Compress, SHA, Erasure Coding, AES-GCM

1Compress and decompress: what each BlueField actually does

DOCA Compress is GA in 3.5.0, but the hardware behind it differs by generation and the guide is precise about it: “For BlueField-2 devices, this library supports: Compress operation using the deflate algorithm; Decompress operation using the deflate algorithm. For BlueField-3 devices, this library supports: Decompress operation using the deflate algorithm; Decompress operation using the LZ4 algorithm.”^⁠1⁠7 Read that twice: on BlueField-3 there is no hardware deflate compress and no LZ4 compress. The datasheet’s storage feature list says “Decompression engine”, not compression, which matches.^⁠10

The task API mirrors the table. Configuration calls are doca_compress_task_compress_deflate_set_conf, doca_compress_task_decompress_deflate_set_conf, doca_compress_task_decompress_lz4_stream_set_conf and doca_compress_task_decompress_lz4_block_set_conf; capability probes are doca_compress_cap_task_<type>_is_supported, _get_max_buf_size, _get_max_buf_list_len and doca_compress_get_max_num_tasks.^⁠1 Each task also yields checksums through getters: “Adler – produced by the deflate compress and decompress tasks”, “CRC – produced by all tasks”, “xxHash – produced by the LZ4 decompress tasks”.^⁠1 The 3.5.0 sample tree contains compress_deflate, decompress_deflate and decompress_lz4_stream; the README notes the old generic “decompress LZ4 task” was removed in favor of the stream and block tasks.^⁠2⁠15

Samples take -p/--pci-addr, -f/--file, -o/--output and -c/--output-checksum; the deflate samples add -wf/--with-frame to write or read a zlib-framed file “compatible with default zlib settings”, and the LZ4 sample adds -bc/--has-block-checksum, -bi/--are-blocks-independent and its own -wf for LZ4 frames.^⁠2⁠15 Without the frame flag DOCA Compress “handles payload only”.^⁠2 A design consequence for storage stacks: on BlueField-3 the read path (decompress) can be offloaded while the write path (compress) stays on CPU or uses another engine — say so before the customer budgets cores.

2SHA: the engine BlueField-3 does not have

DOCA SHA exposes SHA1, SHA2-256 and SHA2-512 through doca_sha_task_hash_set_conf and doca_sha_task_partial_hash_set_conf, with capability queries doca_sha_cap_task_hash_get_supported, doca_sha_cap_task_partial_hash_get_supported, doca_sha_cap_get_max_src_buf_size, doca_sha_cap_get_min_dst_buf_size and doca_sha_cap_get_partial_hash_block_size.^⁠3 Then the sentence that decides designs: “NVIDIA BlueField-3 does not support this library because it has no SHA acceleration engine.”^⁠3 The library is GA in the index, but GA on BlueField-2 hardware only; on BF-2, PF, VF and SF all reach the same engine.^⁠7⁠3

What this means in practice. First, doca_sha device discovery on a BlueField-3 finds no capable device — the sha_create sample cannot run there.^⁠11⁠3 Second, the DOCA Bench doca_sha step exists, but on BF-3 it will not enumerate; the NVIDIA bench skill’s advice is that empty enumeration means the library is not usable on that install, not a bench failure.^⁠8⁠9 Third, integrity hashing for a BF-3 design lands on the host CPU, on the Arm cores in software, or on a BlueField-2. AES-GCM authenticates ciphertext with a tag, which is not a substitute for a standalone digest.^⁠6

The two samples show the API shape you would use on BF-2: sha_create sets a doca_sha_task_hash pool, populates two buffers, submits once and reads the digest; sha_partial_create chops the source into segments sized to the algorithm block size, feeds them through one doca_sha_task_partial_hash with doca_sha_task_partial_hash_set_src, and marks the last with doca_sha_task_partial_hash_set_is_final_buf.^⁠11 The sha_create sample registers exactly one program flag, -d/--data (“user data”).^⁠18

3Erasure Coding: parity math on BlueField-3

DOCA Erasure Coding is GA and runs on “BlueField-3 with some limitations”, on any PF, VF or SF, with representors for host-DPU memory.^⁠4⁠7 Matrices come from doca_ec_matrix_create(type) with DOCA_EC_MATRIX_TYPE_CAUCHY or DOCA_EC_MATRIX_TYPE_VANDERMONDE, plus doca_ec_matrix_create_from_raw, doca_ec_matrix_create_update and doca_ec_matrix_create_recover; tasks are doca_ec_task_galois_mul, doca_ec_task_create (encode), doca_ec_task_update and doca_ec_task_recover, each with *_set_conf, and capabilities doca_ec_cap_task_*_is_supported, doca_ec_cap_get_max_block_size and doca_ec_cap_get_max_buf_list_len.^⁠4

The documented BlueField-3 limits: “Data block count range: 1-128; Redundancy block count: 1-32; Block size: 64B-128MB”, and source data length must be a multiple of the block size and aligned to 64 bytes.^⁠4 The erasure_coding_recover sample runs three phases: encode (split the input into -t/--data blocks, build a matrix by -x/--matrix cauchy or vandermonde, submit doca_ec_task_create, write -r/--rdnc redundancy blocks), delete (-d/--delete-index, comma-separated indices), and decode (read the survivors, detect missing blocks, doca_ec_matrix_create_recover() from the encoding matrix, submit doca_ec_task_recover, write the recovered file).^⁠5⁠14 Defaults are -p 03:00.0, 2 data blocks, 2 redundancy blocks, cauchy, delete index 0, output under /tmp, with -b/--both to run encode and decode in one go.^⁠14

4AES-GCM: authenticated encryption with tight parameters

The AES-GCM guide states the library “is supported at alpha level and on NVIDIA BlueField-3 devices or higher”, while the 3.5.0 libraries index lists DOCA AES-GCM as GA — two NVIDIA pages that disagree, which you should quote together.^⁠6⁠7 Keys are created with doca_aes_gcm_key_create; the sample’s -k/--key help spells out “32 characters for 128-bit key, and 64 for 256-bit key” in hex, and the code uses DOCA_AES_GCM_KEY_128 and DOCA_AES_GCM_KEY_256.^⁠13 The IV is “0B-12B” long and the authentication tag is “only 12B and 16B”; additional authenticated data sits at the start of the source buffer, and on encrypt the tag is appended to the result while on decrypt it is verified and stripped.^⁠6

Tasks are doca_aes_gcm_task_encrypt and doca_aes_gcm_task_decrypt (*_set_conf, *_alloc_init, *_as_task), with capability calls doca_aes_gcm_cap_task_encrypt_is_supported, _get_max_buf_size and _get_max_list_buf_num_elem (and the decrypt equivalents).^⁠13⁠6 Buffers may be local, PCIe-exported or linked lists. Task limitations: “The operation is not atomic” and “Once the task is submitted, the source and destination should not be read/written to”.^⁠6

Sample defaults from aes_gcm_common.c: device 03:00.0, output /tmp/out.txt, a 96-bit all-zero IV, tag size 12, AAD size 0, plus -ns/--num-src-buf and -nd/--num-dst-buf for list buffers.^⁠13⁠12 Both samples follow the same eleven steps: locate device, init Core, set task conf, populate mmap with two buffers, allocate inventory elements, create the key, alloc-init the task, submit, retrieve, check, destroy.^⁠12

5Numbers: measure, do not quote

There is no official per-engine throughput table for these libraries on the fetched 3.5.0 pages, and NVIDIA’s own doca-bench skill deliberately ships no expected numbers.^⁠8⁠9 The DOCA Bench guide shows an example block — “Throughput: 5712042 Operations/s, Ingress rate: 063.832 Gib/s” — as illustrative output with no stated workload; it is not a BlueField-3 spec.^⁠8 The right artifact is a measured CSV with the command line, DOCA version, device and environment attached.^⁠9

DOCA Bench drives exactly these engines: pipeline steps doca_compress::compress|decompress, doca_sha, doca_ec::create|recover|update and doca_aes_gcm::encrypt|decrypt, tuned by attributes such as doca_compress.algorithm, doca_sha.algorithm and doca_ec.data_block_count.^⁠8 The guide explains why the data provider matters: doca_dma and doca_sha “would execute in constant time regardless of the input data”, whereas doca_compress “would be faster with data with more duplication and slower for truly random data”.^⁠8 Sweep support (--sweep core-count,1,8,*2), --csv-output-file (one line per sweep iteration) and --record-cpu-usage turn a run into the input M6.5 needs.^⁠8 Note the table caveat that “Input remote memory is not supported for lz4 decompression” in Bench.^⁠8