MACsec Intel FPGA System Design User Guide

ID 767516
Date 6/26/2023

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents

2.5. Data Path Illustrations

The MKA Key exchange path from VM1 to VM0 is shown in the diagram below. The VM1 prepares MCDMA H2D DMA descriptors whereas VM0 prepares D2H DMA descriptors in the host memory and initialize the MCDMA CSRs accordingly. When VM1 start an H2D DMA operation, MKA packets are transferred from the host memory to the FPGA via channel 1 and an MSIX interrupt is triggered to indicate H2D DMA completion. Received packets are streamed to an uncontrolled port of MACSec-1 after aligning to the packet boundary (MACsec does not support Idle cycles in between packets unless tready backpressure happens). These packets are bypassed by the MACsec IP without any processing, and are transmitted over LAN. Upon receiving uncontrolled packets at MACsec-0, they are bypassed to its uncontrolled stream output port without any processing. The MCDMA triggers its D2H DMA on channel 0 to transfer packets from the FPGA to the host followed by an MSIX interrupt to indicate D2H DMA completion. The same sequence is followed along VM0 to VM1 (DMA channel 0 to DMA Channel 1) while sending MKA reply packets.
Figure 21. MKA Exchange Data Traffic
Once a key exchange is done, the host may configure the MACsec IP with the key information and turn on its packet generator to start transmitting data. Here, since packets are received at the destination, it is important to have the same packet generator configuration at both ends in order to transmit and verify the received data. Once a packet generator is started, it generates the AXI stream packets until a stop condition is reached. The MACsec encrypts all the received packets using the Crypto engine and transmits them over a LAN. Upon receiving the packets at the other MACsec, traffic is decrypted and fed to a packet checker. The checker module compares the traffic against a reference pattern and updates its status registers. The application may stop the traffic generator and restart if the system undergoes a rekeying sequence.
Figure 22. Packet Generator Data Traffic