Production Specification

07/03/02

B roa dcom Co rpo rat ion

Document

5802-DS03-405-R

Se cti o n 4 : S o ftwa r e Pro g r a mm in g Mo de l

detailed descriptions of the on-chip registers.

•

Autonomous chip operation via an intelligent, descriptor-based DMA interface that minimizes the software processing

load.

•

Avoid packet or key setup data copying under any condition.

•

Supports input packet fragmentation (at an IP level as well as in terms of memory allocation for packet data). Input

fragments can be of any size (down to 1 byte), and can be aligned on any byte boundary.

•

Supports output packet fragmentation (at an IP level as well as in terms of memory allocation for packet data). Output

fragment size can be controlled in one of two configurable ways: 1) through a length field with each output data

descriptor, or 2) through a global output data buffer length field. This offers the flexibility of using a fixed output fragment

size, or of setting fragment size on a per-packet basis. Output fragments must be aligned on 32-bit word boundaries,

and must be multiples of a 32-bit word in size.

•

Permits flexibility with respect to the granularity of communication between the CPU and the chip. The CPU can instruct

the chip to process several packets or key setups via a single PCI write. This allows the host CPU to select the degree

of overlap between software and chip processing

large number of packets or key setups.

•

Permits different security processing to be applied to each and every packet or key setup, even though several packets

or key setups may be part of a common master command structure.

•

Flexible support for all IPsec formats, including ESP, AH and combinations with and without tunneling

•

Flexible support for IKE, SSL, and TLS protocols, including DH, RSA, and DSA algorithms

The host CPU queues up any number of packets or key setups in system memory, and passes a pointer to a master

command structure that identifies these packets or key setups to the chip. After the chip processes all the packets or key

setups as specified, it then returns status to the CPU via a done flag per packet, and if enabled, via an interrupt upon global

completion of all packets or all key setups within a master command structure.

A processing context structure is associated with each packet/key setup that allows various packets/key setups to be

processed differently even though they are all part of a common master command structure. In addition, data from each

packet can be fragmented on input (gather function) and on output (scatter function) in the IPsec crypto/authentication

operations.

While there are no data buffer alignment constraints (such as byte alignment only), there are specific constraints upon

command and context structure alignment as detailed under memory structures.