PCIe Chapter 32: IDE Protection, Streams, and Key Lifecycles

Locate the two protected ports

Figure 6-48 identifies each Stream's Partner Ports. Link IDE secures the corresponding Traffic Class (TC) on one Link; Selective IDE secures selected TLPs and can traverse a supported Switch path. Both may coexist on directly connected Ports: matching Selective TLPs use that Stream's key set, while other applicable traffic can use Link IDE.

IDE

Integrity and Data Encryption

Simulated data: Root Port → Switch Upstream Port → Switch Downstream Port → Endpoint Upstream Port. Assume a Selective Stream terminates at the Root Port and Endpoint Port, and both Switch Ports support and enable Flow-Through. Hop-by-hop Link IDE instead requires separate protection within the Switch beyond its terminal Ports.

Figure 6-48 locates the protection boundary; platform trust policy and internal protection of keys, memory and data require platform and device documentation.

PCIe Base 6.0 §6.33, Figure 6-48 IDE Secures TLPs Between Ports, printed/PDF pp.862–866.

Separate capability, Stream controls and keys

Locate IDE Extended Capability ID 0030h, Version 1, at the management Function for each terminating Port. Endpoint Upstream Ports use Function 0; Downstream Ports use their Bridge Function. Key establishment is handled separately through IDE_KM and is not established merely by reading Configuration Space.

Assume both terminal IDE Capability values are 00000063h: Link IDE, Selective IDE, PCRC and IDE_KM Protocol Supported are set; Supported Algorithms=0; both count fields are zero, indicating one Link IDE TC and one Selective Stream. These are capabilities, not current Stream state.

TC

Traffic Class

Let the Root Port's capability base be R. Figure 7-370 places one Link Control/Status block after the three initial registers, so the first Selective Capability, Control and Status are at R+14h, R+18h and R+1Ch in this example. Other implementations can have different offsets.

Assume the Endpoint Port has the same Stream ID, TC and algorithm, Enable=1 and State=0010b. Enable allows operation to start after the IDE_KM trigger; it does not itself establish Secure. Software treats Reserved State encodings as unknown.

PCIe Base 6.0 §§6.33.2–6.33.3, printed/PDF pp.868–869; §§7.9.26–7.9.26.5.3, Figures 7-370–7-378, Tables 7-323–7-330, pp.1303–1313.

Determine whether a Memory Request matches

Table 6-33 permits Memory Read and Write in Selective IDE, but excludes I/O Read and Write. Section 6.33.4 also requires matching Enable, TC, applicable association ranges and other conditions.

Assume the Root Port's partner Endpoint RID is 0300h. RID Association R+20h=00030000h gives RID Limit=0300h; R+24h=00030001h gives RID Base=0300h and Valid=1. Valid indicates the range has been programmed; it does not mean Secure. The Endpoint's association describes its own partner and must be checked separately.

RID

Routing ID, the packet routing identity

Assume the Root Port's first Address Association has R+28h=90090001h, R+2Ch=00000000h and R+30h=00000000h. Figure 7-381 and Tables 7-333–7-335 define a Valid range of 90000000h–900FFFFFh: the Base's low 20 bits are implicit zeros and the Limit's are implicit ones. A TC0 Memory Read to 90010000h falls within it. Given the remaining routing, selection and protection conditions, it can be associated with this Stream.

A TLP outside the range or using another TC fails the relevant conditions for this example's Selective Stream. Other Streams, Link IDE and platform policy must be considered separately. A Memory Read Completion must match the Stream ID and T bit of its Non-Posted Request. Secure snapshots alone do not prove that the target completed the Read.

TLP

Transaction Layer Packet

PCIe Base 6.0 §6.33.4, Table 6-33 TLP Types for Selective IDE Streams, printed/PDF pp.889–890; §§7.9.26.5.4–7.9.26.5.5, Figures 7-379–7-383, Tables 7-331–7-335, pp.1313–1315.

Enable and Secure describe different steps

Figure 6-49 places Ready within Insecure. Ready is a conceptual substate indicating configuration is complete, tracked by firmware/software; hardware need not report that transition. Applicable key setup, configuration and triggering must finish before each Port enters Secure.

If both Enables are set but Root Port State=0000b and Endpoint State=0010b, the Root Port is not currently Secure; align the timestamps too. A Selective Stream with Enable=1 and RID Association Valid=0 must transition to Insecure. Selected Algorithm, PCRC Enable, RID Base/Limit and Valid must be configured before Enable and must not be modified while it is set; otherwise results are undefined.

Clearing Stream Enable or detecting compromised Stream security requires transition to Insecure. If a TEE (Trusted Execution Environment) requires this Stream, Figure 6-50 permits Locked only when all its required Streams are Secure; any required Insecure Stream requires Not Locked. Traffic intended to be secure must not silently fall back to unprotected TLPs.

Received Integrity Check Fail Message is a separate RW1C event field. Clearing that record does not re-establish a Stream or reconstruct a complete failure history.

PCIe Base 6.0 §6.33.1, Figures 6-49–6-50, printed/PDF pp.866–868; §§7.9.26.5.2–7.9.26.5.3, Tables 7-329–7-330, pp.1310–1313.

Connect the inputs and outputs in Appendix L

Figure L-1 supplies a Memory Write. Table L-1 identifies A (additional authenticated data), P (plaintext), C (ciphertext) and MAC (Message Authentication Code). Figure L-2 then places the IDE Prefix, encrypted data, PCRC and MAC in the resulting Non-Flit packet. Flit Mode uses its own layout.

The specification's example teaches field relationships; it does not establish that a local implementation has been validated. This lesson supplies no production keys or private configuration.

PCIe Base 6.0 Appendix L Example IDE TLP, Figures L-1–L-2, Table L-1 Inputs and Outputs for Example IDE TLP, printed/PDF pp.1903–1904; §6.33.4, p.882.

Edition and sources

This chapter uses PCI Express Base Specification Revision 6.0 (6.0-1.0-PUB). Document and PDF page numbers match. Example configurations and values are author assumptions, not device measurements.

This lesson follows 6.0-1.0-PUB. For deployment, consult the later PCI-SIG IDE security advisory (2025-12-09), applicable updates and the actual platform/component versions. The example or a Secure status alone does not establish that a system is unaffected.