Smart SFP+—HW-Intelligence Inside an SFP+-Module

For years, the discussion has been ongoing to create smart SFP+-modules with Field-Programmable Gate Arrays (FPGAs) inside. The main bottleneck is the combination of a very tight power budget of maximum 1.5W and a very limited board-space to place an FPGA. PolarFire^® FPGAs allow this combination and provide serial communication of up to 12.7 Gbps in such an application.

Historically a reference example was provided by Microchip for customers to build their own modules; however, this still provides some burden on the manufacturing, e.g. having to create a mold for the housing. To provide easy access to FPGA-users, we have partnered with PRO DESIGN Electronic GmbH who have turn the example into a standard product, the prodesign MERLIN PolarFire FPGA SFP+ module.

Information about the SFP+-module is available here.

Hardware

The MERLIN SFP+ module comes pre-programmed with a minimal design. This allows the test and basic use of the module out of the box. The module also allows in-application programming via the data-lines of the module, providing flexibility for in-field updates as required. The PolarFire MPF200T FPGA used in the SFP+-module provides approximately 200,000 Logic Elements, of which only a small subset is required for the housekeeping inside the module.

With the high power-efficiency of PolarFire FPGAs, the power envelope of 1.5 W available for the SFP+ standard in power level II is sufficient, supporting typical applications inside of the FPGA. Nevertheless, for some more demanding applications with multiple communication endpoints inside the module, power level III may be required. For an initial estimation of the required power for a given design, we provide the Microchip Power Estimator, an Excel-based standalone tool, allowing up-front what-if power analysis.

Debugging and Programming

During development of the final application for the FPGA inside the SFP+-module updates to the fabric and debugging via JTAG are typical. To provide appropriate access to the FPGA the pins for JTAG are brought out via a flex-cable, allowing programming and debugging using our FlashPro debug adapters.

An example designs for in-application programming and reprogramming is provided in AN 4568 including the design-files. This design is a minimal design which sets up the transceiver-structures plus the required infrastructure for base-designs, update images and a golden image for fallback in case an in-field upgrade to the design should fail.

For ease of use, it is possible to get the SFP+-modules preprogrammed with your own individual design. This requires interaction and agreement with PRO DESIGN. With the preprogramming, one simplifies handling and avoids the time involved to program the modules individually.

Example Use Cases

Medical: Aurora to 10Gigabit Ethernet Converter

In the medical market, the open protocol Aurora is widely used as it offers little overhead and high bandwidth. This protocol is typically used between different parts of the medical equipment where FPGAs are used anyway. For the step into the PC-world, often in-house developed FPGA-based converter-boards are used. These have Aurora-interfaces, collecting the data and then converting it over into PCIe.

The alternative to your own converter-board just for transferring the data is the use of the SFP+-module for converting from Aurora to Gigabit Ethernet, or more likely 10 Gigabit Ethernet. With this constellation, a standard 10GBE network card with an SFP cage can be used, reducing design and manufacturing effort.

The protocol blocks required for interacting via Aurora and 10Gigabit Ethernet are IPs which are commercially available. A.L.S.E provides both IPs for integration into PolarFire FPGAs. For Aurora, both the 8B10B-version and the 64B66B-version for higher data-rates are available; 10Gigabit Ethernet is run using the 10GEDEK-IP, implementing a processor-less Ethernet endpoint.

Data Diode, Smart Data-Filtering in Hardware

Several use-cases for a smart SFP+ module likely come to your mind; one security application shall be explicitly mentioned and described.

High-security networks may need to be connected to networks with a lower security classification. This obviously poses the risk of data leaking out or attack-vectors being brought in. Often some software firewall is supposed to take care of this separation; however, software has been shown as a weak spot. A significantly stronger protection is on hardware level, hardware policing or filtering what is allowed to pass and what needs to be dropped.

Missing Link Electronics (MLE) provides an FPGA-based PCIe network protocol accelerator card which implements this hardware functionality, coined as “Smart Data Diode.” With the addition of these PCIe-cards, servers can be enabled for hardware protection. Retrofitting or enabling of individual physical server-ports is possible by using the MERLIN SFP+-module programmed with special IP from MLE.

Typically, performing TCP/IP communication requires a processor, taking care of the software stack. MLE provides a network protocol acceleration platform (NPAP), which performs the TCP/IP handling in FPGA-hardware. This yields a TCP/IP stack on a significantly smaller power footprint.

As the NPAP allows the termination of ethernet-data, the raw data is accessible inside the FPGA. Based on the system requirements, data can be controlled and selective elimination is possible.

One can allow data transfer into one direction and only acknowledges, negotiation-data and ping-responses into the other direction.

Why is this important and what is the benefit over a software firewall? A software firewall works based on configuration which should only be accessible by an administrator. But software can be hacked, or an administrator may have misconfigured something by accident or deliberately. This can lead to the firewall effectively having holes and not protecting the network.

Changing hardware modules is a significantly more difficult task. This involves physical access to the servers and the conscious removal of a hardware module. In high security environments this is more difficult than getting access to software configurations.

In addition, depending on the final requirement, the filtering and policing behaviour of the SFP+-module can be stored inside of the FPGA on non-volatile memory. This configuration data can either be alterable at run-time or not.

Power Consumption FPGA

As FPGA designs very strongly depend on the designs programmed into them, two of the mentioned use-cases were evaluated from a power consumption perspective. The tool used for this is the Microchip Power Estimator, which allows an early estimation of consumption and self-heating, without having to directly implement a design onto the hardware.

Aurora 64B66B to 10 Gigabit Ethernet

Resource estimations from ALSE were used to estimate the design for an optical Aurora-link with 64B66B encoding, running at 10 Gigabit Ethernet speed together with the resources required for a 10GEDEK-design. In total, that requires approximately 10% of the logic, 9% of the flipflops, 6% of LSRAMs available and two independent transceivers in the PolarFire MPF200T device. For an early estimation, a clock-rate of 150 MHz inside the FPGA was chosen together with a toggle-rate of 12.5%.

With a temperature sweep of the ambient temperature and a thermal resistance of 13°C/Watt for the tight enclosure, the following approximate power consumption is reported:

At an ambient temperature of 50°C, a worst-case device is expected to consume around 600 mW, the laser interface is estimated at 500mW and the efficiency of the power supply unit is approximately 85%. With these numbers, for the given design the MERLIN module requires around 1300 mW and needs to be set to power level II in the inserted system.

Data Diode

Resource estimations from Missing Link Electronics were used to estimate the power consumption for a data-diode operating in a 10 Gigabit Ethernet configuration. For this the two NPAP-interfaces, including two 10 Gigabit Ethernet MACs are considered, with a configuration to serve three TCP-sockets. This yields an approximate logic utilization of 74% logic, 42% flipflops, 51% LSRAMs and 18% µSRAM together with two independent transceivers. For the early estimation a similar clock-rate of 150 MHz inside the FPGA was chosen again together with a toggle-rate of 12.5%.

With a temperature sweep of the ambient temperature and a thermal resistance of 13°C/Watt for the tight enclosure, the following approximate power consumption is reported:

At an ambient temperature of 50°C, a worst-case device is expected to consume around 1.3 W, the laser interface is estimated at 500mW and the efficiency of the power supply unit is approximately 85%. With these numbers, for the given design the MERLIN module needs to be set to power level III in the inserted system.

Partner Contact Details

Visit PRO DESIGN Electronic GmbH and explore the prodesign MERLIN PolarFire FPGA SFP+ module.

Go to the A.L.S.E site.

Also check out the Missing Link Electronics GmbH site.

Summary

The prodesign MERLIN PolarFire FPGA SFP+ module and its possible use-cases enable a strong simplification in a wide range of applications for both pre-configured and your specific needs. Reach out to either Microchip or the partners mentioned for deeper discussions on how to exactly match your needs.