The AXI4-Stream ingress interface for the decryption path follows the same rules as the AXI4-Stream ingress interface for the encryption path in both Fixed Port and Channelized modes.
In the BulkCrypto mode, there is an additional restriction imposed by the HSC Subsystem for the decryption AXI4-Stream ingress interface as follows. If a packet ends on Segment <2*N>, (N=0,1,2,3), the next segment (Segment <2*N+1>) must not be EOP for the next packet (i.e., decc_igr_axis_eop<2*N+1> must be 0). The reason is that there is only one set of ICV signal for each port on the ingress interface.