MACsec Intel® FPGA IP User Guide

ID 736108
Date 10/21/2022
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents

6.8.3. Crypto Errors

Based on traffic sent to the Crypto HIP, there are several errors that can be flagged and the potential list of errors is shown below. These errors and flags are obtained through the TUSER.error_status and TUSER.error_code signals of the AXI-ST interface. These fatal errors are not expected since they are generated due to either invalid configuration or invalid packet format. Any errors observed from the Crypto IP need to be root-caused and fixed in hardware or configuration.
Table 59.  Crypto Errors
Category Error status code Error Description Recoverable Root Cause Mitigation Notes
Modes Invalid AES request [0x13] AES requested when it is disabled in HW No Invalid System Configuration generated by user User need to regenerate Crypto QHIP with AES enabled This error makes all MACsec traffics fail with errors.
EOB without SOB error [0x3] User indicated End of block without a start of block No MACsec IP HW error Fix MACsec IP HW logic bug  
Transfer without SOB error [0x2] Transfer started without SOB No MACsec IP HW error Fix MACsec IP HW logic bug  
Key RAM uncorrectable error [1]   No Log error in MACsec IP Error CSR and fire interrupt User needs to toggle the reset to the ICA subsystem and MACsec IP  
Stream RAM uncorrectable error [0]   No Log error in MACsec IP Error CSR and fire interrupt User needs to toggle the reset to the ICA subsystem and MACsec IP  
AES Counter overflow indication [0x7] AES counter rolled over AES GCM allowed limit No MACsec IP HW error Fix MACsec IP HW logic bug Potential back to back packets with single SOP but no EOP
Packet Processing No Key received for MACsec patterns [0x17] User tried to initiate data authentication, encryption or decryption but did not send in the key earlier No

1. Channel Inuse CSR not reset properly after new SA update

2. Channel Allocation cycle loss due to packet drop or MACsec IP error

Fix MACsec IP HW:

1. Ensure new SA update clear Channel Inuse CSR bits

2. Fix MACsec IP to ensure the Channel Allocation cycle not loss due to packet drop or MACsec IP bug

 
No IV or tweak received for MACsec patterns [0x19] User did not send any IV or tweak at the beginning of the packets No MACsec IP HW error Fix MACsec IP HW logic bug  
No end of packet for data for MACsec [0x1b] User started encryption or decryption but did not toggle end of packet and we reached max length limit No MACsec IP HW error Fix MACsec IP HW logic bug  
Crypto Internal Errors

Pack IPSec Internal Errs

Pack Gen XTS Internal Errs

Pack Gen GCM Internal Errs

Depack MacSec Internal Errs

Depack IPSec Internal Errs

Depack Gen XTS Internal Errs

Depack Gen GCM Internal Errs

Pack RAM Prefetch UNC ECC

DePack RAM Prefetch UNC ECC

256/512 Gasket

RMB Stream RAM UNC ECC

RMB Key RAM UNC ECC

Pack RAM UNC ECC

Depack RAM UNC ECC

MAC FIFO UNC ECC

MAC FIFO OVF

AXI ST Egress MST1 FIFO OVF

AXI ST Egress MST0 FIFO OVF

AXI ST Ingress SLV1 FIFO OVF

AXI ST Ingress SLV0 FIFO OVF

[0x1f]

  No Log error in MACsec IP Error CSR and fire interrupt User needs to toggle the reset to the ICA subsystem and MACsec IP