Interface for a security coprocessor

• US 6,789,147 B1
• Filed: 12/19/2001
• Issued: 09/07/2004
• Est. Priority Date: 07/24/2001
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Cavium, LLC (Marvell Technology Group Limited)
• Inventors: Ahmed, Khaja E., Sanzone, Robert A., Carlson, David A., Hussain, Muhammad Raghib, Varga, Michael D., Kessler, Richard E.
• Primary Examiner(s): Ray, Gopal C.
• Application Number:
  US10/025,512
• Time in Patent Office: 993 Days
• Field of Search: 710/22, 710/52, 710/39, 710/200, 713/200, 711/163, 712/215, 712/221, 712/34, 705/405, 707/8, 709/201, 717/149
• US Class Current: 710/200
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A method and apparatus for processing security operations are described. In one embodiment, a processor includes a number of execution units to process a number of requests for security operations. The number of execution units are to output the results of the number of requests to a number of output data structures associated with the number of requests within a remote memory based on pointers stored in the number of requests. The number of execution units can output the results in an order that is different from the order of the requests in a request queue. The processor also includes a request unit coupled to the number of execution units. The request unit is to retrieve a portion of the number of requests from the request queue within the remote memory and associated input data structures for the portion of the number of requests from the remote memory. Additionally, the request unit is to distribute the retrieved requests to the number of execution units based on availability for processing by the number of execution units.

Claims

1. A method comprising:

retrieving, by a request unit, a number of requests for security operations from a host memory, wherein the number of requests are in an order within the host memory;

distributing, by the request unit, the number of requests for the security operations to a number of execution units, wherein the distribution is based on availability of the number of execution units;

processing the number of requests for the security operations by the number of execution units; and

outputting results of the number of requests for the security operations to locations within the host memory, wherein an order of outputting of the results can be different from the order of the requests within the host memory.

2. The method of claim 1, wherein the number of requests relate to a number of different secure sockets layer sessions, wherein the number of requests can be independent of one another.

3. The method of claim 1, wherein a time to process one of the number of requests can be different from a time to process another of the number of requests.

4. The method of claim 1, wherein each of the number of execution units can process any of the different types of the security operations within the number of requests.

5. The method of claim 1, wherein a request can include a macro security operation.

6. The method of claim 1, wherein retrieving of the number of requests comprises retrieving the number of requests from a queue in the host memory using a first direct memory access (DMA) read operation for the number of requests and retrieving input data structures related to the number of requests from the host memory using a second DMA read operation.

7. The method of claim 6, wherein outputting the results of the number of requests comprises outputting the results of the number of requests using a DMA write operation.

8. The method of claim 7, wherein retrieving of one of the number of requests and outputting of the one of the number of requests includes approximately two DMA operations.

9. The method of claim 1, wherein the outputting of the results of the number of requests for the security operations to locations within the host memory includes outputting the results of the number of requests for the security operations to locations within the host memory based on pointers stored in the number of requests.

10. The method of claim 1, wherein outputting results of the number of requests for the security operations to locations within the host memory includes setting a value of a completion code at the locations within the host memory, the completion code to indicate completion of the request.

11. A method executing on a host processor, the method comprising:

storing a number of requests for security operations within a request queue within a host memory, wherein the number of requests are in an order within the request queue;

storing data related to the number of requests for security operations into a number of input data structures within the host memory;

allocating a number of output data structures within the host memory, wherein a coprocessor is to write results of the number of requests for the security operations into the number of output data structures, wherein the coprocessor can write the results in an order that is different from the order of the requests within the request queue; and

for each of the number of requests, allocating a thread for execution on the host processor, wherein the thread periodically checks a value of a completion code stored in the output data structure for the associated request, the completion code to indicate that the request is completed by the coprocessor.

12. The method of claim 11, wherein the request queue is locked during the storing of the number of requests within the request queue.

13. The method of claim 11, further comprising writing a number of the number of requests stored within the request queue into a memory location on the coprocessor.

14. The method of claim 11, wherein each thread of execution is associated with a different security socket layer session.

15. The method of claim 11, wherein the thread of execution checks the value of the completion code for the associated request independent of other threads of execution.

16. The method of claim 11, wherein at least one of the number of requests include a macro security operation.

17. A processor comprising:

a number of execution units to process a number of requests for security operations, wherein the number of execution units are to output the results of the number of requests to a number of output data structures associated with the number of requests within a remote memory based on pointers stored in the number of requests and wherein the number of execution units can output the results in an order that is different from the order of the requests in a request queue; and

a request unit coupled to the number of execution units, wherein the request unit is to retrieve a portion of the number of requests from the request queue within the remote memory and associated input data structures for the portion of the number of requests from the remote memory and wherein the request unit is to distribute the retrieved requests to the number of execution units based on availability for processing by the number of execution units.

18. The processor of claim 17, wherein the number of requests relate to a number of different secure sockets layer sessions, wherein the number of requests can be independent of one another.

19. The processor of claim 17, wherein a time to process one of the number of requests can be different from a time to process another of the number of requests.

20. The processor of claim 17, wherein each of the number of execution units can process any of the different types of the security operations within the number of requests.

21. The processor of claim 17, wherein a request can include a macro security operation.

22. The processor of claim 17, wherein the request unit is to retrieve the number of requests from the request queue using a first direct memory access (DMA) read operation and wherein the request unit is to retrieve the number of associated input data structures using a second DMA read operation.

23. The processor of claim 22, wherein the number of execution units are to output the results of the number of requests to the number of output data structures using a DMA write operation.

24. A system comprising:

a host processor coupled to a system bus;

a host memory coupled to the system bus, wherein the host memory is to store,

a request queue to include a number of requests for security operations, wherein the number of requests are in an order within the request queue;

a number of input data structures to include data associated with the number of requests; and

a number of output data structures to include results from processing of the number of requests; and

a coprocessor coupled to the system bus, wherein the coprocessor comprises,

a number of execution units to process the number of requests for security operations, wherein the number of execution units are to output the results of the number of requests to the number of output data structures associated with the number of requests based on pointers stored in the number of requests and wherein the number of execution units can output the results in an order that is different from the order of the requests in the request queue; and

a request unit coupled to the number of execution units, wherein the request unit is to retrieve a portion of the number of requests from the request queue and associated input data structures for the portion of the number of requests from host memory and wherein the request unit is to distribute the retrieved requests to the number of execution units based on availability for processing by the number of execution units.

25. The system of claim 24, wherein the number of requests relate to a number of different secure sockets layer sessions, wherein the number of requests can be independent of one another.

26. The system of claim 24, wherein a time to process one of the number of requests can be different from a time to process another of the number of requests.

27. The system of claim 24, wherein each of the number of execution units can process any of the different types of the security operations within the number of requests.

28. The system of claim 24, wherein a request can include a macro security operation.

29. The system of claim 24, wherein the request unit is to retrieve the number of requests from the request queue using a first direct memory access (DMA) read operation and wherein the request unit is to retrieve the number of associated input data structures using a second DMA read operation.

30. The system of claim 29, wherein the number of execution units are to output the results of the number of requests to the number of output data structures using a DMA write operation.

31. A machine-readable medium that provides instructions, which when executed by a machine, causes the machine to perform operations comprising:

retrieving, by a request unit, a number of requests for security operations from a host memory, wherein the number of requests are in an order within the host memory;

distributing, by the request unit, the number of requests for the security operations to a number of execution units, wherein the distribution is based on availability of the number of execution units;

processing the number of requests for the security operations by the number of execution units; and

outputting results of the number of requests for the security operations to locations within the host memory, wherein an order of outputting of the results can be different from the order of the requests within the host memory.

32. The machine-readable medium of claim 31, wherein the number of requests relate to a number of different secure sockets layer sessions, wherein the number of requests can be independent of one another.

33. The machine-readable medium of claim 31, wherein a time to process one of the number of requests can be different from a time to process another of the number of requests.

34. The machine-readable medium of claim 31, wherein each of the number of execution units can process any of the different types of the security operations within the number of requests.

35. The machine-readable medium of claim 31, wherein a request can include a macro security operation.

36. The machine-readable medium of claim 31, wherein retrieving of the number of requests comprises retrieving the number of requests from a queue in the host memory using a first direct memory access (DMA) read operation for the number of requests and retrieving input data structures related to the number of requests from the host memory using a second DMA read operation.

37. The machine-readable medium of claim 36, wherein outputting the results of the number of requests comprises outputting the results of the number of requests using a DMA write operation.

38. The machine-readable medium of claim 37, wherein retrieving of one of the number of requests and outputting of the one of the number of requests includes approximately two DMA operations.

39. The machine-readable medium of claim 31, wherein the outputting of the results of the number of requests for the security operations to locations within the host memory includes outputting the results of the number of requests for the security operations to locations within the host memory based on pointers stored in the number of requests.

40. The machine-readable medium of claim 31, wherein outputting results of the number of requests for the security operations to locations within the host memory includes setting a value of a completion code at the locations within the host memory, the completion code to indicate completion of the request.

41. A machine-readable medium that provides instructions, which when executed by a host processor, causes the host processor to perform operations comprising:

storing a number of requests for security operations within a request queue within a host memory, wherein the number of requests are in an order within the request queue;

storing data related to the number of requests for security operations into a number of input data structures within the host memory;

allocating a number of output data structures within the host memory, wherein a coprocessor is to write results of the number of requests for the security operations into the number of output data structures, wherein the coprocessor can write the results in an order that is different from the order of the requests within the request queue; and

for each of the number of requests, allocating a thread for execution on the host processor, wherein the thread periodically checks a value of a completion code stored in the output data structure for the associated request, the completion code to indicate that the request is completed by the coprocessor.

42. The machine-readable medium of claim 41, wherein the request queue is locked during the storing of the number of requests within the request queue.

43. The machine-readable medium of claim 41, further comprising writing a number of the number of requests stored within the request queue into a memory location on the coprocessor.

44. The machine-readable medium of claim 41, wherein each thread of execution is associated with a different security socket layer session.

45. The machine-readable medium of claim 41, wherein the thread of execution checks the value of the completion code for the associated request independent of other threads of execution.

46. The machine-readable medium of claim 41, wherein at least one of the number of requests include a macro security operation.