Can Agilex 3 A3CY100BM16AE7S (AXC3000) use SDM cryptographic services?

Hello,

Question 1: Does spec code Y support SDM Cryptographic Primitive Services?

Yes — per the authoritative Security Technical Reference Manual, it does. The Security TRM explicitly groups Agilex 3 devices W and Y together: Cryptographic Primitive Services = Yes, while only the Z variant is listed as No. Security Technical Reference Manual The full W/Y feature row confirms: SDM Version 1.5; Cryptographic Primitive Services = Yes; Black Key Provisioning = SPDM; Attestation Support = SPDM 1.2; Secure Data Object Storage = Yes. Hard Processor System Technical Reference Manual

The C-Series Product Table (SUPPLEMENTARY) appears to show Y=No for "Crypto," which contradicts the Security TRM. The Security TRM is the higher-authority source and takes precedence. That conflict is worth noting, but the decisive document is unambiguous: spec Y is in the same capability tier as W for cryptographic primitive services.

On the Mailbox Client IP side, the cryptographic offloading feature is available for Agilex 7, Agilex 5, and Agilex 3 devices in Quartus Prime Pro Edition version 21.3 or later, Enabling Cryptographic Services and specifically for Agilex 3 devices, this feature is available in Quartus Prime Pro Edition version 25.1 or later. Mailbox Client IPs User Guide Your 26.1 build satisfies that requirement.

Question 2: Is 0x085 the expected response, or should it be 0x0F?

Given that your device (spec Y) does have the hardware capability, 0x085 is the more informative and correct rejection. Error 0x0F would mean "function not supported on this device" — a hard silicon limitation. Error 0x085 is in the command-specific error range (0x80–0x8F), which indicates a command-specific error due to an SDM command you used. Error Code Responses The interpretation you found in the Security TRM — "command not allowed under the current security settings" — is consistent with a device that has the capability but has a security policy or provisioning gate blocking access. You'd only expect 0x0F on a Z-variant device.

Question 3: What could cause 0x085 on a capable device?

The root cause is almost certainly a provisioning or security policy prerequisite not being met. Key factors to check:

• SDM security provisioning state: The foundational element of the security architecture is the SDM — a self-contained system-on-chip that securely manages boot, provides secure key storage, and enforces security policies. Security Overview for SDM-Based FPGA Devices Cryptographic primitive services are governed by those same enforced policies. If the device has not been provisioned with the required credentials (key hierarchy, owner root key, or SPDM identity), the SDM will reject crypto service session open commands at the policy enforcement layer.
• SPDM/Black Key Provisioning requirement: For W/Y devices, Black Key Provisioning is via SPDM. Hard Processor System Technical Reference Manual If SPDM-based provisioning has not been completed, the SDM may deny crypto service access regardless of the Enable Crypto Service IP parameter setting.
• SDM crypto engines availability during user mode: The SDM contains hardened cryptographic acceleration engines. When not in use by the SDM for configuration, they are made available to the FPGA design or HPS software through the SDM mailbox interface while the FPGA is in user mode. Security Overview for SDM-Based FPGA Devices If there is any active SDM internal use or policy restriction, access is blocked.
• Mailbox Client instantiation limit: For Agilex 5 and Agilex 3 devices, only one instantiation of the Mailbox Client IP is supported. Mailbox Client IPs User Guide Verify your design has exactly one instance.
• Response FIFO management: Ensure that you read or flush out the content in the response FIFO before issuing a new command. Continuously sending commands without reading back valid data from the response FIFO gradually fills it. When the response FIFO overflows, the SDM freezes. Mailbox Client IPs User Guide Your test methodology (reading response FIFO after each command) looks correct for this.

Question 4: Is there a supported way to enable these services?

The IP parameter side is already correctly configured — setting Enable Crypto Service to 1 in the IP parameter editor causes the Mailbox Client IP to generate a 64-bit AXI manager interface used to pass data between the cryptographic fabric IP and user space memory. Mailbox Client IPs User Guide That part is right.

The blocker is almost certainly on the SDM provisioning side. For detailed Cryptographic Services Mailbox Command descriptions, refer to the Security Methodology for Altera FPGAs and Structured ASICs User Guide, which contains detailed descriptions of security features and technologies to help you select the security features necessary to meet your security objectives. Mailbox Client IPs User Guide For more information or access, contact Altera Premier Support and quote ID #14014613136. Mailbox Client IPs User Guide That document (NDA-gated) covers the exact provisioning workflow required before open_crypto_service_session will succeed.

In summary: your A3CY100BM16AE7S (spec Y) is documented as capable of SDM cryptographic primitive services; the 0x085 response confirms the SDM is rejecting the command on policy/provisioning grounds, not on a silicon capability limitation. The next step is to work through the SDM provisioning flow described in the Security Methodology User Guide for your device.

regards,

Farabi