[RFC,API-NEXT,v2] api: crypto: add crypto packet operation interface

Message ID 20170628224856.31509-1-dmitry.ereminsolenikov@linaro.org
State New
Headers show

Commit Message

Dmitry Eremin-Solenikov June 28, 2017, 10:48 p.m.
Input and output of crypto operations are packets. API is more flexible
for application and API pipelining when output is packet with additional
metadata. Application or API pipeline stages which do not care about
crypto results may work on basic packet metadata.

Crypto result event type changes from ODP_EVENT_CRYPTO_COMPL to
ODP_EVENT_PACKET. Event subtype (ODP_EVENT_PACKET_CRYPTO) can be
used to identify packets with crypto metadata.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry.ereminsolenikov@linaro.org>

---

Changes since v1:
 - Do not remove original crypto API oriented onto crypto completion event
 - Provide multi-packet function supporting handling several packets during
   single operation.

 include/odp/api/spec/crypto.h                      | 208 ++++++++++++++++++---
 include/odp/arch/default/api/abi/crypto.h          |   8 +-
 include/odp/arch/default/api/abi/event.h           |   7 +-
 .../include/odp/api/plat/crypto_types.h            |   2 +-
 4 files changed, 199 insertions(+), 26 deletions(-)

-- 
2.11.0

Comments

shally verma June 30, 2017, 6:24 a.m. | #1
On Thu, Jun 29, 2017 at 4:18 AM, Dmitry Eremin-Solenikov
<dmitry.ereminsolenikov@linaro.org> wrote:
> Input and output of crypto operations are packets. API is more flexible

> for application and API pipelining when output is packet with additional

> metadata. Application or API pipeline stages which do not care about

> crypto results may work on basic packet metadata.

>

> Crypto result event type changes from ODP_EVENT_CRYPTO_COMPL to

> ODP_EVENT_PACKET. Event subtype (ODP_EVENT_PACKET_CRYPTO) can be

> used to identify packets with crypto metadata.

>

> Signed-off-by: Dmitry Eremin-Solenikov <dmitry.ereminsolenikov@linaro.org>

> ---

>

> Changes since v1:

>  - Do not remove original crypto API oriented onto crypto completion event

>  - Provide multi-packet function supporting handling several packets during

>    single operation.

>

>  include/odp/api/spec/crypto.h                      | 208 ++++++++++++++++++---

>  include/odp/arch/default/api/abi/crypto.h          |   8 +-

>  include/odp/arch/default/api/abi/event.h           |   7 +-

>  .../include/odp/api/plat/crypto_types.h            |   2 +-

>  4 files changed, 199 insertions(+), 26 deletions(-)

>

> diff --git a/include/odp/api/spec/crypto.h b/include/odp/api/spec/crypto.h

> index 470cba05066f..9ea4b9f295fc 100644

> --- a/include/odp/api/spec/crypto.h

> +++ b/include/odp/api/spec/crypto.h

> @@ -40,8 +40,9 @@ extern "C" {

>

>  /**

>   * @typedef odp_crypto_compl_t

> -* Crypto API completion event (platform dependent).

> -*/

> + * @deprecated use packet interface instead

> + * Crypto API completion event (platform dependent).

> + */

>

>  /**

>   * Crypto API operation mode

> @@ -328,9 +329,49 @@ typedef struct odp_crypto_session_param_t {

>  typedef odp_crypto_session_param_t ODP_DEPRECATE(odp_crypto_session_params_t);

>

>  /**

> + * Crypto packet API per packet operation parameters

> + */

> +typedef struct odp_crypto_packet_op_param_t {

> +       /** Session handle from creation */

> +       odp_crypto_session_t session;

> +

> +       /** Override session IV pointer */

> +       uint8_t *override_iv_ptr;

> +

> +       /** Offset from start of packet for hash result

> +        *

> +        *  Specifies the offset where the hash result is to be stored. In case

> +        *  of decode sessions, input hash values will be read from this offset,

> +        *  and overwritten with hash results. If this offset lies within

> +        *  specified 'auth_range', implementation will mute this field before

> +        *  calculating the hash result.

> +        */

> +       uint32_t hash_result_offset;

> +

> +       /** Additional Authenticated Data (AAD) */

> +       struct {

> +               /** Pointer to ADD */

> +               uint8_t *ptr;

> +

> +               /** AAD length in bytes. Use odp_crypto_auth_capability() for

> +                *  supported AAD lengths. */

> +               uint32_t length;

> +       } aad;

> +

> +       /** Data range to apply cipher */

> +       odp_packet_data_range_t cipher_range;

> +

> +       /** Data range to authenticate */

> +       odp_packet_data_range_t auth_range;

> +

> +} odp_crypto_packet_op_param_t;

> +

> +/**

>   * Crypto API per packet operation parameters

> + *

> + * @deprecated use packet interface

>   */

> -typedef struct odp_crypto_op_param_t {

> +typedef struct ODP_DEPRECATE(odp_crypto_op_param_t) {

>         /** Session handle from creation */

>         odp_crypto_session_t session;

>

> @@ -388,10 +429,10 @@ typedef struct odp_crypto_op_param_t {

>         /** Data range to authenticate */

>         odp_packet_data_range_t auth_range;

>

> -} odp_crypto_op_param_t;

> +} ODP_DEPRECATE(odp_crypto_op_param_t);

>

> -/** @deprecated  Use odp_crypto_op_param_t instead */

> -typedef odp_crypto_op_param_t ODP_DEPRECATE(odp_crypto_op_params_t);

> +/** @deprecated  Use ODP_DEPRECATE(odp_crypto_op_param_t) instead */

> +typedef ODP_DEPRECATE(odp_crypto_op_param_t) ODP_DEPRECATE(odp_crypto_op_params_t);

>

>  /**

>   * Crypto API session creation return code

> @@ -438,19 +479,24 @@ typedef enum {

>  /**

>   * Cryto API per packet operation completion status

>   */

> -typedef struct odp_crypto_compl_status {

> +typedef struct odp_crypto_op_status {

>         /** Algorithm specific return code */

>         odp_crypto_alg_err_t alg_err;

>

>         /** Hardware specific return code */

>         odp_crypto_hw_err_t  hw_err;

>

> -} odp_crypto_compl_status_t;

> +} odp_crypto_op_status_t;

> +

> +/** @deprecated  Use ODP_DEPRECATE(odp_crypto_op_status_t) instead */

> +typedef odp_crypto_op_status_t ODP_DEPRECATE(odp_crypto_compl_status_t);

>

>  /**

>   * Crypto API operation result

> + *

> + * @deprecated use packet interface

>   */

> -typedef struct odp_crypto_op_result {

> +typedef struct ODP_DEPRECATE(odp_crypto_op_result) {

>         /** Request completed successfully */

>         odp_bool_t  ok;

>

> @@ -461,12 +507,28 @@ typedef struct odp_crypto_op_result {

>         odp_packet_t pkt;

>

>         /** Cipher status */

> -       odp_crypto_compl_status_t cipher_status;

> +       odp_crypto_op_status_t cipher_status;

> +

> +       /** Authentication status */

> +       odp_crypto_op_status_t auth_status;

> +

> +} ODP_DEPRECATE(odp_crypto_op_result_t);

> +

> +/**

> + * Crypto packet API operation result

> + */

> +typedef struct odp_crypto_packet_op_result_t {

> +       /** Request completed successfully */

> +       odp_bool_t  ok;

> +

> +       /** Cipher status */

> +       odp_crypto_op_status_t cipher_status;

>

>         /** Authentication status */

> -       odp_crypto_compl_status_t auth_status;

> +       odp_crypto_op_status_t auth_status;

> +

> +} odp_crypto_packet_op_result_t;

>

> -} odp_crypto_op_result_t;

>

>  /**

>   * Crypto capabilities

> @@ -614,27 +676,35 @@ int odp_crypto_session_destroy(odp_crypto_session_t session);

>   * Note: any invalid parameters will cause undefined behavior and may cause

>   * the application to abort or crash.

>   *

> + * @deprecated use packet interface

> + *

>   * @param ev An event of type ODP_EVENT_CRYPTO_COMPL

>   *

>   * @return crypto completion handle

>   */

> -odp_crypto_compl_t odp_crypto_compl_from_event(odp_event_t ev);

> +ODP_DEPRECATE(odp_crypto_compl_t) ODP_DEPRECATE(odp_crypto_compl_from_event)(odp_event_t ev);

>

>  /**

>   * Convert crypto completion handle to event handle

>   *

> + * @deprecated use packet interface

> + *

>   * @param completion_event  Completion event to convert to generic event

>   *

>   * @return Event handle

>   */

> -odp_event_t odp_crypto_compl_to_event(odp_crypto_compl_t completion_event);

> +odp_event_t ODP_DEPRECATE(odp_crypto_compl_to_event)(

> +               ODP_DEPRECATE(odp_crypto_compl_t) completion_event);

>

>  /**

>   * Release crypto completion event

>   *

> + * @deprecated use packet interface

> + *

>   * @param completion_event  Completion event we are done accessing

>   */

> -void odp_crypto_compl_free(odp_crypto_compl_t completion_event);

> +void ODP_DEPRECATE(odp_crypto_compl_free)(

> +               ODP_DEPRECATE(odp_crypto_compl_t) completion_event);

>

>  /**

>   * Crypto per packet operation

> @@ -645,6 +715,8 @@ void odp_crypto_compl_free(odp_crypto_compl_t completion_event);

>   * If "posted" returns TRUE the result will be delivered via the completion

>   * queue specified when the session was created.

>   *

> + * @deprecated use packet interface

> + *

>   * @param param             Operation parameters

>   * @param posted            Pointer to return posted, TRUE for async operation

>   * @param result            Results of operation (when posted returns FALSE)

> @@ -652,18 +724,22 @@ void odp_crypto_compl_free(odp_crypto_compl_t completion_event);

>   * @retval 0 on success

>   * @retval <0 on failure

>   */

> -int odp_crypto_operation(odp_crypto_op_param_t *param,

> -                        odp_bool_t *posted,

> -                        odp_crypto_op_result_t *result);

> +int ODP_DEPRECATE(odp_crypto_operation)(

> +               ODP_DEPRECATE(odp_crypto_op_param_t) *param,

> +               odp_bool_t *posted,

> +               ODP_DEPRECATE(odp_crypto_op_result_t) *result);

>

>  /**

>   * Crypto per packet operation query result from completion event

>   *

> + * @deprecated use packet interface

> + *

>   * @param completion_event  Event containing operation results

>   * @param result            Pointer to result structure

>   */

> -void odp_crypto_compl_result(odp_crypto_compl_t completion_event,

> -                            odp_crypto_op_result_t *result);

> +void ODP_DEPRECATE(odp_crypto_compl_result)(

> +               ODP_DEPRECATE(odp_crypto_compl_t) completion_event,

> +               ODP_DEPRECATE(odp_crypto_op_result_t) *result);

>

>  /**

>   * Get printable value for an odp_crypto_session_t

> @@ -681,6 +757,8 @@ uint64_t odp_crypto_session_to_u64(odp_crypto_session_t hdl);

>  /**

>   * Get printable value for an odp_crypto_compl_t

>   *

> + * @deprecated use packet interface

> + *

>   * @param hdl  odp_crypto_compl_t handle to be printed

>   * @return     uint64_t value that can be used to print/display this

>   *             handle

> @@ -689,7 +767,8 @@ uint64_t odp_crypto_session_to_u64(odp_crypto_session_t hdl);

>   * to enable applications to generate a printable value that represents

>   * an odp_crypto_compl_t handle.

>   */

> -uint64_t odp_crypto_compl_to_u64(odp_crypto_compl_t hdl);

> +uint64_t ODP_DEPRECATE(odp_crypto_compl_to_u64)(

> +               ODP_DEPRECATE(odp_crypto_compl_t) hdl);

>

>  /**

>   * Initialize crypto session parameters

> @@ -702,6 +781,93 @@ uint64_t odp_crypto_compl_to_u64(odp_crypto_compl_t hdl);

>  void odp_crypto_session_param_init(odp_crypto_session_param_t *param);

>

>  /**

> + * Return crypto processed packet that is associated with event

> + *

> + * Get packet handle to an crypto processed packet event. Event subtype must be

> + * ODP_EVENT_PACKET_CRYPTO. Crypto operation results can be examined with

> + * odp_crypto_packet_result().

> + *

> + * Note: any invalid parameters will cause undefined behavior and may cause

> + * the application to abort or crash.

> + *

> + * @param ev       Event handle

> + *

> + * @return Packet handle

> + */

> +odp_packet_t odp_crypto_packet_from_event(odp_event_t ev);

> +

> +/**

> + * Convert crypto packet handle to event

> + *

> + * The packet handle must be an output of an crypto operation.

> + *

> + * @param pkt      Packet handle from crypto operation

> + *

> + * @return Event handle

> + */

> +odp_event_t odp_crypto_packet_to_event(odp_packet_t pkt);

> +


Why above two calls cannot be odp_packet_from_event() / odp_packet_event() ?

Do the actual return of two APIs be different?

> +/**

> + * Get crypto operation results from an crypto processed packet

> + *

> + * Successful crypto operations of all types (SYNC and ASYNC) produce packets

> + * which contain crypto result metadata. This function copies the operation

> + * results from an crypto processed packet. Event subtype of this kind of

> + * packet is ODP_EVENT_PACKET_crypto. Results are undefined if a non-crypto

> + * processed packet is passed as input.

> + *

> + * @param         packet  An crypto processed packet (ODP_EVENT_PACKET_CRYPTO)

> + * @param[out]    result  Pointer to operation result for output

> + *

> + * @retval  0     On success

> + * @retval <0     On failure

> + */

> +int odp_crypto_packet_result(odp_crypto_packet_op_result_t *result,

> +                            odp_packet_t packet);

> +

> +/**

> + * Crypto packet operation

> + *

> + * Performs the ASYNC cryptographic operations specified during session creation

> + * on the packets. Caller should initialize pkt_out either with desired output

> + * packet handles or with ODP_PACKET_INVALID to make ODP allocate new packets

> + * from provided pool.

> + *

> + * @param         pkt_in   Packets to be processed

> + * @param         num_in   Number of packets to be processed

> + * @param[in,out] pkt_out  Packet handle array with hints for resulting packets

> + * @param         param    Operation parameters array

> + *

> + * @return Number of input packets consumed (0 ... num_in)

> + * @retval <0 on failure

> + */

> +int odp_crypto_packet_op(const odp_packet_t pkt_in[],

> +                        odp_packet_t pkt_out[],

> +                        int num_in,

> +                        const odp_crypto_packet_op_param_t param[]);

> +


 Is pkt_in array size == pkt_out array size? I think description means
"SYNC" here.

> +/**

> + * Crypto packet operation

> + *

> + * Performs the SYNC cryptographic operations specified during session creation

> + * on the packets. Caller should initialize pkt_out either with desired output

> + * packet handles or with ODP_PACKET_INVALID to make ODP allocate new packets

> + * from provided pool.

> + *

> + * @param pkt_in   Packets to be processed

> + * @param num_in   Number of packets to be processed

> + * @param pkt_out  Packet handle array with hints for resulting packets

> + * @param param    Operation parameters array

> + *

> + * @return Number of input packets consumed (0 ... num_in)

> + * @retval <0 on failure

> + */

> +int odp_crypto_packet_op_enq(const odp_packet_t pkt_in[],

> +                            const odp_packet_t pkt_out[],

> +                            int num_in,

> +                            const odp_crypto_packet_op_param_t param[]);

> +

> +/**

>   * @}

>   */

>

Same Do you mean "Async" here. And what is meaning of "hints" in
description of both API?
can there be any other information provided in pkt_out array other
than handles? Also, pkt_out is CONST here, so if any or all of the
array values set to ODP_PACKET_INVALID, then will this parameter be
updated?


> diff --git a/include/odp/arch/default/api/abi/crypto.h b/include/odp/arch/default/api/abi/crypto.h

> index f0793a198a53..d0af9962aa54 100644

> --- a/include/odp/arch/default/api/abi/crypto.h

> +++ b/include/odp/arch/default/api/abi/crypto.h

> @@ -11,10 +11,13 @@

>  extern "C" {

>  #endif

>

> +#include <odp/api/deprecated.h>

> +

>  #include <stdint.h>

>

>  /** @internal Dummy type for strong typing */

> -typedef struct { char dummy; /**< @internal Dummy */ } _odp_abi_crypto_compl_t;

> +typedef struct { char dummy; /**< @internal Dummy */ }

> +       ODP_DEPRECATE(_odp_abi_crypto_compl_t);

>

>  /** @ingroup odp_crypto

>   *  @{

> @@ -23,7 +26,8 @@ typedef struct { char dummy; /**< @internal Dummy */ } _odp_abi_crypto_compl_t;

>  #define ODP_CRYPTO_SESSION_INVALID (0xffffffffffffffffULL)

>

>  typedef uint64_t  odp_crypto_session_t;

> -typedef _odp_abi_crypto_compl_t *odp_crypto_compl_t;

> +typedef ODP_DEPRECATE(_odp_abi_crypto_compl_t) *

> +       ODP_DEPRECATE(odp_crypto_compl_t);

>

>  /**

>   * @}

> diff --git a/include/odp/arch/default/api/abi/event.h b/include/odp/arch/default/api/abi/event.h

> index ab3c0f755836..871d2cf94de5 100644

> --- a/include/odp/arch/default/api/abi/event.h

> +++ b/include/odp/arch/default/api/abi/event.h

> @@ -11,6 +11,8 @@

>  extern "C" {

>  #endif

>

> +#include <odp/api/deprecated.h>

> +

>  #include <stdint.h>

>

>  /** @internal Dummy type for strong typing */

> @@ -28,14 +30,15 @@ typedef enum odp_event_type_t {

>         ODP_EVENT_BUFFER       = 1,

>         ODP_EVENT_PACKET       = 2,

>         ODP_EVENT_TIMEOUT      = 3,

> -       ODP_EVENT_CRYPTO_COMPL = 4,

> +       ODP_DEPRECATE(ODP_EVENT_CRYPTO_COMPL) = 4,

>         ODP_EVENT_IPSEC_STATUS = 5

>  } odp_event_type_t;

>

>  typedef enum odp_event_subtype_t {

>         ODP_EVENT_NO_SUBTYPE   = 0,

>         ODP_EVENT_PACKET_BASIC = 1,

> -       ODP_EVENT_PACKET_IPSEC = 2

> +       ODP_EVENT_PACKET_CRYPTO = 2,

> +       ODP_EVENT_PACKET_IPSEC = 3

>  } odp_event_subtype_t;

>

>  /**

> diff --git a/platform/linux-generic/include/odp/api/plat/crypto_types.h b/platform/linux-generic/include/odp/api/plat/crypto_types.h

> index 2cc747eb2fde..3a37536925dd 100644

> --- a/platform/linux-generic/include/odp/api/plat/crypto_types.h

> +++ b/platform/linux-generic/include/odp/api/plat/crypto_types.h

> @@ -30,7 +30,7 @@ extern "C" {

>  #define ODP_CRYPTO_SESSION_INVALID (0xffffffffffffffffULL)

>

>  typedef uint64_t odp_crypto_session_t;

> -typedef ODP_HANDLE_T(odp_crypto_compl_t);

> +typedef ODP_HANDLE_T(ODP_DEPRECATE(odp_crypto_compl_t));

>

>  /**

>   * @}

> --

> 2.11.0

>

Patch

diff --git a/include/odp/api/spec/crypto.h b/include/odp/api/spec/crypto.h
index 470cba05066f..9ea4b9f295fc 100644
--- a/include/odp/api/spec/crypto.h
+++ b/include/odp/api/spec/crypto.h
@@ -40,8 +40,9 @@  extern "C" {
 
 /**
  * @typedef odp_crypto_compl_t
-* Crypto API completion event (platform dependent).
-*/
+ * @deprecated use packet interface instead
+ * Crypto API completion event (platform dependent).
+ */
 
 /**
  * Crypto API operation mode
@@ -328,9 +329,49 @@  typedef struct odp_crypto_session_param_t {
 typedef odp_crypto_session_param_t ODP_DEPRECATE(odp_crypto_session_params_t);
 
 /**
+ * Crypto packet API per packet operation parameters
+ */
+typedef struct odp_crypto_packet_op_param_t {
+	/** Session handle from creation */
+	odp_crypto_session_t session;
+
+	/** Override session IV pointer */
+	uint8_t *override_iv_ptr;
+
+	/** Offset from start of packet for hash result
+	 *
+	 *  Specifies the offset where the hash result is to be stored. In case
+	 *  of decode sessions, input hash values will be read from this offset,
+	 *  and overwritten with hash results. If this offset lies within
+	 *  specified 'auth_range', implementation will mute this field before
+	 *  calculating the hash result.
+	 */
+	uint32_t hash_result_offset;
+
+	/** Additional Authenticated Data (AAD) */
+	struct {
+		/** Pointer to ADD */
+		uint8_t *ptr;
+
+		/** AAD length in bytes. Use odp_crypto_auth_capability() for
+		 *  supported AAD lengths. */
+		uint32_t length;
+	} aad;
+
+	/** Data range to apply cipher */
+	odp_packet_data_range_t cipher_range;
+
+	/** Data range to authenticate */
+	odp_packet_data_range_t auth_range;
+
+} odp_crypto_packet_op_param_t;
+
+/**
  * Crypto API per packet operation parameters
+ *
+ * @deprecated use packet interface
  */
-typedef struct odp_crypto_op_param_t {
+typedef struct ODP_DEPRECATE(odp_crypto_op_param_t) {
 	/** Session handle from creation */
 	odp_crypto_session_t session;
 
@@ -388,10 +429,10 @@  typedef struct odp_crypto_op_param_t {
 	/** Data range to authenticate */
 	odp_packet_data_range_t auth_range;
 
-} odp_crypto_op_param_t;
+} ODP_DEPRECATE(odp_crypto_op_param_t);
 
-/** @deprecated  Use odp_crypto_op_param_t instead */
-typedef odp_crypto_op_param_t ODP_DEPRECATE(odp_crypto_op_params_t);
+/** @deprecated  Use ODP_DEPRECATE(odp_crypto_op_param_t) instead */
+typedef ODP_DEPRECATE(odp_crypto_op_param_t) ODP_DEPRECATE(odp_crypto_op_params_t);
 
 /**
  * Crypto API session creation return code
@@ -438,19 +479,24 @@  typedef enum {
 /**
  * Cryto API per packet operation completion status
  */
-typedef struct odp_crypto_compl_status {
+typedef struct odp_crypto_op_status {
 	/** Algorithm specific return code */
 	odp_crypto_alg_err_t alg_err;
 
 	/** Hardware specific return code */
 	odp_crypto_hw_err_t  hw_err;
 
-} odp_crypto_compl_status_t;
+} odp_crypto_op_status_t;
+
+/** @deprecated  Use ODP_DEPRECATE(odp_crypto_op_status_t) instead */
+typedef odp_crypto_op_status_t ODP_DEPRECATE(odp_crypto_compl_status_t);
 
 /**
  * Crypto API operation result
+ *
+ * @deprecated use packet interface
  */
-typedef struct odp_crypto_op_result {
+typedef struct ODP_DEPRECATE(odp_crypto_op_result) {
 	/** Request completed successfully */
 	odp_bool_t  ok;
 
@@ -461,12 +507,28 @@  typedef struct odp_crypto_op_result {
 	odp_packet_t pkt;
 
 	/** Cipher status */
-	odp_crypto_compl_status_t cipher_status;
+	odp_crypto_op_status_t cipher_status;
+
+	/** Authentication status */
+	odp_crypto_op_status_t auth_status;
+
+} ODP_DEPRECATE(odp_crypto_op_result_t);
+
+/**
+ * Crypto packet API operation result
+ */
+typedef struct odp_crypto_packet_op_result_t {
+	/** Request completed successfully */
+	odp_bool_t  ok;
+
+	/** Cipher status */
+	odp_crypto_op_status_t cipher_status;
 
 	/** Authentication status */
-	odp_crypto_compl_status_t auth_status;
+	odp_crypto_op_status_t auth_status;
+
+} odp_crypto_packet_op_result_t;
 
-} odp_crypto_op_result_t;
 
 /**
  * Crypto capabilities
@@ -614,27 +676,35 @@  int odp_crypto_session_destroy(odp_crypto_session_t session);
  * Note: any invalid parameters will cause undefined behavior and may cause
  * the application to abort or crash.
  *
+ * @deprecated use packet interface
+ *
  * @param ev An event of type ODP_EVENT_CRYPTO_COMPL
  *
  * @return crypto completion handle
  */
-odp_crypto_compl_t odp_crypto_compl_from_event(odp_event_t ev);
+ODP_DEPRECATE(odp_crypto_compl_t) ODP_DEPRECATE(odp_crypto_compl_from_event)(odp_event_t ev);
 
 /**
  * Convert crypto completion handle to event handle
  *
+ * @deprecated use packet interface
+ *
  * @param completion_event  Completion event to convert to generic event
  *
  * @return Event handle
  */
-odp_event_t odp_crypto_compl_to_event(odp_crypto_compl_t completion_event);
+odp_event_t ODP_DEPRECATE(odp_crypto_compl_to_event)(
+		ODP_DEPRECATE(odp_crypto_compl_t) completion_event);
 
 /**
  * Release crypto completion event
  *
+ * @deprecated use packet interface
+ *
  * @param completion_event  Completion event we are done accessing
  */
-void odp_crypto_compl_free(odp_crypto_compl_t completion_event);
+void ODP_DEPRECATE(odp_crypto_compl_free)(
+		ODP_DEPRECATE(odp_crypto_compl_t) completion_event);
 
 /**
  * Crypto per packet operation
@@ -645,6 +715,8 @@  void odp_crypto_compl_free(odp_crypto_compl_t completion_event);
  * If "posted" returns TRUE the result will be delivered via the completion
  * queue specified when the session was created.
  *
+ * @deprecated use packet interface
+ *
  * @param param             Operation parameters
  * @param posted            Pointer to return posted, TRUE for async operation
  * @param result            Results of operation (when posted returns FALSE)
@@ -652,18 +724,22 @@  void odp_crypto_compl_free(odp_crypto_compl_t completion_event);
  * @retval 0 on success
  * @retval <0 on failure
  */
-int odp_crypto_operation(odp_crypto_op_param_t *param,
-			 odp_bool_t *posted,
-			 odp_crypto_op_result_t *result);
+int ODP_DEPRECATE(odp_crypto_operation)(
+		ODP_DEPRECATE(odp_crypto_op_param_t) *param,
+		odp_bool_t *posted,
+		ODP_DEPRECATE(odp_crypto_op_result_t) *result);
 
 /**
  * Crypto per packet operation query result from completion event
  *
+ * @deprecated use packet interface
+ *
  * @param completion_event  Event containing operation results
  * @param result            Pointer to result structure
  */
-void odp_crypto_compl_result(odp_crypto_compl_t completion_event,
-			     odp_crypto_op_result_t *result);
+void ODP_DEPRECATE(odp_crypto_compl_result)(
+		ODP_DEPRECATE(odp_crypto_compl_t) completion_event,
+		ODP_DEPRECATE(odp_crypto_op_result_t) *result);
 
 /**
  * Get printable value for an odp_crypto_session_t
@@ -681,6 +757,8 @@  uint64_t odp_crypto_session_to_u64(odp_crypto_session_t hdl);
 /**
  * Get printable value for an odp_crypto_compl_t
  *
+ * @deprecated use packet interface
+ *
  * @param hdl  odp_crypto_compl_t handle to be printed
  * @return     uint64_t value that can be used to print/display this
  *             handle
@@ -689,7 +767,8 @@  uint64_t odp_crypto_session_to_u64(odp_crypto_session_t hdl);
  * to enable applications to generate a printable value that represents
  * an odp_crypto_compl_t handle.
  */
-uint64_t odp_crypto_compl_to_u64(odp_crypto_compl_t hdl);
+uint64_t ODP_DEPRECATE(odp_crypto_compl_to_u64)(
+		ODP_DEPRECATE(odp_crypto_compl_t) hdl);
 
 /**
  * Initialize crypto session parameters
@@ -702,6 +781,93 @@  uint64_t odp_crypto_compl_to_u64(odp_crypto_compl_t hdl);
 void odp_crypto_session_param_init(odp_crypto_session_param_t *param);
 
 /**
+ * Return crypto processed packet that is associated with event
+ *
+ * Get packet handle to an crypto processed packet event. Event subtype must be
+ * ODP_EVENT_PACKET_CRYPTO. Crypto operation results can be examined with
+ * odp_crypto_packet_result().
+ *
+ * Note: any invalid parameters will cause undefined behavior and may cause
+ * the application to abort or crash.
+ *
+ * @param ev       Event handle
+ *
+ * @return Packet handle
+ */
+odp_packet_t odp_crypto_packet_from_event(odp_event_t ev);
+
+/**
+ * Convert crypto packet handle to event
+ *
+ * The packet handle must be an output of an crypto operation.
+ *
+ * @param pkt      Packet handle from crypto operation
+ *
+ * @return Event handle
+ */
+odp_event_t odp_crypto_packet_to_event(odp_packet_t pkt);
+
+/**
+ * Get crypto operation results from an crypto processed packet
+ *
+ * Successful crypto operations of all types (SYNC and ASYNC) produce packets
+ * which contain crypto result metadata. This function copies the operation
+ * results from an crypto processed packet. Event subtype of this kind of
+ * packet is ODP_EVENT_PACKET_crypto. Results are undefined if a non-crypto
+ * processed packet is passed as input.
+ *
+ * @param         packet  An crypto processed packet (ODP_EVENT_PACKET_CRYPTO)
+ * @param[out]    result  Pointer to operation result for output
+ *
+ * @retval  0     On success
+ * @retval <0     On failure
+ */
+int odp_crypto_packet_result(odp_crypto_packet_op_result_t *result,
+			     odp_packet_t packet);
+
+/**
+ * Crypto packet operation
+ *
+ * Performs the ASYNC cryptographic operations specified during session creation
+ * on the packets. Caller should initialize pkt_out either with desired output
+ * packet handles or with ODP_PACKET_INVALID to make ODP allocate new packets
+ * from provided pool.
+ *
+ * @param         pkt_in   Packets to be processed
+ * @param         num_in   Number of packets to be processed
+ * @param[in,out] pkt_out  Packet handle array with hints for resulting packets
+ * @param         param    Operation parameters array
+ *
+ * @return Number of input packets consumed (0 ... num_in)
+ * @retval <0 on failure
+ */
+int odp_crypto_packet_op(const odp_packet_t pkt_in[],
+			 odp_packet_t pkt_out[],
+			 int num_in,
+			 const odp_crypto_packet_op_param_t param[]);
+
+/**
+ * Crypto packet operation
+ *
+ * Performs the SYNC cryptographic operations specified during session creation
+ * on the packets. Caller should initialize pkt_out either with desired output
+ * packet handles or with ODP_PACKET_INVALID to make ODP allocate new packets
+ * from provided pool.
+ *
+ * @param pkt_in   Packets to be processed
+ * @param num_in   Number of packets to be processed
+ * @param pkt_out  Packet handle array with hints for resulting packets
+ * @param param    Operation parameters array
+ *
+ * @return Number of input packets consumed (0 ... num_in)
+ * @retval <0 on failure
+ */
+int odp_crypto_packet_op_enq(const odp_packet_t pkt_in[],
+			     const odp_packet_t pkt_out[],
+			     int num_in,
+			     const odp_crypto_packet_op_param_t param[]);
+
+/**
  * @}
  */
 
diff --git a/include/odp/arch/default/api/abi/crypto.h b/include/odp/arch/default/api/abi/crypto.h
index f0793a198a53..d0af9962aa54 100644
--- a/include/odp/arch/default/api/abi/crypto.h
+++ b/include/odp/arch/default/api/abi/crypto.h
@@ -11,10 +11,13 @@ 
 extern "C" {
 #endif
 
+#include <odp/api/deprecated.h>
+
 #include <stdint.h>
 
 /** @internal Dummy type for strong typing */
-typedef struct { char dummy; /**< @internal Dummy */ } _odp_abi_crypto_compl_t;
+typedef struct { char dummy; /**< @internal Dummy */ }
+	ODP_DEPRECATE(_odp_abi_crypto_compl_t);
 
 /** @ingroup odp_crypto
  *  @{
@@ -23,7 +26,8 @@  typedef struct { char dummy; /**< @internal Dummy */ } _odp_abi_crypto_compl_t;
 #define ODP_CRYPTO_SESSION_INVALID (0xffffffffffffffffULL)
 
 typedef uint64_t  odp_crypto_session_t;
-typedef _odp_abi_crypto_compl_t *odp_crypto_compl_t;
+typedef ODP_DEPRECATE(_odp_abi_crypto_compl_t) *
+	ODP_DEPRECATE(odp_crypto_compl_t);
 
 /**
  * @}
diff --git a/include/odp/arch/default/api/abi/event.h b/include/odp/arch/default/api/abi/event.h
index ab3c0f755836..871d2cf94de5 100644
--- a/include/odp/arch/default/api/abi/event.h
+++ b/include/odp/arch/default/api/abi/event.h
@@ -11,6 +11,8 @@ 
 extern "C" {
 #endif
 
+#include <odp/api/deprecated.h>
+
 #include <stdint.h>
 
 /** @internal Dummy type for strong typing */
@@ -28,14 +30,15 @@  typedef enum odp_event_type_t {
 	ODP_EVENT_BUFFER       = 1,
 	ODP_EVENT_PACKET       = 2,
 	ODP_EVENT_TIMEOUT      = 3,
-	ODP_EVENT_CRYPTO_COMPL = 4,
+	ODP_DEPRECATE(ODP_EVENT_CRYPTO_COMPL) = 4,
 	ODP_EVENT_IPSEC_STATUS = 5
 } odp_event_type_t;
 
 typedef enum odp_event_subtype_t {
 	ODP_EVENT_NO_SUBTYPE   = 0,
 	ODP_EVENT_PACKET_BASIC = 1,
-	ODP_EVENT_PACKET_IPSEC = 2
+	ODP_EVENT_PACKET_CRYPTO = 2,
+	ODP_EVENT_PACKET_IPSEC = 3
 } odp_event_subtype_t;
 
 /**
diff --git a/platform/linux-generic/include/odp/api/plat/crypto_types.h b/platform/linux-generic/include/odp/api/plat/crypto_types.h
index 2cc747eb2fde..3a37536925dd 100644
--- a/platform/linux-generic/include/odp/api/plat/crypto_types.h
+++ b/platform/linux-generic/include/odp/api/plat/crypto_types.h
@@ -30,7 +30,7 @@  extern "C" {
 #define ODP_CRYPTO_SESSION_INVALID (0xffffffffffffffffULL)
 
 typedef uint64_t odp_crypto_session_t;
-typedef ODP_HANDLE_T(odp_crypto_compl_t);
+typedef ODP_HANDLE_T(ODP_DEPRECATE(odp_crypto_compl_t));
 
 /**
  * @}