AUTH_KASUMI_F9``
50 * ``RTE_CRYPTO_AUTH_MD5``
51 * ``RTE_CRYPTO_AUTH_MD5_HMAC``
52 * ``RTE_CRYPTO_AUTH_SHA1``
53 * ``RTE_CRYPTO_AUTH_SHA1_HMAC``
54 * ``RTE_CRYPTO_AUTH_SHA224``
55 * ``RTE_CRYPTO_AUTH_SHA224_HMAC``
56 * ``RTE_CRYPTO_AUTH_SHA256``
57 * ``RTE_CRYPTO_AUTH_SHA256_HMAC``
58 * ``RTE_CRYPTO_AUTH_SHA384``
59 * ``RTE_CRYPTO_AUTH_SHA384_HMAC``
60 * ``RTE_CRYPTO_AUTH_SHA512``
61 * ``RTE_CRYPTO_AUTH_SHA512_HMAC``
62 * ``RTE_CRYPTO_AUTH_SNOW3G_UIA2``
63 * ``RTE_CRYPTO_AUTH_ZUC_EIA3``
67 * ``RTE_CRYPTO_AEAD_AES_GCM``
68 * ``RTE_CRYPTO_AEAD_CHACHA20_POLY1305``
70 Asymmetric Crypto Algorithms
71 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
73 * ``RTE_CRYPTO_ASYM_XFORM_RSA``
74 * ``RTE_CRYPTO_ASYM_XFORM_MODEX``
79 The OCTEON cnxk crypto PMD may be compiled natively on an OCTEON cnxk platform
80 or cross-compiled on an x86 platform.
82 Refer to :doc:`../platform/cnxk` for instructions to build your DPDK
87 The OCTEON cnxk crypto PMD uses services from the kernel mode OCTEON cnxk
88 crypto PF driver in linux. This driver is included in the OCTEON TX SDK.
93 ``CN9K Initialization``
95 List the CPT PF devices available on cn9k platform:
97 .. code-block:: console
101 ``a0fd`` is the CPT PF device id. You should see output similar to:
103 .. code-block:: console
105 0002:10:00.0 Class 1080: Device 177d:a0fd
107 Set ``sriov_numvfs`` on the CPT PF device, to create a VF:
109 .. code-block:: console
111 echo 1 > /sys/bus/pci/devices/0002:10:00.0/sriov_numvfs
113 Bind the CPT VF device to the vfio_pci driver:
115 .. code-block:: console
118 ./usertools/dpdk-devbind.py -u 0002:10:00.1
119 ./usertools/dpdk-devbind.py -b vfio-pci 0002:10.00.1
123 * For CN98xx SoC, it is recommended to use even and odd DBDF VFs to achieve
124 higher performance as even VF uses one crypto engine and odd one uses
125 another crypto engine.
127 * Ensure that sufficient huge pages are available for your application::
129 dpdk-hugepages.py --setup 4G --pagesize 512M
131 Refer to :ref:`linux_gsg_hugepages` for more details.
133 ``CN10K Initialization``
135 List the CPT PF devices available on cn10k platform:
137 .. code-block:: console
141 ``a0f2`` is the CPT PF device id. You should see output similar to:
143 .. code-block:: console
145 0002:20:00.0 Class 1080: Device 177d:a0f2
147 Set ``sriov_numvfs`` on the CPT PF device, to create a VF:
149 .. code-block:: console
151 echo 1 > /sys/bus/pci/devices/0002:20:00.0/sriov_numvfs
153 Bind the CPT VF device to the vfio_pci driver:
155 .. code-block:: console
158 ./usertools/dpdk-devbind.py -u 0002:20:00.1
159 ./usertools/dpdk-devbind.py -b vfio-pci 0002:20:00.1
161 Runtime Config Options
162 ----------------------
164 - ``Maximum queue pairs limit`` (default ``63``)
166 The number of maximum queue pairs supported by the device, can be limited
167 during runtime by using ``max_qps_limit`` ``devargs`` parameter.
171 -a 0002:20:00.1,max_qps_limit=4
173 With the above configuration, the number of maximum queue pairs supported
174 by the device is limited to 4.
179 .. _table_octeon_cnxk_crypto_debug_options:
181 .. table:: OCTEON cnxk crypto PMD debug options
183 +---+------------+-------------------------------------------------------+
184 | # | Component | EAL log command |
185 +===+============+=======================================================+
186 | 1 | CPT | --log-level='pmd\.crypto\.cnxk,8' |
187 +---+------------+-------------------------------------------------------+
192 The symmetric crypto operations on OCTEON cnxk crypto PMD may be verified by
193 running the test application:
197 .. code-block:: console
200 RTE>>cryptodev_cn9k_autotest
204 .. code-block:: console
207 RTE>>cryptodev_cn10k_autotest
209 The asymmetric crypto operations on OCTEON cnxk crypto PMD may be verified by
210 running the test application:
214 .. code-block:: console
217 RTE>>cryptodev_cn9k_asym_autotest
221 .. code-block:: console
224 RTE>>cryptodev_cn10k_asym_autotest
226 Lookaside IPsec Support
227 -----------------------
229 The OCTEON cnxk SoCs can accelerate IPsec traffic in lookaside protocol mode,
230 with its **cryptographic accelerator (CPT)**. ``OCTEON cnxk crypto PMD`` implements
231 this as an ``RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL`` offload.
233 Refer to :doc:`../prog_guide/rte_security` for more details on protocol offloads.
235 This feature can be tested with ipsec-secgw sample application.
237 Supported OCTEON cnxk SoCs
238 ~~~~~~~~~~~~~~~~~~~~~~~~~~
243 CN9XX Features supported
244 ~~~~~~~~~~~~~~~~~~~~~~~~
250 * AES-128/192/256-GCM
252 CN10XX Features supported
253 ~~~~~~~~~~~~~~~~~~~~~~~~~
260 * AES-128/192/256-GCM
261 * AES-128/192/256-CBC-SHA1-HMAC