Hard Processor System Technical Reference Manual: Agilex™ 5 SoCs

ID 814346
Date 4/01/2024
Public
Document Table of Contents

5.1.6.6.4. Layer 3 and Layer 4 Match Filtering

The EMAC supports layer 3 and layer 4 based packet filtering. The layer 3 filtering refers to the IP source or destination address filtering in the IPv4 or IPv6 packets whereas layer 4 filtering refers to the source or destination port number filtering in TCP or UDP.

The layer 3 and layer 4 packet filtering feature automatically enables the IPC full checksum offload engine on the receive side. For layer 3 or layer 4 filtering operation, you must set the IPC bit of the MAC_Rx_Configuration register to enable the RX checksum offload engine.

When layer 3 and layer 4 filtering is enabled, the packets are filtered in the following way:
  • Matched packets: The MAC forwards the packets that match all enabled fields to the application along with the status. The MAC gives the matched field status only if the IPC bit of the MAC_Rx_Configuration register is set and one of the following conditions is true:
    • All enabled layer 3 and layer 4 fields match
    • At least one of the enabled field matches and other fields are bypassed or disabled
  • Unmatched Packets: The MAC drops the packets that do not match any of the enabled fields. You can use the inverse match feature to block or drop a packet with specific TCP or UDP over IP fields and forward all other packets.
  • Non-TCP or UDP IP packets: By default, all non-TCP or UDP IP packets are bypassed from the layer 3 and layer 4 filters. You can optionally program the MAC to drop all non-TCP or UDP over IP packets.
When multiple layer 3 and layer 4 filters are enabled, any filter match is considered as a match. If more than one filter matches, the MAC provides the status of the lowest filter where filter 0 is the lowest filter and filter 7 is the highest filter. For example, if filter 0 and filter 1 match, the MAC gives the status corresponding to filter 0.
Note: The source or destination address and VLAN tag filters (if enabled) have precedence over layer 3 and layer 4 filters. This means that a packet that fails the source or destination address or VLAN tag filter is dropped irrespective of the layer 3 and layer 4 filter results.

Layer 3 and Layer 4 Filters Register Set

The MAC implements a set of indirect registers for layer 3 and layer 4 based packet filtering. The indirect register set contains a control register namely, MAC_L3_L4_Control0, to control the packet filtering. In addition, there are five address registers to program the layer 3 and layer 4 fields to be matched, such as:
  • MAC_Layer4_Address0
  • MAC_Layer3_Addr0_Reg0
  • MAC_Layer3_Addr1_Reg0
  • MAC_Layer3_Addr2_Reg0
  • MAC_Layer3_Addr3_Reg0

The MAC is configured to have 16 such independent set of registers.

Layer 3 Filtering

The EMAC supports perfect matching or inverse matching for IP source address and destination address. In addition, you can match the complete IP address or mask the lower bits matching, that is, compare all bits of the address except the specified lower mask bits.

For IPv6 packets filtering, you can use the MAC_Layer3_Addr[0:3]_Reg(#i) to provide the 128-bit IP source address or IP destination address. The IP source address or destination address must be programmed in the order defined by the IPv6 specification, that is, the first byte of the IP source address or destination address in the received packet is in the higher byte of the register and the subsequent registers follow the same order.

For IPv4 packet filtering, you can use the MAC_Layer3_Addr0_Reg#(i) and MAC_Layer3_Addr1_Reg#(i) registers to provide the 32-bit IP source address and IP destination address, respectively. The remaining two registers are reserved. The IP source address or destination address must be programmed in the order defined by the IPv4 specification, that is, the first byte of IP source address and destination address in the received packet in the higher byte of the respective register.

Layer 4 Filtering

The EMAC supports perfect matching or inverse matching for TCP or UDP source and destination port numbers. However, you can program only one type (TCP or UDP) at a time. The MAC_Layer4_address(#i) register contains the 16-bit source and destination port numbers of TCP or UDP, that is, the lower 16 bits for source port number and higher 16 bits for destination port number. The TCP or UDP source and destination port numbers must be programmed in the order defined in the TCP or UDP specification, that is, the first byte of TCP or UDP source and destination port number in the received packet is in the higher byte of the register.