MACsec Intel® FPGA IP User Guide

Download PDF
ID 736108
Date 10/21/2022
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents
Document Table of Contents x
1. Introduction 2. Interface Overview 3. Parameters 4. Designing with the IP Core 5. MACsec Intel® FPGA IP Example Design 6. Functional Description 7. Configuration Registers for MACsec IP 8. Document Revision History for the MACsec Intel FPGA IP User Guide
1. Introduction x
1.1. Terminology 1.2. IP Core Overview 1.3. Release Information 1.4. Device Family Support 1.5. Device Speed Grade Support and Theoretical Throughput 1.6. Resource Utilization
1.2. IP Core Overview x
1.2.1. IP Description 1.2.2. IP Core Applications
1.2.2. IP Core Applications x
1.2.2.1. SmartNIC 1.2.2.2. Ethernet Bridge + Inline MACsec
2. Interface Overview x
2.1. Block Diagram 2.2. Interfaces 2.3. Clocking Domains
2.2. Interfaces x
2.2.1. IP Interface Signals 2.2.2. IP Interface Signal Timing Diagram/Waveforms 2.2.3. Clocks, Resets, and Interrupts
2.2.1. IP Interface Signals x
2.2.1.1. Common Port Mux Interface 2.2.1.2. Common Port Demux Interface 2.2.1.3. Controlled Port Mux Interface 2.2.1.4. Controlled Port Demux Interface 2.2.1.5. Uncontrolled Port RX Interface 2.2.1.6. Uncontrolled Port TX Interface 2.2.1.7. Crypto RX Interface 2.2.1.8. Crypto TX Interface 2.2.1.9. Management Interface 2.2.1.10. Decrypt Port Mux Management Interface 2.2.1.11. Decrypt Port Demux Management Interface 2.2.1.12. Encrypt Port Mux Management Interface 2.2.1.13. Encrypt Port Demux Management Interface 2.2.1.14. Crypto IP Management Bus
2.2.2. IP Interface Signal Timing Diagram/Waveforms x
2.2.2.1. Common Port Mux Interface Waveform 2.2.2.2. Common Port Demux Interface Waveform 2.2.2.3. Controlled Port Mux Interface Waveform 2.2.2.4. Controlled Port Demux Interface Waveform 2.2.2.5. Uncontrolled Port RX Interface Waveform 2.2.2.6. Uncontrolled Port TX Interface Waveform 2.2.2.7. Crypto RX Waveform 2.2.2.8. Crypto TX Waveform 2.2.2.9. MACsec Management Interface (Read) 2.2.2.10. MACsec Management Interface (Write)
3. Parameters x
3.1. MACsec Intel FPGA IP Parameter Settings
4. Designing with the IP Core x
4.1. Installing and Licensing Intel® FPGA IP Cores 4.2. Specifying the IP Core Parameters and Options 4.3. Generated File Structure 4.4. Reset Transactions 4.5. MACsec Software Initialization Sequence 4.6. MACsec Software Rekeying
4.1. Installing and Licensing Intel® FPGA IP Cores x
4.1.1. Intel® FPGA IP Evaluation Mode
5. MACsec Intel® FPGA IP Example Design x
5.1. Port Configurations 5.2. Multi Interface Buffering Muxing/Demuxing 5.3. 2x25 GbE (Encryption + Decryption) 5.4. Packet Generator/Checker 5.5. Clocking
6. Functional Description x
6.1. AXI-ST Common/Controlled/Uncontrolled Ports 6.2. Packet Parser and Classifier 6.3. SA Lookup and Update 6.4. Encryption Framer/DeFramer 6.5. Decryption Framer/Deframer 6.6. Packet Aggregator/Disaggregator 6.7. Cryptographic AES 6.8. Error Handling 6.9. Packet Statistics
6.1. AXI-ST Common/Controlled/Uncontrolled Ports x
6.1.1. AXI-ST Single Packet Mode 6.1.2. AXI-ST Multi Packet Mode 6.1.3. User Interface Data Streaming 6.1.4. AXI-ST Ready Latency 6.1.5. Port and Secure Channel Mapping 6.1.6. Port and Crypto Channel Mapping 6.1.7. Minimum Packet Size 6.1.8. Byte Ordering 6.1.9. Controlled/Uncontrolled Port Muxing
6.1.3. User Interface Data Streaming x
6.1.3.1. Single Packet Mode Data Stream 6.1.3.2. Multi Packet Mode Data Stream
6.2. Packet Parser and Classifier x
6.2.1. Packet Parser 6.2.2. Packet Classifier
6.3. SA Lookup and Update x
6.3.1. Packet Actions 6.3.2. Packet Buffer 6.3.3. New Channel Assignment 6.3.4. Anti-Replay Protection
6.3.1. Packet Actions x
6.3.1.1. Packet Encrypt 6.3.1.2. Packet Decrypt 6.3.1.3. Packet Discard
6.3.1.3. Packet Discard x
6.3.1.3.1. PDU Validation
6.4. Encryption Framer/DeFramer x
6.4.1. Channel Allocation 6.4.2. Packet Framer 6.4.3. VLAN Tagging
6.4.2. Packet Framer x
6.4.2.1. Bypass Packet 6.4.2.2. Stream Interleaving
6.4.3. VLAN Tagging x
6.4.3.1. No VLAN Tag 6.4.3.2. VLAN Tag (Not in Clear) 6.4.3.3. VLAN Tag (Clear)
6.5. Decryption Framer/Deframer x
6.5.1. XPN Recovery 6.5.2. Replay Check Update 6.5.3. Packet Deframer
6.6. Packet Aggregator/Disaggregator x
6.6.1. Packet Aggregator 6.6.2. Packet Disaggregator
6.7. Cryptographic AES x
6.7.1. Register Address Ordering 6.7.2. Byte Order Swapping 6.7.3. Byte Ordering
6.8. Error Handling x
6.8.1. Packet Error Handling 6.8.2. Memory Blocks ECC Errors 6.8.3. Crypto Errors 6.8.4. System-Level Errors
1. Introduction
2. Interface Overview
3. Parameters
4. Designing with the IP Core
5. MACsec Intel® FPGA IP Example Design
6. Functional Description
7. Configuration Registers for MACsec IP
8. Document Revision History for the MACsec Intel FPGA IP User Guide

2.2.1.7. Crypto RX Interface

This interface is only exposed when CRYPTO_QHIP_EN = 0. Setting CRYPTO_QHIP_EN to '0' is not recommended.

Note: For more information on how to use this interface, refer to Symmetric Cryptographic Intel FPGA Hard IP User Guide.
Table 13.  Crypto RX Interface
Signal Name Width Direction Description
app_ip_st_clk 1 In Clock
app_ip_st_areset_n 1 In Asynchronous reset
aes_app_ip_rx_tvalid 1 In Valid
aes_ip_app_rx_tready 1 Out Ready
aes_ip_app_rx_tid 32 In

Transaction Stream/Channel ID

TID[31:0]:

Stream and Channel ID for Packet 0 (Both Single Packet Mode and Multi Packet Mode) and Packet 1 (Multi Packet Mode only).

  • TID[31:26] – Stream ID for packet 1
  • TID[25:16] – Channel ID for packet 1
  • TID[15:10] – Stream ID for packet 0
  • TID[9:0] – Channel ID for packet 0

Valid on every transfer of the packet

aes_app_ip_rx_tdata 512 In Data
aes_app_ip_rx_tkeep 64 In

1'b1 for data byte, 1'b0 for null byte.

Note: This signal does not allow a null byte in the beginning or middle of the transfer. It is only applicable during the end of the transfer.
aes_app_ip_rx_tlast 1 In Last, indicates end of transfer.
aes_app_ip_rx_tuser.algorithm_types 1 In

Indicates AES or SM4 mode for the current clock cycle

  • 1: SM4;
  • 0: AES
aes_app_ip_rx_tuser.encrypt_decrypt 1 In

Indicates Encrypt or Decrypt mode for the current clock cycle

  • 1: decrypt;
  • 0: encrypt
aes_app_ip_rx_tuser.key_128b_256b 1 In

Indicates 128 bit key size or 256 bit key size mode for the current clock cycle

  • 0: 128 bit key size;
  • 1: 256 bit key size
aes_app_ip_rx_tuser.pattern 4 In

This is a 4-bit encoding for the Traffic Pattern types.

4'b 0010: MACsec

aes_app_ip_rx_tuser.mac_iv_tweak_en 1 In Indicates the data fields carry an IV (or tweak for XTS) and at the output this field indicates the data contains the MAC.
aes_app_ip_rx_tuser.data_en 1 In Indicates that for a given pattern ID the data bits carry the raw data into the crypto cores
aes_app_ip_rx_tuser.next_packet_en 1 In Indicates that there is a start of a new packet midway through the data lines. This is only a valid signal when there is a tlast signal asserted in the same clock and the tkeep.
aes_app_ip_rx_tuser.error_status 1 In Output signal to the fabric indicating any error on the inputs. 0 means there is no error.
aes_app_ip_rx_tuser.error_code 5 In Output signal indicating to the fabric the error code for this cycle.
aes_app_ip_rx_tuser.auth_error 1 In Indicates whether there is any integrity check error during packet decryption. Valid when tlast is asserted.
aes_app_ip_rx_tuser.internal_error 1 In Indication from the QHIP of an internal error detection. This signal is synchronous and when asserted requires the user to read the error status code and CSR’s to detect the error. It also requires the user to drive in the TUser bit for error_clear with the right profile, stream and channel ID of the error in order to use the QHIP again on that profile and channel.
aes_app_ip_rx_tuser_last_segment<segment number> 1 In

Packet segmentation boundary indication for higher bandwidth transfer.

  • aes_app_ip_rx_tuser_last_segment0

  • aes_app_ip_rx_tuser_last_segment1

  • aes_app_ip_rx_tuser_last_segment2

  • aes_app_ip_rx_tuser_last_segment3

Level Two Title