[dpdk-dev] [PATCH v2 4/6] crypto/qat: add support for DOCSIS protocol

[David Coyle <david.coyle@intel.com>]

Add support to the QAT SYM PMD for the DOCSIS protocol, through the
rte_security API. This, therefore, includes adding support for the
rte_security API to this PMD.

Signed-off-by: David Coyle <david.coyle@intel.com>
Signed-off-by: Mairtin o Loingsigh <mairtin.oloingsigh@intel.com>
---
 drivers/common/qat/Makefile               |   3 +
 drivers/crypto/qat/meson.build            |   2 +
 drivers/crypto/qat/qat_sym.c              | 139 ++++++++++++++------
 drivers/crypto/qat/qat_sym.h              |  82 ++++++++++--
 drivers/crypto/qat/qat_sym_capabilities.h |  44 +++++++
 drivers/crypto/qat/qat_sym_pmd.c          |  53 +++++++-
 drivers/crypto/qat/qat_sym_pmd.h          |   4 +
 drivers/crypto/qat/qat_sym_session.c      | 148 ++++++++++++++++++++++
 drivers/crypto/qat/qat_sym_session.h      |  12 ++
 9 files changed, 438 insertions(+), 49 deletions(-)

diff --git a/drivers/common/qat/Makefile b/drivers/common/qat/Makefile
index 28bd5668f..85d420709 100644
--- a/drivers/common/qat/Makefile
+++ b/drivers/common/qat/Makefile
@@ -35,6 +35,9 @@ endif
 ifeq ($(CONFIG_RTE_LIBRTE_PMD_QAT_SYM),y)
 	LDLIBS += -lrte_cryptodev
 	LDLIBS += -lcrypto
+ifeq ($(CONFIG_RTE_LIBRTE_SECURITY),y)
+	LDLIBS += -lrte_net
+endif
 	CFLAGS += -DBUILD_QAT_SYM
 	SRCS-y += qat_sym.c
 	SRCS-y += qat_sym_session.c
diff --git a/drivers/crypto/qat/meson.build b/drivers/crypto/qat/meson.build
index fc65923a7..a225f374a 100644
--- a/drivers/crypto/qat/meson.build
+++ b/drivers/crypto/qat/meson.build
@@ -8,6 +8,8 @@ reason = '' # sentinal value to suppress printout
 dep = dependency('libcrypto', required: false)
 qat_includes += include_directories('.')
 qat_deps += 'cryptodev'
+qat_deps += 'net'
+qat_deps += 'security'
 if dep.found()
 	# Add our sources files to the list
 	qat_sources += files('qat_sym_pmd.c',
diff --git a/drivers/crypto/qat/qat_sym.c b/drivers/crypto/qat/qat_sym.c
index 25b6dd5f4..98983c985 100644
--- a/drivers/crypto/qat/qat_sym.c
+++ b/drivers/crypto/qat/qat_sym.c
@@ -9,6 +9,9 @@
 #include <rte_crypto_sym.h>
 #include <rte_bus_pci.h>
 #include <rte_byteorder.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_net_crc.h>
+#endif
 
 #include "qat_sym.h"
 
@@ -44,11 +47,10 @@ bpi_cipher_decrypt(uint8_t *src, uint8_t *dst,
 
 
 static inline uint32_t
-qat_bpicipher_preprocess(struct qat_sym_session *ctx,
-				struct rte_crypto_op *op)
+qat_bpicipher_preprocess(struct qat_sym_session *ctx, struct rte_crypto_op *op,
+				struct rte_crypto_sym_op *sym_op)
 {
 	int block_len = qat_cipher_get_block_size(ctx->qat_cipher_alg);
-	struct rte_crypto_sym_op *sym_op = op->sym;
 	uint8_t last_block_len = block_len > 0 ?
 			sym_op->cipher.data.length % block_len : 0;
 
@@ -99,6 +101,29 @@ qat_bpicipher_preprocess(struct qat_sym_session *ctx,
 	return sym_op->cipher.data.length - last_block_len;
 }
 
+#ifdef RTE_LIBRTE_SECURITY
+static inline void
+qat_crc_generate(struct qat_sym_session *ctx,
+			struct rte_security_docsis_op *doc_op,
+			struct rte_crypto_sym_op *sym_op)
+{
+	uint8_t *crc_data;
+	uint32_t *crc;
+
+	if (ctx->qat_dir == ICP_QAT_HW_CIPHER_ENCRYPT &&
+			doc_op != NULL &&
+			doc_op->crc.length != 0) {
+
+		crc_data = (uint8_t *) rte_pktmbuf_mtod_offset(
+				sym_op->m_src, uint8_t *,
+				doc_op->crc.offset);
+		crc = (uint32_t *)(crc_data + doc_op->crc.length);
+		*crc = rte_net_crc_calc(crc_data, doc_op->crc.length,
+				RTE_NET_CRC32_ETH);
+	}
+}
+#endif
+
 static inline void
 set_cipher_iv(uint16_t iv_length, uint16_t iv_offset,
 		struct icp_qat_fw_la_cipher_req_params *cipher_param,
@@ -162,25 +187,56 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
 	uint8_t do_sgl = 0;
 	uint8_t in_place = 1;
 	int alignment_adjustment = 0;
+	struct rte_crypto_sym_op *sym;
+#ifdef RTE_LIBRTE_SECURITY
+	struct rte_security_op *sec_op;
+	struct rte_security_docsis_op *doc_op = NULL;
+#endif
+
 	struct rte_crypto_op *op = (struct rte_crypto_op *)in_op;
 	struct qat_sym_op_cookie *cookie =
 				(struct qat_sym_op_cookie *)op_cookie;
 
-	if (unlikely(op->type != RTE_CRYPTO_OP_TYPE_SYMMETRIC)) {
-		QAT_DP_LOG(ERR, "QAT PMD only supports symmetric crypto "
-				"operation requests, op (%p) is not a "
-				"symmetric operation.", op);
-		return -EINVAL;
-	}
-
 	if (unlikely(op->sess_type == RTE_CRYPTO_OP_SESSIONLESS)) {
 		QAT_DP_LOG(ERR, "QAT PMD only supports session oriented"
 				" requests, op (%p) is sessionless.", op);
 		return -EINVAL;
 	}
 
-	ctx = (struct qat_sym_session *)get_sym_session_private_data(
-			op->sym->session, cryptodev_qat_driver_id);
+	if (likely(op->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC &&
+			op->sess_type == RTE_CRYPTO_OP_WITH_SESSION)) {
+		sym = op->sym;
+		ctx = (struct qat_sym_session *)get_sym_session_private_data(
+				sym->session, cryptodev_qat_driver_id);
+#ifdef RTE_LIBRTE_SECURITY
+	} else if (op->type == RTE_CRYPTO_OP_TYPE_SECURITY &&
+			op->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) {
+		sec_op = (struct rte_security_op *)&op->security;
+		if (sec_op->type == RTE_SECURITY_OP_TYPE_DOCSIS) {
+			doc_op = &sec_op->docsis;
+			sym = &doc_op->crypto_sym;
+			ctx = (struct qat_sym_session *)
+				get_sec_session_private_data(sym->sec_session);
+		} else {
+			QAT_DP_LOG(ERR, "QAT PMD only supports security"
+					" operation requests for DOCSIS, op"
+					" (%p) is not for DOCSIS.", op);
+			return -EINVAL;
+		}
+#endif
+	} else {
+		QAT_DP_LOG(ERR, "QAT PMD only supports symmetric crypto "
+				"%soperation requests, op (%p) is not a "
+				"symmetric %soperation or the associated "
+				"session type is invalid.",
+#ifdef RTE_LIBRTE_SECURITY
+				"and security ", op, "or security "
+#else
+				"", op, ""
+#endif
+				);
+		return -EINVAL;
+	}
 
 	if (unlikely(ctx == NULL)) {
 		QAT_DP_LOG(ERR, "Session was not created for this device");
@@ -231,27 +287,34 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
 				ICP_QAT_HW_CIPHER_ALGO_ZUC_3G_128_EEA3) {
 
 			if (unlikely(
-			    (op->sym->cipher.data.length % BYTE_LENGTH != 0) ||
-			    (op->sym->cipher.data.offset % BYTE_LENGTH != 0))) {
+			    (sym->cipher.data.length % BYTE_LENGTH != 0) ||
+			    (sym->cipher.data.offset % BYTE_LENGTH != 0))) {
 				QAT_DP_LOG(ERR,
 		  "SNOW3G/KASUMI/ZUC in QAT PMD only supports byte aligned values");
 				op->status = RTE_CRYPTO_OP_STATUS_INVALID_ARGS;
 				return -EINVAL;
 			}
-			cipher_len = op->sym->cipher.data.length >> 3;
-			cipher_ofs = op->sym->cipher.data.offset >> 3;
+			cipher_len = sym->cipher.data.length >> 3;
+			cipher_ofs = sym->cipher.data.offset >> 3;
 
 		} else if (ctx->bpi_ctx) {
-			/* DOCSIS - only send complete blocks to device
+			/* DOCSIS processing */
+
+#ifdef RTE_LIBRTE_SECURITY
+			/* Calculate CRC */
+			qat_crc_generate(ctx, doc_op, sym);
+#endif
+
+			/* Only send complete blocks to device.
 			 * Process any partial block using CFB mode.
 			 * Even if 0 complete blocks, still send this to device
 			 * to get into rx queue for post-process and dequeuing
 			 */
-			cipher_len = qat_bpicipher_preprocess(ctx, op);
-			cipher_ofs = op->sym->cipher.data.offset;
+			cipher_len = qat_bpicipher_preprocess(ctx, op, sym);
+			cipher_ofs = sym->cipher.data.offset;
 		} else {
-			cipher_len = op->sym->cipher.data.length;
-			cipher_ofs = op->sym->cipher.data.offset;
+			cipher_len = sym->cipher.data.length;
+			cipher_ofs = sym->cipher.data.offset;
 		}
 
 		set_cipher_iv(ctx->cipher_iv.length, ctx->cipher_iv.offset,
@@ -428,58 +491,58 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
 		min_ofs = op->sym->aead.data.offset;
 	}
 
-	if (op->sym->m_src->nb_segs > 1 ||
-			(op->sym->m_dst && op->sym->m_dst->nb_segs > 1))
+	if (sym->m_src->nb_segs > 1 ||
+			(sym->m_dst && sym->m_dst->nb_segs > 1))
 		do_sgl = 1;
 
 	/* adjust for chain case */
 	if (do_cipher && do_auth)
 		min_ofs = cipher_ofs < auth_ofs ? cipher_ofs : auth_ofs;
 
-	if (unlikely(min_ofs >= rte_pktmbuf_data_len(op->sym->m_src) && do_sgl))
+	if (unlikely(min_ofs >= rte_pktmbuf_data_len(sym->m_src) && do_sgl))
 		min_ofs = 0;
 
-	if (unlikely((op->sym->m_dst != NULL) &&
-			(op->sym->m_dst != op->sym->m_src))) {
+	if (unlikely((sym->m_dst != NULL) &&
+			(sym->m_dst != sym->m_src))) {
 		/* Out-of-place operation (OOP)
 		 * Don't align DMA start. DMA the minimum data-set
 		 * so as not to overwrite data in dest buffer
 		 */
 		in_place = 0;
 		src_buf_start =
-			rte_pktmbuf_iova_offset(op->sym->m_src, min_ofs);
+			rte_pktmbuf_iova_offset(sym->m_src, min_ofs);
 		dst_buf_start =
-			rte_pktmbuf_iova_offset(op->sym->m_dst, min_ofs);
+			rte_pktmbuf_iova_offset(sym->m_dst, min_ofs);
 
 	} else {
 		/* In-place operation
 		 * Start DMA at nearest aligned address below min_ofs
 		 */
 		src_buf_start =
-			rte_pktmbuf_iova_offset(op->sym->m_src, min_ofs)
+			rte_pktmbuf_iova_offset(sym->m_src, min_ofs)
 						& QAT_64_BTYE_ALIGN_MASK;
 
-		if (unlikely((rte_pktmbuf_iova(op->sym->m_src) -
-					rte_pktmbuf_headroom(op->sym->m_src))
+		if (unlikely((rte_pktmbuf_iova(sym->m_src) -
+					rte_pktmbuf_headroom(sym->m_src))
 							> src_buf_start)) {
 			/* alignment has pushed addr ahead of start of mbuf
 			 * so revert and take the performance hit
 			 */
 			src_buf_start =
-				rte_pktmbuf_iova_offset(op->sym->m_src,
+				rte_pktmbuf_iova_offset(sym->m_src,
 								min_ofs);
 		}
 		dst_buf_start = src_buf_start;
 
 		/* remember any adjustment for later, note, can be +/- */
 		alignment_adjustment = src_buf_start -
-			rte_pktmbuf_iova_offset(op->sym->m_src, min_ofs);
+			rte_pktmbuf_iova_offset(sym->m_src, min_ofs);
 	}
 
 	if (do_cipher || do_aead) {
 		cipher_param->cipher_offset =
 				(uint32_t)rte_pktmbuf_iova_offset(
-				op->sym->m_src, cipher_ofs) - src_buf_start;
+				sym->m_src, cipher_ofs) - src_buf_start;
 		cipher_param->cipher_length = cipher_len;
 	} else {
 		cipher_param->cipher_offset = 0;
@@ -557,8 +620,8 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
 
 		ICP_QAT_FW_COMN_PTR_TYPE_SET(qat_req->comn_hdr.comn_req_flags,
 				QAT_COMN_PTR_TYPE_SGL);
-		ret = qat_sgl_fill_array(op->sym->m_src,
-		   (int64_t)(src_buf_start - rte_pktmbuf_iova(op->sym->m_src)),
+		ret = qat_sgl_fill_array(sym->m_src,
+		   (int64_t)(src_buf_start - rte_pktmbuf_iova(sym->m_src)),
 		   &cookie->qat_sgl_src,
 		   qat_req->comn_mid.src_length,
 		   QAT_SYM_SGL_MAX_NUMBER);
@@ -599,9 +662,9 @@ qat_sym_build_request(void *in_op, uint8_t *out_msg,
 
 	/* Handle Single-Pass GCM */
 	if (ctx->is_single_pass) {
-		cipher_param->spc_aad_addr = op->sym->aead.aad.phys_addr;
+		cipher_param->spc_aad_addr = sym->aead.aad.phys_addr;
 		cipher_param->spc_auth_res_addr =
-				op->sym->aead.digest.phys_addr;
+				sym->aead.digest.phys_addr;
 	}
 
 #if RTE_LOG_DP_LEVEL >= RTE_LOG_DEBUG
diff --git a/drivers/crypto/qat/qat_sym.h b/drivers/crypto/qat/qat_sym.h
index bc6426c32..1a99a68fe 100644
--- a/drivers/crypto/qat/qat_sym.h
+++ b/drivers/crypto/qat/qat_sym.h
@@ -6,6 +6,9 @@
 #define _QAT_SYM_H_
 
 #include <rte_cryptodev_pmd.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_net_crc.h>
+#endif
 
 #ifdef BUILD_QAT_SYM
 #include <openssl/evp.h>
@@ -76,10 +79,10 @@ bpi_cipher_encrypt(uint8_t *src, uint8_t *dst,
 
 static inline uint32_t
 qat_bpicipher_postprocess(struct qat_sym_session *ctx,
-				struct rte_crypto_op *op)
+				struct rte_crypto_op *op,
+				struct rte_crypto_sym_op *sym_op)
 {
 	int block_len = qat_cipher_get_block_size(ctx->qat_cipher_alg);
-	struct rte_crypto_sym_op *sym_op = op->sym;
 	uint8_t last_block_len = block_len > 0 ?
 			sym_op->cipher.data.length % block_len : 0;
 
@@ -132,14 +135,52 @@ qat_bpicipher_postprocess(struct qat_sym_session *ctx,
 	return sym_op->cipher.data.length - last_block_len;
 }
 
+#ifdef RTE_LIBRTE_SECURITY
 static inline void
-qat_sym_process_response(void **op, uint8_t *resp)
+qat_crc_verify(struct qat_sym_session *ctx, struct rte_crypto_op *op,
+		struct rte_security_docsis_op *doc_op,
+		struct rte_crypto_sym_op *sym_op)
 {
+	uint32_t crc = 0;
+	uint8_t *crc_data;
+	uint32_t crc_offset;
+
+	if (ctx->qat_dir == ICP_QAT_HW_CIPHER_DECRYPT &&
+			doc_op != NULL &&
+			doc_op->crc.length != 0) {
+
+		crc_offset = doc_op->crc.offset;
+		crc_data = (uint8_t *) rte_pktmbuf_mtod_offset(
+				sym_op->m_src, uint8_t *, crc_offset);
+
+		if (unlikely((sym_op->m_dst != NULL)
+				&& (sym_op->m_dst != sym_op->m_src)))
+			/* out-of-place operation (OOP) */
+			crc_data = (uint8_t *) rte_pktmbuf_mtod_offset(
+					sym_op->m_dst, uint8_t *, crc_offset);
+
+		crc = rte_net_crc_calc(crc_data, doc_op->crc.length,
+				RTE_NET_CRC32_ETH);
 
+		if (crc != *(uint32_t *)(crc_data + doc_op->crc.length))
+			op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
+	}
+}
+#endif
+
+static inline void
+qat_sym_process_response(void **op, uint8_t *resp)
+{
 	struct icp_qat_fw_comn_resp *resp_msg =
 			(struct icp_qat_fw_comn_resp *)resp;
 	struct rte_crypto_op *rx_op = (struct rte_crypto_op *)(uintptr_t)
 			(resp_msg->opaque_data);
+	struct rte_crypto_sym_op *sym_op;
+	struct qat_sym_session *sess;
+#ifdef RTE_LIBRTE_SECURITY
+	struct rte_security_op *sec_op;
+	struct rte_security_docsis_op *doc_op = NULL;
+#endif
 
 #if RTE_LOG_DP_LEVEL >= RTE_LOG_DEBUG
 	QAT_DP_HEXDUMP_LOG(DEBUG, "qat_response:", (uint8_t *)resp_msg,
@@ -152,15 +193,36 @@ qat_sym_process_response(void **op, uint8_t *resp)
 
 		rx_op->status = RTE_CRYPTO_OP_STATUS_AUTH_FAILED;
 	} else {
-		struct qat_sym_session *sess = (struct qat_sym_session *)
-						get_sym_session_private_data(
-						rx_op->sym->session,
-						cryptodev_qat_driver_id);
-
+#ifdef RTE_LIBRTE_SECURITY
+		if (unlikely(rx_op->type == RTE_CRYPTO_OP_TYPE_SECURITY)) {
+			/*
+			 * Assuming at this point that if it's a security
+			 * op, that this is for DOCSIS
+			 */
+			sec_op = (struct rte_security_op *)&rx_op->security;
+			doc_op = &sec_op->docsis;
+			sess = (struct qat_sym_session *)
+					get_sec_session_private_data(
+					doc_op->crypto_sym.sec_session);
+			sym_op = &doc_op->crypto_sym;
+		} else
+#endif
+		{
+			sess = (struct qat_sym_session *)
+					get_sym_session_private_data(
+					rx_op->sym->session,
+					cryptodev_qat_driver_id);
+			sym_op = rx_op->sym;
+		}
 
-		if (sess->bpi_ctx)
-			qat_bpicipher_postprocess(sess, rx_op);
 		rx_op->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
+
+		if (sess->bpi_ctx) {
+			qat_bpicipher_postprocess(sess, rx_op, sym_op);
+#ifdef RTE_LIBRTE_SECURITY
+			qat_crc_verify(sess, rx_op, doc_op, sym_op);
+#endif
+		}
 	}
 	*op = (void *)rx_op;
 }
diff --git a/drivers/crypto/qat/qat_sym_capabilities.h b/drivers/crypto/qat/qat_sym_capabilities.h
index ff691ce35..4c33188cb 100644
--- a/drivers/crypto/qat/qat_sym_capabilities.h
+++ b/drivers/crypto/qat/qat_sym_capabilities.h
@@ -699,4 +699,48 @@
 		}, }							\
 	}
 
+#ifdef RTE_LIBRTE_SECURITY
+#define QAT_SECURITY_SYM_CAPABILITIES					\
+	{	/* AES DOCSIS BPI */					\
+		.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,			\
+		{.sym = {						\
+			.xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,	\
+			{.cipher = {					\
+				.algo = RTE_CRYPTO_CIPHER_AES_DOCSISBPI,\
+				.block_size = 16,			\
+				.key_size = {				\
+					.min = 16,			\
+					.max = 32,			\
+					.increment = 16			\
+				},					\
+				.iv_size = {				\
+					.min = 16,			\
+					.max = 16,			\
+					.increment = 0			\
+				}					\
+			}, }						\
+		}, }							\
+	}
+
+#define QAT_SECURITY_CAPABILITIES(sym)					\
+	[0] = {	/* DOCSIS Uplink */					\
+		.action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,	\
+		.protocol = RTE_SECURITY_PROTOCOL_DOCSIS,		\
+		.docsis = {						\
+			.direction = RTE_SECURITY_DOCSIS_UPLINK,	\
+			.crc_size = RTE_ETHER_CRC_LEN			\
+		},							\
+		.crypto_capabilities = (sym)				\
+	},								\
+	[1] = {	/* DOCSIS Downlink */					\
+		.action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,	\
+		.protocol = RTE_SECURITY_PROTOCOL_DOCSIS,		\
+		.docsis = {						\
+			.direction = RTE_SECURITY_DOCSIS_DOWNLINK,	\
+			.crc_size = RTE_ETHER_CRC_LEN			\
+		},							\
+		.crypto_capabilities = (sym)				\
+	}
+#endif
+
 #endif /* _QAT_SYM_CAPABILITIES_H_ */
diff --git a/drivers/crypto/qat/qat_sym_pmd.c b/drivers/crypto/qat/qat_sym_pmd.c
index e887c880f..711d1585f 100644
--- a/drivers/crypto/qat/qat_sym_pmd.c
+++ b/drivers/crypto/qat/qat_sym_pmd.c
@@ -8,6 +8,9 @@
 #include <rte_malloc.h>
 #include <rte_pci.h>
 #include <rte_cryptodev_pmd.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_security_driver.h>
+#endif
 
 #include "qat_logs.h"
 #include "qat_sym.h"
@@ -29,6 +32,21 @@ static const struct rte_cryptodev_capabilities qat_gen2_sym_capabilities[] = {
 	RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
 };
 
+#ifdef RTE_LIBRTE_SECURITY
+static const struct rte_cryptodev_capabilities
+					qat_security_sym_capabilities[] = {
+	QAT_SECURITY_SYM_CAPABILITIES,
+	RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
+};
+
+static const struct rte_security_capability qat_security_capabilities[] = {
+	QAT_SECURITY_CAPABILITIES(qat_security_sym_capabilities),
+	{
+		.action = RTE_SECURITY_ACTION_TYPE_NONE
+	}
+};
+#endif
+
 static int qat_sym_qp_release(struct rte_cryptodev *dev,
 	uint16_t queue_pair_id);
 
@@ -237,6 +255,23 @@ static struct rte_cryptodev_ops crypto_qat_ops = {
 		.sym_session_clear	= qat_sym_session_clear
 };
 
+#ifdef RTE_LIBRTE_SECURITY
+static const struct rte_security_capability *
+qat_security_cap_get(void *device __rte_unused)
+{
+	return qat_security_capabilities;
+}
+
+static struct rte_security_ops security_qat_ops = {
+	.session_create = qat_security_session_create,
+	.session_update = NULL,
+	.session_stats_get = NULL,
+	.session_destroy = qat_security_session_destroy,
+	.set_pkt_metadata = NULL,
+	.capabilities_get = qat_security_cap_get
+};
+#endif
+
 static uint16_t
 qat_sym_pmd_enqueue_op_burst(void *qp, struct rte_crypto_op **ops,
 		uint16_t nb_ops)
@@ -276,6 +311,9 @@ qat_sym_dev_create(struct qat_pci_device *qat_pci_dev,
 	char name[RTE_CRYPTODEV_NAME_MAX_LEN];
 	struct rte_cryptodev *cryptodev;
 	struct qat_sym_dev_private *internals;
+#ifdef RTE_LIBRTE_SECURITY
+	struct rte_security_ctx *security_instance;
+#endif
 
 	snprintf(name, RTE_CRYPTODEV_NAME_MAX_LEN, "%s_%s",
 			qat_pci_dev->name, "sym");
@@ -308,7 +346,20 @@ qat_sym_dev_create(struct qat_pci_device *qat_pci_dev,
 			RTE_CRYPTODEV_FF_OOP_SGL_IN_LB_OUT |
 			RTE_CRYPTODEV_FF_OOP_LB_IN_SGL_OUT |
 			RTE_CRYPTODEV_FF_OOP_LB_IN_LB_OUT |
-			RTE_CRYPTODEV_FF_DIGEST_ENCRYPTED;
+			RTE_CRYPTODEV_FF_DIGEST_ENCRYPTED |
+			RTE_CRYPTODEV_FF_SECURITY;
+
+#ifdef RTE_LIBRTE_SECURITY
+	security_instance = rte_malloc("qat_sec",
+				sizeof(struct rte_security_ctx), 0);
+	if (security_instance == NULL)
+		QAT_LOG(ERR, "rte_security_ctx memory alloc failed\n");
+
+	security_instance->device = (void *)cryptodev;
+	security_instance->ops = &security_qat_ops;
+	security_instance->sess_cnt = 0;
+	cryptodev->security_ctx = security_instance;
+#endif
 
 	internals = cryptodev->data->dev_private;
 	internals->qat_dev = qat_pci_dev;
diff --git a/drivers/crypto/qat/qat_sym_pmd.h b/drivers/crypto/qat/qat_sym_pmd.h
index a5a31e512..c625fef4a 100644
--- a/drivers/crypto/qat/qat_sym_pmd.h
+++ b/drivers/crypto/qat/qat_sym_pmd.h
@@ -7,7 +7,11 @@
 
 #ifdef BUILD_QAT_SYM
 
+#include <rte_ether.h>
 #include <rte_cryptodev.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_security.h>
+#endif
 
 #include "qat_sym_capabilities.h"
 #include "qat_device.h"
diff --git a/drivers/crypto/qat/qat_sym_session.c b/drivers/crypto/qat/qat_sym_session.c
index 58bdbd343..0dc5a9ea9 100644
--- a/drivers/crypto/qat/qat_sym_session.c
+++ b/drivers/crypto/qat/qat_sym_session.c
@@ -14,6 +14,9 @@
 #include <rte_log.h>
 #include <rte_malloc.h>
 #include <rte_crypto_sym.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_security.h>
+#endif
 
 #include "qat_logs.h"
 #include "qat_sym_session.h"
@@ -2092,3 +2095,148 @@ int qat_sym_validate_zuc_key(int key_len, enum icp_qat_hw_cipher_algo *alg)
 	}
 	return 0;
 }
+
+#ifdef RTE_LIBRTE_SECURITY
+static int
+qat_sec_session_check_docsis(struct rte_security_session_conf *conf)
+{
+	struct rte_crypto_sym_xform *crypto_sym = conf->crypto_xform;
+	struct rte_security_docsis_xform *docsis = &conf->docsis;
+
+	/* CRC generate -> Cipher encrypt */
+	if (docsis->direction == RTE_SECURITY_DOCSIS_DOWNLINK) {
+
+		if (crypto_sym != NULL &&
+		    crypto_sym->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
+		    crypto_sym->cipher.op == RTE_CRYPTO_CIPHER_OP_ENCRYPT &&
+		    crypto_sym->cipher.algo ==
+					RTE_CRYPTO_CIPHER_AES_DOCSISBPI &&
+		    (crypto_sym->cipher.key.length ==
+					ICP_QAT_HW_AES_128_KEY_SZ ||
+		     crypto_sym->cipher.key.length ==
+					ICP_QAT_HW_AES_256_KEY_SZ) &&
+		    crypto_sym->cipher.iv.length == ICP_QAT_HW_AES_BLK_SZ &&
+		    crypto_sym->next == NULL &&
+		    docsis->crc_size == RTE_ETHER_CRC_LEN) {
+			return 0;
+		}
+	/* Cipher decrypt -> CRC verify */
+	} else if (docsis->direction == RTE_SECURITY_DOCSIS_UPLINK) {
+
+		if (crypto_sym != NULL &&
+		    crypto_sym->type == RTE_CRYPTO_SYM_XFORM_CIPHER &&
+		    crypto_sym->cipher.op == RTE_CRYPTO_CIPHER_OP_DECRYPT &&
+		    crypto_sym->cipher.algo ==
+					RTE_CRYPTO_CIPHER_AES_DOCSISBPI &&
+		    (crypto_sym->cipher.key.length ==
+					ICP_QAT_HW_AES_128_KEY_SZ ||
+		     crypto_sym->cipher.key.length ==
+					ICP_QAT_HW_AES_256_KEY_SZ) &&
+		    crypto_sym->cipher.iv.length == ICP_QAT_HW_AES_BLK_SZ &&
+		    crypto_sym->next == NULL &&
+		    docsis->crc_size == RTE_ETHER_CRC_LEN) {
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+static int
+qat_sec_session_set_docsis_parameters(struct rte_cryptodev *dev,
+		struct rte_security_session_conf *conf, void *session_private)
+{
+	int ret;
+	int qat_cmd_id;
+	struct rte_crypto_sym_xform *xform = NULL;
+	struct qat_sym_session *session = session_private;
+
+	ret = qat_sec_session_check_docsis(conf);
+	if (ret) {
+		QAT_LOG(ERR, "Unsupported DOCSIS security configuration");
+		return ret;
+	}
+
+	xform = conf->crypto_xform;
+
+	/* Set context descriptor physical address */
+	session->cd_paddr = rte_mempool_virt2iova(session) +
+			offsetof(struct qat_sym_session, cd);
+
+	session->min_qat_dev_gen = QAT_GEN1;
+
+	/* Get requested QAT command id */
+	qat_cmd_id = qat_get_cmd_id(xform);
+	if (qat_cmd_id < 0 || qat_cmd_id >= ICP_QAT_FW_LA_CMD_DELIMITER) {
+		QAT_LOG(ERR, "Unsupported xform chain requested");
+		return -ENOTSUP;
+	}
+	session->qat_cmd = (enum icp_qat_fw_la_cmd_id)qat_cmd_id;
+	switch (session->qat_cmd) {
+	case ICP_QAT_FW_LA_CMD_CIPHER:
+		ret = qat_sym_session_configure_cipher(dev, xform, session);
+		if (ret < 0)
+			return ret;
+		break;
+	default:
+	QAT_LOG(ERR, "Unsupported Service %u",
+		session->qat_cmd);
+		return -ENOTSUP;
+	}
+
+	return 0;
+}
+
+int
+qat_security_session_create(void *dev,
+				struct rte_security_session_conf *conf,
+				struct rte_security_session *sess,
+				struct rte_mempool *mempool)
+{
+	void *sess_private_data;
+	struct rte_cryptodev *cdev = (struct rte_cryptodev *)dev;
+	int ret;
+
+	if (rte_mempool_get(mempool, &sess_private_data)) {
+		QAT_LOG(ERR, "Couldn't get object from session mempool");
+		return -ENOMEM;
+	}
+
+	if (conf->protocol != RTE_SECURITY_PROTOCOL_DOCSIS) {
+		QAT_LOG(ERR, "Invalid security protocol");
+		return -EINVAL;
+	}
+
+	ret = qat_sec_session_set_docsis_parameters(cdev, conf,
+			sess_private_data);
+	if (ret != 0) {
+		QAT_LOG(ERR, "Failed to configure session parameters");
+		/* Return session to mempool */
+		rte_mempool_put(mempool, sess_private_data);
+		return ret;
+	}
+
+	set_sec_session_private_data(sess, sess_private_data);
+
+	return ret;
+}
+
+int
+qat_security_session_destroy(void *dev __rte_unused,
+				 struct rte_security_session *sess)
+{
+	void *sess_priv = get_sec_session_private_data(sess);
+	struct qat_sym_session *s = (struct qat_sym_session *)sess_priv;
+
+	if (sess_priv) {
+		if (s->bpi_ctx)
+			bpi_cipher_ctx_free(s->bpi_ctx);
+		memset(s, 0, qat_sym_session_get_private_size(dev));
+		struct rte_mempool *sess_mp = rte_mempool_from_obj(sess_priv);
+
+		set_sec_session_private_data(sess, NULL);
+		rte_mempool_put(sess_mp, sess_priv);
+	}
+	return 0;
+}
+#endif
diff --git a/drivers/crypto/qat/qat_sym_session.h b/drivers/crypto/qat/qat_sym_session.h
index e6538f627..721f8fcd3 100644
--- a/drivers/crypto/qat/qat_sym_session.h
+++ b/drivers/crypto/qat/qat_sym_session.h
@@ -6,6 +6,9 @@
 
 #include <rte_crypto.h>
 #include <rte_cryptodev_pmd.h>
+#ifdef RTE_LIBRTE_SECURITY
+#include <rte_security.h>
+#endif
 
 #include "qat_common.h"
 #include "icp_qat_hw.h"
@@ -156,4 +159,13 @@ qat_cipher_get_block_size(enum icp_qat_hw_cipher_algo qat_cipher_alg);
 int
 qat_sym_validate_zuc_key(int key_len, enum icp_qat_hw_cipher_algo *alg);
 
+#ifdef RTE_LIBRTE_SECURITY
+int
+qat_security_session_create(void *dev, struct rte_security_session_conf *conf,
+		struct rte_security_session *sess, struct rte_mempool *mempool);
+int
+qat_security_session_destroy(void *dev __rte_unused,
+		struct rte_security_session *sess);
+#endif
+
 #endif /* _QAT_SYM_SESSION_H_ */
-- 
2.17.1