Visible to Intel only — GUID: itf1672944241381
Ixiasoft
2.1. System Architecture
2.2. Data Path Between Ethernet MAC and MACsec
2.3. Data Path Between MACsec and MCDMA
2.4. Data Path Between MACsec and Packet Generator/Checker (Packet Client)
2.5. Data Path Illustrations
2.6. Interrupts
2.7. Packet FIFO
2.8. AXI-ST Rate Controller
2.9. Error Handling
2.10. Top Level Signals
6.5.1.1. MACsec Reset Sequence
6.5.1.2. TX Configuration Sequence
6.5.1.3. RX Configuration Sequence
6.5.1.4. TX Rekeying Sequence
6.5.1.5. RX Rekeying Sequence
6.5.1.6. Cut Through/Store Forward Mode
6.5.1.7. User Single/Multi Port Settings
6.5.1.8. Encrypt/Decrypt Port
6.5.1.9. Port Priority
6.5.1.10. Interrupt Generation and Register
6.6.1. macsec_initilize
6.6.2. macsec_get_attributes
6.6.3. macsec_get_sa_attributes
6.6.4. macsec_set_attributes
6.6.5. macsec_set_sa_attributes
6.6.6. macsec_read_register
6.6.7. macsec_write_register
6.6.8. macsec_set_port_configuration
6.6.9. macsec_rate_configuration
6.6.10. macsec_single_or_multi_port
6.6.11. macsec_crypto_mode
6.6.12. macsec_port_priority
6.6.13. macsec_register_isr
7.1. Software Requirements
7.2. Obtaining the Reference Design
7.3. Reference Design Directory Structure
7.4. Simulation Command Arguments
7.5. Simulation Test Cases
7.6. Complete Simulation Command
7.7. Simulation Requirements
7.8. Running Non-UVM Simulation
7.9. Running UVM Simulation
7.10. Building, Installing, and Running the Software
7.11. Building the Hardware Design
Visible to Intel only — GUID: itf1672944241381
Ixiasoft
2.5. Data Path Illustrations
The MKA Key exchange path from VM1 to VM0 is shown in the diagram below. The VM1 prepares MCDMA H2D DMA descriptors whereas VM0 prepares D2H DMA descriptors in the host memory and initialize the MCDMA CSRs accordingly. When VM1 start an H2D DMA operation, MKA packets are transferred from the host memory to the FPGA via channel 1 and an MSIX interrupt is triggered to indicate H2D DMA completion. Received packets are streamed to an uncontrolled port of MACSec-1 after aligning to the packet boundary (MACsec does not support Idle cycles in between packets unless tready backpressure happens). These packets are bypassed by the MACsec IP without any processing, and are transmitted over LAN. Upon receiving uncontrolled packets at MACsec-0, they are bypassed to its uncontrolled stream output port without any processing. The MCDMA triggers its D2H DMA on channel 0 to transfer packets from the FPGA to the host followed by an MSIX interrupt to indicate D2H DMA completion. The same sequence is followed along VM0 to VM1 (DMA channel 0 to DMA Channel 1) while sending MKA reply packets.
Figure 21. MKA Exchange Data Traffic
Once a key exchange is done, the host may configure the MACsec IP with the key information and turn on its packet generator to start transmitting data. Here, since packets are received at the destination, it is important to have the same packet generator configuration at both ends in order to transmit and verify the received data. Once a packet generator is started, it generates the AXI stream packets until a stop condition is reached. The MACsec encrypts all the received packets using the Crypto engine and transmits them over a LAN. Upon receiving the packets at the other MACsec, traffic is decrypted and fed to a packet checker. The checker module compares the traffic against a reference pattern and updates its status registers. The application may stop the traffic generator and restart if the system undergoes a rekeying sequence.
Figure 22. Packet Generator Data Traffic