Synchronizing an encrypted data stream across chip-to-chip ground referenced signaling interconnect

1 . A device comprising:

memory to store a session key;

a transmitter (TX) physical layer to transmit frames to a second device over a link; and

TX datalink logic coupled to the TX physical layer and the memory, wherein, to coordinate synchronized encryption over the link with the second device, the TX datalink logic is to:

cause a key synchronization frame to be transmitted to the second device before the synchronized encryption, wherein the key synchronization frame comprises a frame count value; and

in response to receipt of a key synchronization acknowledgement frame from the second device acknowledging receipt of the key synchronization frame, start encrypting frame data with the session key after transmitting a number of frames corresponding to the frame count value.

2 . The device of claim 1 , wherein the key synchronization acknowledgement also includes an acknowledgement of availability, to the second device, of the session key.

3 . The device of claim 1 , further comprising receiver (RX) datalink logic coupled to the TX datalink logic, the RX datalink logic to:

decode the key synchronization acknowledgement frame;

perform a checksum operation of the key synchronization acknowledgement frame; and

provide the decoded key synchronization acknowledgement frame to the TX datalink logic in response to successful completion of the checksum operation.

4 . The device of claim 1 , wherein the TX datalink logic is further to:

confirm availability of the session key in the memory;

track a plurality of frames that are transmitted according to the frame count value; and

start encrypting the frame data at a flit of a frame that is transmitted after transmitting a final frame of the plurality of frames.

5 . The device of claim 1 , wherein the TX datalink logic is further to:

cause client data frames to be blocked and no operation (NOP) frames to instead be transmitted over the link until encryption of the frame data is started; and

switch from a plaintext pipeline to an encryption pipeline that employs the session key to encrypt the frame data.

6 . The device of claim 1 , wherein the TX datalink logic is further to:

track a timeout period for receipt of the key synchronization acknowledgement frame; and

in response to failing to receive the key synchronization acknowledgement frame within the timeout period, cause retransmission of the key synchronization frame to the second device.

7 . The device of claim 6 , wherein the timeout period is associated with roundtrip latency of the key synchronization frame and the key synchronization acknowledgement frame, and wherein the frame count value is multiple times greater than the timeout period measured in clock cycles.

8 . The device of claim 1 , further comprising a firmware interface coupled between a processing device and the TX datalink logic and through which to receive the session key, wherein the TX datalink logic is to store the session key in the memory.

9 . A device comprising:

memory to store a session key;

a receiver (RX) physical layer to receive frames from a second device over a link, wherein the frames comprise a key synchronization frame followed by encrypted frames; and

RX datalink logic coupled to the RX physical layer and the memory, wherein, to coordinate synchronized encryption over the link with a second device, the RX datalink logic is to:

decode the key synchronization frame received from the RX physical layer;

retrieve a frame count value from the key synchronization frame;

retrieve the session key from the memory in response to the key synchronization frame passing a checksum operation; and

start decrypting frame data retrieved from the encrypted frames with the session key after receiving a number of frames corresponding to the frame count value.

10 . The device of claim 9 , wherein the RX datalink logic is further to:

perform the checksum operation of the decoded key synchronization frame;

determine whether the session key is available in the memory; and

in response to a successful completion of the checksum operation and availability of the session key, generate a key synchronization acknowledgment frame.

11 . The device of claim 10 , further comprising TX datalink logic coupled between the RX datalink logic and the link, the TX datalink logic to cause the key synchronization acknowledgement frame to be transmitted over the link to the second device.

12 . The device of claim 10 , wherein the key synchronization acknowledgement frame comprises an acknowledgement of receipt of the key synchronization frame and availability, to the second device, of the session key.

13 . The device of claim 9 , wherein the RX datalink logic is further to:

track a plurality of frames that are received according to the frame count value; and

start decrypting the frame data, using an encryption pipeline, at a flit of a frame that is received after receiving a final frame of the plurality of frames.

14 . The device of claim 9 , further comprising a firmware interface coupled between a processing device and the RX datalink logic and through which to receive the session key, wherein the RX datalink logic is to store the session key in the memory.

15 . A method of operating a chip-to-chip interconnect to coordinate synchronized encryption over a link coupled between a first device, which is coupled to a first chip, and a second device, which is coupled to a second chip, wherein the method comprises:

causing, by first datalink logic of the first device, a key synchronization frame to be transmitted to the second device before the synchronized encryption, wherein the key synchronization frame comprises a frame count value; and

in response to receiving a key synchronization acknowledgement frame from the second device acknowledging receipt of the key synchronization frame:

determining, by the first datalink logic, when a plurality of frames corresponding to the frame count value have been transmitted; and

starting to encrypt, by the first datalink logic, frame data with a session key based on the determining.

16 . The method of claim 15 , further comprising:

confirming, by first datalink logic of the first device, availability of the session key;

tracking, by the first datalink logic, transmission of the plurality of frames according to the frame count value; and

starting to encrypt frame data, by the first datalink logic, at a flit of a frame that is transmitted after transmitting a final frame of the plurality of frames.

17 . The method of claim 15 , further comprising:

causing, by the first datalink logic, client data frames to be blocked and no operation (NOP) frames to instead be transmitted over the link until encryption of the frame data is started; and

switching, by the first datalink logic, from a plaintext pipeline to an encryption pipeline that employs the session key to encrypt the frame data.

18 . The method of claim 15 , further comprising:

tracking, by the first datalink logic, a timeout period for receipt of the key synchronization acknowledgement; and

in response to failing to receive the key synchronization acknowledgement within the timeout period, causing, by the first datalink logic, retransmission of the key synchronization frame to the second device.

19 . The method of claim 18 , wherein the timeout period is associated with roundtrip latency of the key synchronization frame and the key synchronization acknowledgement, and wherein the frame count value is multiple times greater than the timeout period measured in clock cycles.

20 . The method of claim 15 , wherein the key synchronization acknowledgement comprises an acknowledgement of receipt, by the second device, of the key synchronization frame and availability, to the second device, of the session key.

21 . The method of claim 15 , further comprising:

detecting, by the first chip, a powerup of the chip-to-chip interconnect; and

programming, by a first processing device of the first chip, the session key to first memory accessible by the first datalink logic.

22 . The method of claim 15 , further comprising:

decoding, by second datalink logic of the second device, the key synchronization frame received over the link;

retrieving the frame count value from the decoded key synchronization frame; and

starting to decrypt, by the second datalink logic, the frame data with the session key after receiving a number of frames corresponding to the frame count value.

23 . The method of claim 22 , further comprising:

performing, by the second datalink logic, a checksum operation of the decoded key synchronization frame;

determine whether the session key is available;

generating the key synchronization acknowledgment frame in response to a successful completion of the checksum operation and availability of the session key; and

causing, by the second datalink logic, the key synchronization acknowledgement to be transmitted over the link to the second device.

24 . The method of claim 22 , further comprising:

tracking, by the second datalink logic, a plurality of frames that are received according to the frame count value; and

starting to decrypt frame data, by the second datalink logic using an encryption pipeline, at a flit of a frame that is received after receiving a final frame of the plurality of frames.

25 . The method of claim 22 , further comprising:

detecting, by the second chip, a powerup of the chip-to-chip interconnect; and

programming, by a second processing device of the second chip, the session key to second memory accessible by the second datalink logic.