MACsec Intel® FPGA IP User Guide

Download PDF
ID 736108
Date 4/03/2023
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents
Document Table of Contents x
1. Introduction 2. Interface Overview 3. Parameters 4. Designing with the IP Core 5. MACsec Intel® FPGA IP Example Design 6. Functional Description 7. Configuration Registers for MACsec IP 8. MACsec Intel FPGA IP User Guide Archives 9. Document Revision History for the MACsec Intel FPGA IP User Guide
1. Introduction x
1.1. Terminology 1.2. IP Core Overview 1.3. Release Information 1.4. Device Family Support 1.5. Device Speed Grade Support and Theoretical Throughput 1.6. Resource Utilization
1.2. IP Core Overview x
1.2.1. IP Description 1.2.2. IP Core Applications
1.2.2. IP Core Applications x
1.2.2.1. SmartNIC 1.2.2.2. Ethernet Bridge + Inline MACsec
2. Interface Overview x
2.1. Block Diagram 2.2. Interfaces 2.3. Clocking Domains
2.2. Interfaces x
2.2.1. IP Interface Signals 2.2.2. IP Interface Signal Timing Diagram/Waveforms 2.2.3. Clocks, Resets, and Interrupts
2.2.1. IP Interface Signals x
2.2.1.1. Common Port Mux Interface 2.2.1.2. Common Port Demux Interface 2.2.1.3. Controlled Port Mux Interface 2.2.1.4. Controlled Port Demux Interface 2.2.1.5. Uncontrolled Port RX Interface 2.2.1.6. Uncontrolled Port TX Interface 2.2.1.7. Crypto RX Interface 2.2.1.8. Crypto TX Interface 2.2.1.9. Management Interface 2.2.1.10. Decrypt Port Mux Management Interface 2.2.1.11. Decrypt Port Demux Management Interface 2.2.1.12. Encrypt Port Mux Management Interface 2.2.1.13. Encrypt Port Demux Management Interface 2.2.1.14. Crypto IP Management Bus 2.2.1.15. Miscellaneous Control Signals
2.2.2. IP Interface Signal Timing Diagram/Waveforms x
2.2.2.1. Common Port Mux Interface Waveform 2.2.2.2. Common Port Demux Interface Waveform 2.2.2.3. Controlled Port Mux Interface Waveform 2.2.2.4. Controlled Port Demux Interface Waveform 2.2.2.5. Uncontrolled Port RX Interface Waveform 2.2.2.6. Uncontrolled Port TX Interface Waveform 2.2.2.7. Crypto RX Waveform 2.2.2.8. Crypto TX Waveform 2.2.2.9. MACsec Management Interface (Read) 2.2.2.10. MACsec Management Interface (Write)
3. Parameters x
3.1. MACsec Intel FPGA IP Parameter Settings
4. Designing with the IP Core x
4.1. Installing and Licensing Intel® FPGA IP Cores 4.2. Specifying the IP Core Parameters and Options 4.3. Generated File Structure 4.4. Reset Transactions 4.5. MACsec Software Initialization Sequence 4.6. Switching Port Muxes between Store and Forward and Cut-Through Modes
4.1. Installing and Licensing Intel® FPGA IP Cores x
4.1.1. Intel® FPGA IP Evaluation Mode
5. MACsec Intel® FPGA IP Example Design x
5.1. Simulation Requirements 5.2. Steps to Run Simulation 5.3. Port Configurations 5.4. Multi Interface Buffering Muxing/Demuxing 5.5. 2x25 GbE (Encryption + Decryption) 5.6. Packet Generator/Checker 5.7. Clocking
6. Functional Description x
6.1. AXI-ST Common/Controlled/Uncontrolled Ports 6.2. Packet Parser and Classifier 6.3. SA Lookup and Update 6.4. Encryption Framer/DeFramer 6.5. Decryption Framer/Deframer 6.6. Packet Aggregator/Disaggregator 6.7. Cryptographic AES 6.8. Error Handling 6.9. Packet Statistics
6.1. AXI-ST Common/Controlled/Uncontrolled Ports x
6.1.1. AXI-ST Single Packet Mode 6.1.2. AXI-ST Multi Packet Mode 6.1.3. User Interface Data Streaming 6.1.4. AXI-ST Ready Latency 6.1.5. Port and Secure Channel Mapping 6.1.6. Port and Crypto Channel Mapping 6.1.7. Minimum Packet Size 6.1.8. Byte Ordering 6.1.9. Controlled/Uncontrolled Port Muxing
6.1.3. User Interface Data Streaming x
6.1.3.1. Single Packet Mode Data Stream 6.1.3.2. Multi Packet Mode Data Stream
6.2. Packet Parser and Classifier x
6.2.1. Packet Parser 6.2.2. Packet Classifier
6.3. SA Lookup and Update x
6.3.1. Packet Actions 6.3.2. Packet Buffer 6.3.3. New Channel Assignment 6.3.4. Anti-Replay Protection
6.3.1. Packet Actions x
6.3.1.1. Packet Encrypt 6.3.1.2. Packet Decrypt 6.3.1.3. Packet Discard 6.3.1.4. PDU Validation
6.4. Encryption Framer/DeFramer x
6.4.1. Channel Allocation 6.4.2. Packet Framer 6.4.3. VLAN Tagging
6.4.2. Packet Framer x
6.4.2.1. Bypass Packet 6.4.2.2. Stream Interleaving
6.4.3. VLAN Tagging x
6.4.3.1. No VLAN Tag 6.4.3.2. VLAN Tag (Not in Clear) 6.4.3.3. VLAN Tag (Clear)
6.5. Decryption Framer/Deframer x
6.5.1. XPN Recovery 6.5.2. Replay Check Update 6.5.3. Packet Deframer
6.6. Packet Aggregator/Disaggregator x
6.6.1. Packet Aggregator 6.6.2. Packet Disaggregator
6.7. Cryptographic AES x
6.7.1. Register Address Ordering 6.7.2. Byte Order Swapping 6.7.3. Byte Ordering
6.8. Error Handling x
6.8.1. Packet Error Handling 6.8.2. Memory Blocks ECC Errors 6.8.3. Crypto Errors 6.8.4. System-Level Errors
1. Introduction
2. Interface Overview
3. Parameters
4. Designing with the IP Core
5. MACsec Intel® FPGA IP Example Design
6. Functional Description
7. Configuration Registers for MACsec IP
8. MACsec Intel FPGA IP User Guide Archives
9. Document Revision History for the MACsec Intel FPGA IP User Guide

6.1. AXI-ST Common/Controlled/Uncontrolled Ports

The MACsec IP user interface supports 6 AXI-ST ports (transmit lane Common/Controlled/Uncontrolled/ ports and receive lane Common/Controlled/Uncontrolled/ ports). The maximum bandwidth supported by the MACsec IP is 200Gbps and therefore the aggregated bandwidth of all ports must not exceed 200Gbps. In the scenario where the desired bandwidth exceeds the port bandwidth, backpressure occurs to avoid buffer overflow.

All port data widths are configurable between 64, 128, 256, and 512 bits. The maximum bandwidth supported is 200Gbps when the width of the interface between the port mux and demux blocks and the MACsec processing blocks is 512 bits.

The AXI-ST ports support both AXI-ST Single Packet Mode and AXI-ST Multi Packet Mode. There are 2 lanes which exist within the MACsec IP, one is the Transmit Tx Lane and the other is the Receive Rx Lane.

The AXI-ST Common/Controlled/Uncontrolled ports support 16 bits of metadata which tag along with incoming packets. These 16 bits of metadata are sent through the AXI-ST TUSER interface which is available when the METADATA_EN parameter is configured to ENABLE. This feature is mainly used in PTP where PTP packets are sent through the MACsec IP together with PTP sideband signals and local counter values to support PTP 1- step and 2-step modes.

The AXI-ST TID is used to indicate the Port/Stream ID and this ID tags along with the packet flowing through the MACsec encryption/decryption lane. You can use the TID to identify the source of the packet and route the packet to its destination accordingly. The packet order per stream is maintained.

Traffic that requires encryption or decryption is sent through the MACsec Controlled port. In the case of traffic that doesn’t need to be encrypted or decrypted, it can be submitted through the Uncontrolled port. Traffic from both ports is merged and sent to the Common port on the transmit lane.

On the transmit lane, the Uncontrolled port traffic is muxed together with Controlled port traffic at the Common port before sending it out from the MACsec IP. The arbitration between the Uncontrolled port and Controlled port is based on a programmable priority round robin scheme where priority can be given to Controlled port traffic or Uncontrolled port traffic per your selection. When no traffic is detected on one of the ports, traffic from another port is granted by default. There is a potential performance impact on the transmit lane as the IP is muxing 200Gbps traffic from Controlled/Uncontrolled ports into a single Common port. It is your responsibility to make sure the total bandwidth of both Controlled/Uncontrolled port doesn’t exceed the maximum bandwidth supported by the MACsec IP, which is 200Gbps. You need to handle the flow control on the MACsec IP Controlled/Uncontrolled ports so that no overflows (packet drops) happen on the Mux/Demux interfaces due to unmatched bandwidth.

On the receive lane, when the Common port traffic is parsed and no MACsec Ethertype is detected, the traffic is routed to the Uncontrolled port. The Uncontrolled port sees all traffic including encrypted packets and non-MACsec packets. You are then required to process the traffic and extract the packets. By default, the Uncontrolled ports on transmit and receive lanes are disabled.


Section Content
AXI-ST Single Packet Mode
AXI-ST Multi Packet Mode
User Interface Data Streaming
AXI-ST Ready Latency
Port and Secure Channel Mapping
Port and Crypto Channel Mapping
Minimum Packet Size
Byte Ordering
Controlled/Uncontrolled Port Muxing

Level Two Title