MACsec Intel® FPGA IP User Guide

Download PDF
ID 736108
Date 10/02/2023
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents
Document Table of Contents x
1. Introduction 2. Interface Overview 3. Parameters 4. Designing with the IP Core 5. Functional Description 6. Configuration Registers for MACsec IP 7. MACsec Intel® FPGA IP Example Design 8. MACsec Intel FPGA IP User Guide Archives 9. Document Revision History for the MACsec Intel FPGA IP User Guide
1. Introduction x
1.1. Terminology 1.2. IP Core Overview 1.3. Release Information 1.4. Device Family Support 1.5. Device Speed Grade Support and Theoretical Throughput 1.6. Resource Utilization
1.2. IP Core Overview x
1.2.1. IP Description 1.2.2. IP Core Applications
1.2.2. IP Core Applications x
1.2.2.1. SmartNIC 1.2.2.2. Ethernet Bridge + Inline MACsec
2. Interface Overview x
2.1. Block Diagram 2.2. Interfaces 2.3. Clocking Domains
2.2. Interfaces x
2.2.1. IP Interface Signals 2.2.2. IP Interface Signal Timing Diagram/Waveforms 2.2.3. Clocks, Resets, and Interrupts
2.2.1. IP Interface Signals x
2.2.1.1. Common Port Mux Interface 2.2.1.2. Common Port Demux Interface 2.2.1.3. Controlled Port Mux Interface 2.2.1.4. Controlled Port Demux Interface 2.2.1.5. Uncontrolled Port RX Interface 2.2.1.6. Uncontrolled Port TX Interface 2.2.1.7. Management Interface 2.2.1.8. Decrypt Port Mux Management Interface 2.2.1.9. Decrypt Port Demux Management Interface 2.2.1.10. Encrypt Port Mux Management Interface 2.2.1.11. Encrypt Port Demux Management Interface 2.2.1.12. Crypto IP Management Bus 2.2.1.13. Miscellaneous Control Signals
2.2.2. IP Interface Signal Timing Diagram/Waveforms x
2.2.2.1. Common Port Mux Interface Waveform 2.2.2.2. Common Port Demux Interface Waveform 2.2.2.3. Controlled Port Mux Interface Waveform 2.2.2.4. Controlled Port Demux Interface Waveform 2.2.2.5. Uncontrolled Port RX Interface Waveform 2.2.2.6. Uncontrolled Port TX Interface Waveform 2.2.2.7. Crypto RX Waveform 2.2.2.8. Crypto TX Waveform 2.2.2.9. MACsec Management Interface (Read) 2.2.2.10. MACsec Management Interface (Write)
3. Parameters x
3.1. MACsec Intel FPGA IP Parameter Settings
4. Designing with the IP Core x
4.1. Installing and Licensing Intel® FPGA IP Cores 4.2. Specifying the IP Core Parameters and Options 4.3. Generated File Structure 4.4. Reset Transactions 4.5. MACsec Software Initialization Sequence
4.1. Installing and Licensing Intel® FPGA IP Cores x
4.1.1. Intel® FPGA IP Evaluation Mode
5. Functional Description x
5.1. AXI-ST Common/Controlled/Uncontrolled Ports 5.2. Packet Parser and Classifier 5.3. SA Lookup and Update 5.4. Encryption Framer/DeFramer 5.5. Decryption Framer/Deframer 5.6. Packet Aggregator/Disaggregator 5.7. Cryptographic AES 5.8. Error Handling 5.9. Packet Statistics
5.1. AXI-ST Common/Controlled/Uncontrolled Ports x
5.1.1. AXI-ST Single Packet Mode 5.1.2. AXI-ST Multi Packet Mode 5.1.3. User Interface Data Streaming 5.1.4. AXI-ST Ready Latency 5.1.5. Port and Secure Channel Mapping 5.1.6. Port and Crypto Channel Mapping 5.1.7. Minimum Packet Size 5.1.8. Byte Ordering 5.1.9. Controlled/Uncontrolled Port Muxing
5.1.3. User Interface Data Streaming x
5.1.3.1. Single Packet Mode Data Stream 5.1.3.2. Multi Packet Mode Data Stream
5.2. Packet Parser and Classifier x
5.2.1. Packet Parser 5.2.2. Packet Classifier
5.3. SA Lookup and Update x
5.3.1. Packet Actions 5.3.2. Packet Buffer 5.3.3. New Channel Assignment 5.3.4. Anti-Replay Protection
5.3.1. Packet Actions x
5.3.1.1. Packet Encrypt 5.3.1.2. Packet Decrypt 5.3.1.3. Packet Discard 5.3.1.4. PDU Validation
5.4. Encryption Framer/DeFramer x
5.4.1. Channel Allocation 5.4.2. Packet Framer 5.4.3. VLAN Tagging
5.4.2. Packet Framer x
5.4.2.1. Bypass Packet 5.4.2.2. Stream Interleaving
5.4.3. VLAN Tagging x
5.4.3.1. No VLAN Tag 5.4.3.2. VLAN Tag (Not in Clear) 5.4.3.3. VLAN Tag (Clear)
5.5. Decryption Framer/Deframer x
5.5.1. XPN Recovery 5.5.2. Replay Check Update 5.5.3. Packet Deframer
5.6. Packet Aggregator/Disaggregator x
5.6.1. Packet Aggregator 5.6.2. Packet Disaggregator
5.7. Cryptographic AES x
5.7.1. Register Address Ordering 5.7.2. Byte Order Swapping 5.7.3. Byte Ordering
5.8. Error Handling x
5.8.1. Packet Error Handling 5.8.2. Memory Blocks ECC Errors 5.8.3. Crypto Errors 5.8.4. System-Level Errors
7. MACsec Intel® FPGA IP Example Design x
7.1. Simulation Requirements 7.2. Steps to Run Simulation 7.3. Port Configurations 7.4. Multi Interface Buffering Muxing/Demuxing 7.5. 2x25 GbE (Encryption + Decryption) 7.6. Packet Generator/Checker 7.7. Clocking
1. Introduction
2. Interface Overview
3. Parameters
4. Designing with the IP Core
5. Functional Description
6. Configuration Registers for MACsec IP
7. MACsec Intel® FPGA IP Example Design
8. MACsec Intel FPGA IP User Guide Archives
9. Document Revision History for the MACsec Intel FPGA IP User Guide

2.2.1.1. Common Port Mux Interface

Table 7.  Common Port Mux InterfaceThe variable <n> in this table refers to the specific port number being referenced.
Signal Name Width Direction Description
decrypt_user_ss_p<n>_app_pp_axi_st_aclk 1 Input Clock for AXI-ST Interface
decrypt_user_ss_p<n>_app_pp_axi_st_areset_n 1 Input Reset for AXI-ST Interface
decrypt_user_ss_p<n>_app_pp_tvalid 1 Input

TVALID indicates that the master is driving a valid transfer.

A transfer takes place when both TVALID and TREADY are asserted.

decrypt_user_ss_p<n>_app_pp_tdata

64

128

256

512

 Input

TDATA is the primary payload that is used to provide the data that is passing across the interface.

decrypt_user_ss_p<n>_app_pp_tkeep

8

16

32

64

 Input

TKEEP is the byte qualifier that indicates whether the content of the associated byte of TDATA is processed as part of the data stream.

decrypt_user_ss_p<n>_app_pp_tlast 1 Input TLAST indicates the boundary of a packet.
decrypt_user_ss_p<n>_app_pp_tid 6 Input

TID is the data stream identifier that indicates different stream of data. This can be used as a Channel ID for different streams sharing the same port.

decrypt_user_ss_p<n>_pp_app_tready 1 Output TREADY indicates that the slave can accept a transfer on the current cycle.
decrypt_user_ss_p<n>_app_pp_tuser_last_segment <segment_number> 1 Input

Port<n> packet segmentation boundary indication for higher bandwidth transfer.

*last_segment indicates which 64-bit segment of the data bus the last segment is aligned to.

segment_number ranges from 0 to 7.

For the following data widths, the corresponding segment number bit applies:
  • 64—NA
  • 128—last_segment[1:0]
  • 256—last_segment[3:0]
  • 512—last_segment[7:0]
decrypt_user_ss_p<n>_app_pp_rx_tuser_client 7 Input

Ethernet Packet error status:

  • [6] - PHY error
  • [5] - CRC error
  • [4] - Length error => Payload that arrives longer than advertised length
  • [3] - Oversize error
  • [2] - Undersized (frame shorter than 64B) or oversized (larger than max_frame)
  • [1] - FCS error
  • [0] - Malformed
decrypt_user_ss_p<n>_app_pp_tx_tuser_client 7 Input

Ethernet Packet error status:

  • [6] - PHY error
  • [5] - CRC error
  • [4] - Length error => Payload that arrives longer than advertised length
  • [3] - Oversize error
  • [2] - Undersized (frame shorter than 64B) or oversized (larger than max_frame)

  • [1] - FCS error

  • [0] - Malformed
decrypt_user_ss_p<n>_app_pp_tuser_usermetadata 16 Input

User metadata which is tag along with incoming/outgoing packet into the MACsec IP. This metadata is not processed by MACsec IP and it is passed through the IP. One of the use cases supports PTP use case where a local timestamp or timer can be sent through this metadata on the MACsec ingress. The user can compare this local timestamp or timer at MACsec egress to determine the time taken for the request to go through the MACsec IP pipeline.

decrypt_user_ss_p<n>_pp_app_tuser_ppmetadata 415 Output

Packet Processing metadata which is tag along with incoming/outgoing packet into the MACsec IP to indicate:

[414:188] - Reserved

[187:173] - Pkt_len (packet length valid with AXI-ST first data phase signal.)

[172:3] - Reserved

[1] - tlast_buf_pkt_truncation (packet truncation error pulse valid with AXI-ST tlast signal.)

[2] - tlast_uerr_fatal (uncorrectable fatal error which causes the packet to drop in port demux. It can be present anytime during a valid with AXI ST packet.)

[0] - tlast_empty (indicates the Multi Interface Buffering Port for Stream TID is empty and no incoming packet detected when this indication is asserted. Used in MACsec framer to flush the buffer without waiting for next packet for data packing. Valid with AXI-ST tlast signal.)

Level Two Title