MACsec Intel® FPGA IP User Guide

Download PDF
ID 736108
Date 10/21/2022
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents
Document Table of Contents x
1. Introduction 2. Interface Overview 3. Parameters 4. Designing with the IP Core 5. MACsec Intel® FPGA IP Example Design 6. Functional Description 7. Configuration Registers for MACsec IP 8. Document Revision History for the MACsec Intel FPGA IP User Guide
1. Introduction x
1.1. Terminology 1.2. IP Core Overview 1.3. Release Information 1.4. Device Family Support 1.5. Device Speed Grade Support and Theoretical Throughput 1.6. Resource Utilization
1.2. IP Core Overview x
1.2.1. IP Description 1.2.2. IP Core Applications
1.2.2. IP Core Applications x
1.2.2.1. SmartNIC 1.2.2.2. Ethernet Bridge + Inline MACsec
2. Interface Overview x
2.1. Block Diagram 2.2. Interfaces 2.3. Clocking Domains
2.2. Interfaces x
2.2.1. IP Interface Signals 2.2.2. IP Interface Signal Timing Diagram/Waveforms 2.2.3. Clocks, Resets, and Interrupts
2.2.1. IP Interface Signals x
2.2.1.1. Common Port Mux Interface 2.2.1.2. Common Port Demux Interface 2.2.1.3. Controlled Port Mux Interface 2.2.1.4. Controlled Port Demux Interface 2.2.1.5. Uncontrolled Port RX Interface 2.2.1.6. Uncontrolled Port TX Interface 2.2.1.7. Crypto RX Interface 2.2.1.8. Crypto TX Interface 2.2.1.9. Management Interface 2.2.1.10. Decrypt Port Mux Management Interface 2.2.1.11. Decrypt Port Demux Management Interface 2.2.1.12. Encrypt Port Mux Management Interface 2.2.1.13. Encrypt Port Demux Management Interface 2.2.1.14. Crypto IP Management Bus
2.2.2. IP Interface Signal Timing Diagram/Waveforms x
2.2.2.1. Common Port Mux Interface Waveform 2.2.2.2. Common Port Demux Interface Waveform 2.2.2.3. Controlled Port Mux Interface Waveform 2.2.2.4. Controlled Port Demux Interface Waveform 2.2.2.5. Uncontrolled Port RX Interface Waveform 2.2.2.6. Uncontrolled Port TX Interface Waveform 2.2.2.7. Crypto RX Waveform 2.2.2.8. Crypto TX Waveform 2.2.2.9. MACsec Management Interface (Read) 2.2.2.10. MACsec Management Interface (Write)
3. Parameters x
3.1. MACsec Intel FPGA IP Parameter Settings
4. Designing with the IP Core x
4.1. Installing and Licensing Intel® FPGA IP Cores 4.2. Specifying the IP Core Parameters and Options 4.3. Generated File Structure 4.4. Reset Transactions 4.5. MACsec Software Initialization Sequence 4.6. MACsec Software Rekeying
4.1. Installing and Licensing Intel® FPGA IP Cores x
4.1.1. Intel® FPGA IP Evaluation Mode
5. MACsec Intel® FPGA IP Example Design x
5.1. Port Configurations 5.2. Multi Interface Buffering Muxing/Demuxing 5.3. 2x25 GbE (Encryption + Decryption) 5.4. Packet Generator/Checker 5.5. Clocking
6. Functional Description x
6.1. AXI-ST Common/Controlled/Uncontrolled Ports 6.2. Packet Parser and Classifier 6.3. SA Lookup and Update 6.4. Encryption Framer/DeFramer 6.5. Decryption Framer/Deframer 6.6. Packet Aggregator/Disaggregator 6.7. Cryptographic AES 6.8. Error Handling 6.9. Packet Statistics
6.1. AXI-ST Common/Controlled/Uncontrolled Ports x
6.1.1. AXI-ST Single Packet Mode 6.1.2. AXI-ST Multi Packet Mode 6.1.3. User Interface Data Streaming 6.1.4. AXI-ST Ready Latency 6.1.5. Port and Secure Channel Mapping 6.1.6. Port and Crypto Channel Mapping 6.1.7. Minimum Packet Size 6.1.8. Byte Ordering 6.1.9. Controlled/Uncontrolled Port Muxing
6.1.3. User Interface Data Streaming x
6.1.3.1. Single Packet Mode Data Stream 6.1.3.2. Multi Packet Mode Data Stream
6.2. Packet Parser and Classifier x
6.2.1. Packet Parser 6.2.2. Packet Classifier
6.3. SA Lookup and Update x
6.3.1. Packet Actions 6.3.2. Packet Buffer 6.3.3. New Channel Assignment 6.3.4. Anti-Replay Protection
6.3.1. Packet Actions x
6.3.1.1. Packet Encrypt 6.3.1.2. Packet Decrypt 6.3.1.3. Packet Discard
6.3.1.3. Packet Discard x
6.3.1.3.1. PDU Validation
6.4. Encryption Framer/DeFramer x
6.4.1. Channel Allocation 6.4.2. Packet Framer 6.4.3. VLAN Tagging
6.4.2. Packet Framer x
6.4.2.1. Bypass Packet 6.4.2.2. Stream Interleaving
6.4.3. VLAN Tagging x
6.4.3.1. No VLAN Tag 6.4.3.2. VLAN Tag (Not in Clear) 6.4.3.3. VLAN Tag (Clear)
6.5. Decryption Framer/Deframer x
6.5.1. XPN Recovery 6.5.2. Replay Check Update 6.5.3. Packet Deframer
6.6. Packet Aggregator/Disaggregator x
6.6.1. Packet Aggregator 6.6.2. Packet Disaggregator
6.7. Cryptographic AES x
6.7.1. Register Address Ordering 6.7.2. Byte Order Swapping 6.7.3. Byte Ordering
6.8. Error Handling x
6.8.1. Packet Error Handling 6.8.2. Memory Blocks ECC Errors 6.8.3. Crypto Errors 6.8.4. System-Level Errors
1. Introduction
2. Interface Overview
3. Parameters
4. Designing with the IP Core
5. MACsec Intel® FPGA IP Example Design
6. Functional Description
7. Configuration Registers for MACsec IP
8. Document Revision History for the MACsec Intel FPGA IP User Guide

6.1.6. Port and Crypto Channel Mapping

The following table shows the mapping between the MACsec IP Common/Controlled, SA, and crypto channel number. Both encryption and decryption Common/Controlled ports should use a different TID to reference to a different SA entry. For example, traffic on encryption Common/Controlled port 0 can use TID = 0 and traffic on decryption Common/Controlled port 0 should use another TID = 1. as the Crypto QHIP cannot handle interleaving encryption/decryption within the same stream.

When both the MAX_CRYPTO_CH and MAX_CTRL_PORT parameters are configured to non-default values, the Crypto channels assigned to each port/stream follow the table below. For example, if MAX_CRYPTO_CH = 1024 and MAX_TX_TID = 32, Crypto channels assigned to Tx port/stream 0 (Tx TID = 0) are 0 – 7 and 256 – 263.
Table 36.  Mapping between MACsec Common/Controlled SA and Crypto Channel
Port (Identify through AXI-ST TID[5:0]) SA (for each $port (0 .. (MAX_CRYPTO_CH/16 -1))) Crypto Channel Number
Tx Port i (TID = $port mod MAX_TX_TID)

TX_LANE_SC0_SA0_*[$port]

 0 + ($port * 8)

TX_LANE_SC0_SA1_*[$port]

 1 + ($port * 8)

TX_LANE_SC0_SA2_*[$port]

 2 + ($port * 8)

TX_LANE_SC1_SA3_*[$port]

 3 + ($port * 8)

TX_LANE_SC1_SA0_*[$port]

 4 + ($port * 8)

TX_LANE_SC1_SA1_*[$port]

 5 + ($port * 8)

TX_LANE_SC1_SA2_*[$port]

 6 + ($port * 8)

TX_LANE_SC1_SA3_*[$port]

 7 + ($port * 8)
The table below shows the port/stream to Crypto channel assignment equation. For example, if MAX_CRYPTO_CH = 1024 and MAX_TX_TID = 32, Crypto channels assigned to Rx port/stream 0 (Rx TID = 0 after offset) are 512 – 527 and 768 – 774.
Table 37.  Crypto Channel Assignment Equation
Port (Identify through AXI-ST TID[5:0]), RX request TID is after offset which starts at 0 SA (for each $port (0 .. (MAX_CRYPTO_CH/16 -1))) Crypto Channel Number
Rx Port i (TID = $port mod (MAX_CTRL_PORT - MAX_TX_TID)

RX_LANE_SC0_SA0_*[$port ]

0

 0 + (MAX_CRYPTO_CH/2 + ($port * 8))
RX_LANE_SC0_SA1_*[$port ] 1 + (MAX_CRYPTO_CH/2 + ($port * 8))
RX_LANE_SC0_SA2_*[$port ] 2 + (MAX_CRYPTO_CH/2 + ($port * 8))
RX_LANE_SC0_SA3_*[$port ] 3 + (MAX_CRYPTO_CH/2 + ($port * 8))
RX_LANE_SC1_SA0_*[$port ] 4 + (MAX_CRYPTO_CH/2 + ($port * 8))
RX_LANE_SC1_SA1_*[$port ] 5 + (MAX_CRYPTO_CH/2 + ($port * 8))
RX_LANE_SC1_SA2_*[$port ] 6 + (MAX_CRYPTO_CH/2 + ($port * 8))
RX_LANE_SC1_SA3_*[$port ] 7 + (MAX_CRYPTO_CH/2 + ($port * 8))

The SADB is organized per port up to a maximum of 64 ports. Each port is assigned with 2 Tx SCs (4 Tx SAs) and 2 Rx SCs (4 Rx SAs) and the lookup on the port SCs/SAs is done using a stream ID (AXI-ST TID) of the request. Since the Tx and Rx ports cannot share the same stream ID, half of the SAs are wasted. For example, Tx port requests cannot lookup on Rx SAs and Rx port requests cannot lookup on Tx SAs.

To overcome this issue, an Rx port request stream ID is applied with an offset before the lookup is performed. The Rx port request stream ID always starts from 0 after applying the offset. The MAX_CRYPTO_CH specifying the maximum supported Crypto channel IDs by the MACsec IP is evenly distributed between the Tx and Rx ports. All Rx ports are further divided as MAX_CRYPTO_CH/2 channel IDs per Rx port. The Crypto channels assigned to each Tx port remains the same, which is 8.

Example 1:

Assuming 32 Tx port and 32 Rx port (MAX_TX_TID = 32, MAX_CTRL_PORT = 64, MAX_CRYPTO_CH = 1024).
  • Channel ID assigned to Tx Ports – 0 – 512
  • Channel ID assigned to Rx Ports – 512 - 1023
  • 32 Tx ports stream ID = 0 – 31
  • 32 Rx ports stream ID = 32 – 63

Before SA lookup, the 32 Rx port stream ID is deducted with MAX_TX_PORT (32). The final Rx port stream ID used for SA lookup is 0 – 31.

Table 38.  SADB
Port Stream ID SADB SC/SA Channel ID
Tx Port 0 TX_LANE_SC*_SA*_*[0] 0 – 7, 256 - 263
Rx Port 32 RX_LANE_SC*_SA*_*[0,32] 512 - 519, 768 – 774
Tx Port 1 TX_LANE_SC*_SA*_*[1] 8 – 15, 264 - 271
Rx Port 33 RX_LANE_SC*_SA*_*[1,33] 520 – 527, 775 - 783
  :    
Tx Port 31 TX_LANE_SC*_SA*_*[31] 248 – 255, 504 - 511
Rx Port 63 RX_LANE_SC*_SA*_*[31,63] 760 - 767, 1016 – 1023

Example 2:

Assuming 4 Tx ports and 2 Rx ports (MAX_TX_TID = 4, MAX_CTRL_PORT = 6, MAX_CRYPTO_CH = 64).
  • Channel ID assigned to Tx Ports – 0 – 31
  • Channel ID assigned to Rx Ports – 32 - 63
  • 4 Tx ports stream ID = 0 – 3
  • 2 Rx ports stream ID = 4 – 5

Before SA lookup, the 8 Rx port stream ID is deducted with MAX_TX_PORT (8). The final Rx port stream ID used for SA lookup is 0 – 7.

Table 39.  SADB
Port Stream ID SADB SC/SA Channel ID
Tx Port 0 TX_LANE_SC*_SA*_*[0] 0 – 7
Rx Port 4 RX_LANE_SC*_SA*_*[0,2] 32 – 39, 48 – 55
Tx Port 1 TX_LANE_SC*_SA*_*[1] 8 - 15
Rx Port 5 RX_LANE_SC*_SA*_*[1,3] 40 - 47, 56 – 63
Tx Port 2 TX_LANE_SC*_SA*_*[2] 16 – 23
Tx Port 3 TX_LANE_SC*_SA*_*[3] 24 - 31

Below are examples of a few possible configurations:

1 full duplex Ethernet port (port 0, Encrypt or Decrypt):
  • MAX_CTRL_PORT = 2, MAX_TX_TID = 1
  • Ethernet Port 0 Rx > Port Mux (TID = 0) > MACSEC IP > Port Demux (TID = 0) > Ethernet Port 0 Tx
2 full duplex Ethernet ports (port 0 - (Encrypt), port 1 - (Decrypt)):
  • MAX_CTRL_PORT = 2, MAX_TX_TID = 1
  • Ethernet Port 0 Rx > Port Mux (TID = 0) > MACSEC IP > Port Demux (TID = 0) > Ethernet Port 0 Tx
  • Ethernet Port 1 Rx > Port Mux (TID = 1) > MACSEC IP > Port Demux (TID = 1) > Ethernet Port 1 Tx
3 full duplex Ethernet ports (port 0,1 - (Encrypt), port 2 - (Decrypt)):
  • MAX_CTRL_PORT = 4, MAX_TX_TID = 2
  • Ethernet Port 0 Rx > Port Mux (TID = 0) > MACSEC IP > Port Demux (TID = 0) > Ethernet Port 0 Tx
  • Ethernet Port 1 Rx > Port Mux (TID = 1) > MACSEC IP > Port Demux (TID = 1) > Ethernet Port 1 Tx
  • Ethernet Port 2 Rx > Port Mux (TID = 2) > MACSEC IP > Port Demux (TID = 2) > Ethernet Port 2 Tx
4 full duplex Ethernet ports (port 0,1 - (Encrypt), port 2,3 - (Decrypt)):
  • MAX_CTRL_PORT = 4, MAX_TX_TID = 2
  • Ethernet Port 0 Rx > Port Mux (TID = 0) > MACSEC IP > Port Demux (TID = 0) > Ethernet Port 0 Tx
  • Ethernet Port 1 Rx > Port Mux (TID = 1) > MACSEC IP > Port Demux (TID = 1) > Ethernet Port 1 Tx
  • Ethernet Port 2 Rx > Port Mux (TID = 2) > MACSEC IP > Port Demux (TID = 2) > Ethernet Port 2 Tx
  • Ethernet Port 3 Rx > Port Mux (TID = 3) > MACSEC IP > Port Demux (TID = 3) > Ethernet Port 3 Tx
4 full duplex Ethernet ports (port 0,1,2 - (Encrypt), port 3 - (Decrypt)):
  • MAX_CTRL_PORT = 4, MAX_TX_TID = 3
  • Ethernet Port 0 Rx > Port Mux (TID = 0) > MACSEC IP > Port Demux (TID = 0) > Ethernet Port 0 Tx
  • Ethernet Port 1 Rx > Port Mux (TID = 1) > MACSEC IP > Port Demux (TID = 1) > Ethernet Port 1 Tx
  • Ethernet Port 2 Rx > Port Mux (TID = 2) > MACSEC IP > Port Demux (TID = 2) > Ethernet Port 2 Tx
  • Ethernet Port 3 Rx > Port Mux (TID = 3) > MACSEC IP > Port Demux (TID = 3) > Ethernet Port 3 Tx
4 simplex Ethernet ports (port 0,1,5,6 - (Encrypt), port 2,3,7,8 - (Decrypt)):
  • MAX_CTRL_PORT = 4, MAX_TX_TID = 2
  • Ethernet Port 0 Rx > Port Mux (TID = 0) > MACSEC IP > Port Demux (TID = 0) > Ethernet Port 5 Tx
  • Ethernet Port 1 Rx > Port Mux (TID = 1) > MACSEC IP > Port Demux (TID = 1) > Ethernet Port 6 Tx
  • Ethernet Port 2 Rx > Port Mux (TID = 2) > MACSEC IP > Port Demux (TID = 2) > Ethernet Port 7 Tx
  • Ethernet Port 3 Rx > Port Mux (TID = 3) > MACSEC IP > Port Demux (TID = 3) > Ethernet Port 8 Tx
Level Two Title