Efficient memory utilization for cartesian product of rules

Abstract

The present disclosure relates to efficient memory utilization for Cartesian products of rules. A network device includes one or more ports and an action selection circuit. The ports are to exchange packets over a network. The action selection circuit is to, for a given packet, determine a first search key based on a first header field of the given packet and determine a second search key based on a second header field of the given packet, compare the first search key to a first set of comparison values, output a multi-element vector in response to a match between the first search key and a first comparison value, generate a composite search key by concatenating the second search key and the multi-element vector, compare the composite search key to a second set of comparison values, and output an action indicator for application to the given packet in response to a match between the composite search key and a second comparison value.

Description

Technical Field

[0001] This invention relates generally to communication networks, and more specifically to the efficient determination of communication packet actions based on packet headers. Background Technology

[0002] In a communication network, actions can be applied to a communication packet based on the contents of one or more header fields.

[0003] In their paper, "Hierarchical triepacket classification algorithm based on expectation-maximization clustering" (July 13, 2017; doi.org / 10.1371 / journal.pone.0181049), Bi and Zaho assert the urgent need for grouping classification algorithms capable of handling large-scale rule sets. They explain the importance of hierarchical trie-based grouping classification algorithms due to their widespread practical use, despite drawbacks such as backtracking and the presence of empty nodes. The authors then propose a novel grouping classification algorithm based on expectation-maximization clustering (HTEMC), which employs trie path compression to eliminate backtracking and addresses the low update efficiency of trie structures, significantly improving the algorithm's performance.

[0004] In "Scalable Packet Classification," Barboscu and Varghese (IEEE / ACM Network Communications, Vol. 13, No. 1, February 2005), the authors assert that as filter databases grow in size, reported packet classification becomes poorly scalable in both time and space, and hardware solutions (such as TCAM) do not scale to large classifiers. The paper attempts to leverage this observation to generate a scalable packet classification scheme called Aggregated Bit Vector (ABV), which employs a bit vector retrieval algorithm (BV) (which takes linear time) and adds two new ideas—recursive aggregation of bitmaps and filter rearrangement—to ABV, which may take logarithmic time for many databases.

[0005] Finally, for example, in "Algorithms for Advanced Packet Classification with Ternary CAMs" by Lakshminarayanan et al., ACM SIGCOMM 2005 describes techniques to improve the efficiency of TCAMs in packet classification. Summary of the Invention

[0006] The embodiments of the present invention described herein provide a network device including one or more ports, an action selection circuit, and a packet processor. The one or more ports are used to exchange packets over a network, each packet including a packet header having at least a first header field and a second header field. The action selection circuit is configured to: for a given packet, determine a first search keyword based on the first header field of the given packet, and determine a second search keyword based on the second header field of the given packet; compare the first search keyword with a first set of comparison values ​​to output a multi-element vector in response to a match between the first search keyword and a first comparison value in the first set; generate a composite search keyword by concatenating the second search keyword and the multi-element vector; compare the composite search keyword with a second set of comparison values; and output an action indicator for applying to the given packet in response to a match between the composite search keyword and a second comparison value in the second set. The packet processor processes the packet in response to the packet header, including applying an action to the given packet in response to the action indicator, the action indicator being output by the comparison circuit.

[0007] In some embodiments, the multi-element vector includes a one-hot vector having a marker element whose position in the one-hot vector indicates the index of the first comparison value found to match the first search keyword in the first group. In an exemplary embodiment, the second comparison value in the second group includes (i) a second value corresponding to the second header field, and (ii) comparison vectors, each comparison vector including: a "do not care" value at one or more locations where the combination of the second value corresponding to (i) and the first comparison value corresponding to (ii) guarantees the output of the action indicator; and a non-set value at one or more other locations.

[0008] In some embodiments, the multi-element vector is defined such that: one or more elements of the multi-element vector are set, corresponding to an index in the second group that corresponds to a second comparison value matching the second search keyword; and one or more elements of the multi-element vector that do not correspond to an index in the second group that corresponds to a second comparison value not matching the second search keyword are not set. In an example embodiment, the comparison value in the second group includes: (i) a second search keyword value, and (ii) a multi-element vector comparison value, wherein one or more elements at the position indicating the first search keyword value are set, and elements at other positions are set to an "ignore" value.

[0009] In the disclosed embodiments, at least one of the first comparison value and the second comparison value includes an "ignore" value. In some embodiments, the multi-element vector includes binary elements. In one embodiment, the action selection circuitry includes a tri-state content-addressable memory (TCAM) for storing one or both of the first set of comparison values ​​and the second set of comparison values.

[0010] According to embodiments described herein, a method in a network device is also provided. The method includes exchanging packets over a network, each packet including a packet header having at least a first header field and a second header field. For a given packet, a first search keyword is determined based on the first header field of the given packet, and a second search keyword is determined based on the second header field of the given packet. The first search keyword is compared with a first set of comparison values, and a multi-element vector corresponding to the first comparison value is output in response to a match between the first search keyword and the first comparison value in the first set. A composite search keyword is generated by concatenating the first search keyword and the multi-element vector. The composite search keyword is compared with a second set of comparison values, and an action indicator for applying to the given packet is output in response to a match between the composite search keyword and a second comparison value in the second set. The packet is processed in response to the packet header, including applying an action to the given packet in response to the action indicator, the action indicator being output by comparison circuitry.

[0011] According to the embodiments described herein, a method for determining an action applied to a packet in a network device is also provided. The method includes: for a given packet being processed in the network device, determining a first search keyword based on a first header field of the given packet, and determining a second search keyword based on a second header field of the given packet; comparing the first search keyword with a first set of comparison values, and outputting a multi-element vector in response to a match; generating a composite search keyword by concatenating the first search keyword and the multi-element vector; comparing the composite search keyword with a second set of comparison values, and outputting an action indicator for applying to the given packet in response to a match. Attached Figure Description

[0012] The invention will be more fully understood from the following detailed description of the embodiments, taken in conjunction with the accompanying drawings, in which:

[0013] Figure 1 This is a schematic block diagram of a network device according to an embodiment of the present invention;

[0014] Figure 2 This is an example double header field rule set table according to an embodiment of the present invention;

[0015] Figure 3 This is a schematic block diagram of an Action Select Circuit (ASC) of the Rule-with-Membership-Vector type according to an embodiment of the present invention;

[0016] Figure 4A This is a flowchart illustrating a method for programming a comparison circuit of an ASC having a membership vector rule type according to an embodiment of the present invention;

[0017] Figure 4B This is a flowchart schematically illustrating a method for determining an action using a membership vector rule according to an embodiment of the present invention;

[0018] Figure 5 This is a schematic diagram illustrating an ASC of the Vector-Membership type according to an embodiment of the present invention;

[0019] Figure 6A This is a flowchart schematically illustrating a method for programming a comparison circuit for an ASC of a vector membership type according to an embodiment of the present invention;

[0020] Figure 6BA flowchart illustrating a vector-membership method for determining actions according to an embodiment of the present invention is shown schematically; and

[0021] Figure 7 This is a schematic graph illustrating the total number of comparison bits required for the selection action according to an embodiment of the present invention. Detailed Implementation

[0022] Overview

[0023] Network devices such as network switches / routers and other network devices communicate through communication networks (e.g., Ethernet or InfiniBand). TM Packet transmission. According to forwarding / routing rules, network devices typically receive packets from the network through ingress ports and forward packets to the network through egress ports.

[0024] Network devices may include packet processors configured to process and route packets according to a set of rules, typically based on values ​​stored in the packet header (in the TCP / IP example, the header includes five header fields: source address, ingress port, protocol, destination address, and egress port; collectively referred to as the L4 5-tuple).

[0025] This set of rules (sometimes called an action table) includes one or more actions, and for each action, the corresponding header value of the packets to which the action should be applied. Sometimes, the values ​​of the packet header fields specified for each rule include an "I don't care" field (usually specified by an "X" symbol); for example, if a given action should be applied to all packets arriving from a given port, regardless of the values ​​of other header fields, the corresponding rule would include the given port at the ingress port header field, and "I don't care" for all other header fields.

[0026] Typically, some rules are defined as Cartesian products of single-field rules. While the number of values ​​for a given rule in a single field is manageable, the number of Cartesian products can be extremely high, slowing down packet processing and / or requiring a large amount of circuitry. When rule matching is performed using a tri-state content-addressable memory (TCAM), the TCAM size can be very large and / or not all rules may fit within the TCAM. (TCAM has the advantage of searching all rules simultaneously, but suffers from the disadvantages of large area and high power consumption.)

[0027] This document discloses an apparatus and method for efficiently locating rules and determining actions based on the value of a packet header, according to embodiments of the invention. In an embodiment, an action selection circuit (ASC) receives two or more fields of a packet header and extracts actions in response to the contents of the header fields and a pre-programmed set of rules.

[0028] In one embodiment, the ASC includes a first comparison circuit that compares a first packet header field with a column of comparison values ​​and outputs a corresponding intermediate result output vector. The ASC combines the output vector with a second field of the packet header to generate a synthetic search keyword, which is input to a second comparison circuit that includes a second column of comparison values; the second comparison circuit then outputs an action corresponding to the first packet header field and the second packet header field.

[0029] In some embodiments, the different comparison values ​​in the first comparison circuit are assigned member IDs, and the intermediate result output vector is a one-hot representation of the member ID. The second comparison circuit compares the one-hot representation with a field in which all bit positions corresponding to the action are set to "ignore" values, while other bit positions are at logic -0.

[0030] In other embodiments, the second comparison circuit includes a first search column that includes the search value of the second header field. The search value is assigned a member ID, which is represented in a one-hot format in the second search column of the second comparison circuit. One-hot means a single set element included in the position according to the member ID, with all other elements set to "ignore". The ASC compares a temporary output vector from the first comparison circuit with the second search column and compares the first search column with the second header field. When a match exists in both search fields (in the same row), the ASC instructs an action.

[0031] System Description

[0032] Network devices such as network switches and routers access communication networks (e.g., Ethernet or InfiniBand) through ingress ports. TM It receives packets and forwards them to the network through the egress port. (In the following disclosure, we will primarily refer to switches and routers; however, the invention is not limited to switches and routers and can be used with all suitable network devices, including network interface controllers (NICs), host channel adapters (HCAs), network-enabled graphics processing units (GPUs), data processing units (DPUs—sometimes also called “smart NICs”), and any other computing devices coupled to the communication network.)

[0033] Typically, network devices include packet processing circuitry that applies processing actions to incoming packets according to a set of rules configured for the network device. Some rules refer to the contents of the packet header; for example, a rule might indicate that the network device will always discard incoming packets with a source IP port equal to a preset value (e.g., for security).

[0034] A packet header may include multiple header fields (e.g., five header fields to define the source IP address, source port, destination IP address, destination port, and protocol ID); in practice, while some header fields may be relatively small, others may include 32 bits or more, and therefore, the number of possible header combinations can be enormous.

[0035] This set of rules sometimes associates actions with a combination of values ​​from multiple header fields. For example, it might discard packets with source IP address = X and destination port = Y, regardless of the contents of other header fields. Fields not validated according to the rules are called "do not care fields" and are denoted by X. In some embodiments, "do not care" values ​​can also be used in validated fields for some of these bits. For example, for a source IP address header field formatted as NUM1.NUM2.NUM3.NUM4 (four decimal numbers separated by dots), the following rule could be applied: "If the field value is 138.100.X.7, then discard the packet." This rule would apply to field values ​​of 138.100.2.7 and 138.100.4.7, but not to field values ​​of 138.101.2.7 and 138.100.2.6.

[0036] In one embodiment, the network device includes action selection circuitry to efficiently determine actions based on fields in the packet header and a pre-programmed set of rules.

[0037] Figure 1 This is a schematic block diagram of a network device 100 according to an embodiment of the present invention. The network device includes: port 102 (which may include an ingress port and an egress port) for communication via Ethernet, InfiniBand, etc. TM Or any other suitable network transmission packet; header extractor 104 for extracting header fields of ingress packets; action selection circuit (ASC) 106 configured to select an action to be performed on the ingress packet (e.g., forward or drop); and packet processor 108 for processing packets in response to the indicated action (other components of network device 100 are not shown for clarity of concept).

[0038] according to Figure 1In the illustrated example embodiment, ASC 106 includes a first comparison circuit 110 and a second comparison circuit 112. The first comparison circuit 110 compares a first header field of the packet header with a first set of search values ​​and outputs a provisional search result in response. The second comparison circuit compares a composite search value, including a second header field and the provisional search result, with a second set of search values ​​and instructs the packet processor to take action.

[0039] It should be noted that in practical applications, the number of header fields is often greater than two, and other rules can be associated with other header fields. In embodiments, these additional rules can be processed by other comparison circuits, including (but not limited to) interconnected pairs of comparison circuits.

[0040] The number of header field combinations (even for just two header fields) can be very large; therefore, retrieving a rule defined by a combination of two header fields can consume a considerable amount of silicon area (and a significant amount of power). In embodiments, if the retrieval is performed using two separate comparison circuits, the area and power can be significantly reduced, where a provisional result from the first comparison circuit is used as input to the second comparison circuit. In some embodiments, when one of the fields is substantially smaller, the smaller field can be represented by a vector.

[0041] In some embodiments, the first comparison circuit and / or the second comparison circuit includes one or more tri-state content-addressable memories (TCAMs) configured to compare input data to compare values ​​stored therein; in embodiments, both the first and second comparison circuits are located in a single TCAM; the TCAM is first accessed to perform the comparison function of the first comparison circuit, and then the TCAM is accessed to perform the comparison function of the second comparison circuit; the TCAM may store the temporary result in a register (e.g., outside the TCAM).

[0042] It should be noted that, although according to Figure 1 In the example embodiment shown, ASC 106 selects the action to be applied to the inbound packet based on the inbound packet header. However, in an alternative embodiment, ASC 106 may select the action to be applied to the outbound packet based on the outbound packet header. In other embodiments, ASC may select the action to apply to both inbound and outbound packets.

[0043] In some embodiments, network device 100 further includes a processor that monitors and configures the various network device circuits. In other embodiments, the processor may be external and connected to the network device via an interface (e.g., Peripheral Component Interconnect High Speed ​​or PCIe).

[0044] Referenced through examples Figure 1 The configurations of network device 100 and ASC 106 shown and described above are illustrated. Other configurations may be used in alternative embodiments. For example, multiple comparison circuit pairs may be used in an embodiment. In some embodiments, the action selected by the second comparison circuit 108 may be input to other circuits, which may, for example, pass the action to the packet processor only if some other conditions are met.

[0045] Figure 2 This is an example double-header field rule set table 200 according to an embodiment of the present invention. It should be noted that typical rule set tables are significantly larger than table 200 and can contain thousands or tens of thousands of rules. Example rule set 200 is cited only for the clarity of the embodiment concept and will be disclosed below.

[0046] Rule set table 200 includes a destination port column 204, a destination IP address column 206, and an action column 208. Each column includes multiple rows corresponding to multiple rules. The rows in the destination port column include search values ​​related to the destination port header field, and the rows in the destination IP address column include search values ​​related to the destination IP address header field. If, for any given row, both the destination IP address search value and the destination port search value match the values ​​of the corresponding header fields, the network device selects the action corresponding to the given row from the action column 208.

[0047] In some embodiments, actions can have binary values—for example, forward (logic -1) or drop (logic -0). In such embodiments, rows corresponding to one of the logical values ​​can be skipped from the rule set table, and the action corresponding to the logical level can be selected by default. For example, in table 200, if a drop is the complementary value to forward (i.e., the action to be taken is always forward or drop), the table can include comparisons of rows with only forwarding actions and will not include rows related to drop; for smaller table sizes, logical values ​​with fewer rules should be stored in the table, and logical values ​​with more rules should be selected by default. (In practice, the action column for binary value actions can be eliminated.)

[0048] Figure 2 The rule set table 200 shown and described herein is an example embodiment cited for clarity of concept only. Other rule set tables may be used in alternative embodiments, such as those with different (typically much larger) rule set sizes and belonging to different header fields. In embodiments, comparison values ​​may include "ignore" values ​​that match the values ​​of corresponding header field bits regardless of their significance. In yet another embodiment, the number of possible actions may be more than two.

[0049] definition

[0050] In the description of this article, we used several terms that are defined and explained below:

[0051] Actions: These are the actions that a packet processor typically applies to a given packet in response to its packet header. Actions include forwarding, dropping, and many others.

[0052] Action selection circuit (e.g., ASCII 106, Figure 1 ): Circuitry that responds to packet header selection actions. In an embodiment, the ASC includes two or more comparison circuits.

[0053] Header fields: The functional part of the packet header, such as destination IP address, destination port, etc. A typical header may include, for example, five header fields. In the following description, we will sometimes refer to "first header field" and "second header field"; however, these enumerations are not necessarily related to the position of the header fields within the header and will be used as general header field identifiers.

[0054] Search keyword: A multi-element signal compared with preset comparison data. In embodiments, the search keyword may include one or more header fields; in other embodiments, the search keyword is established based on header fields (e.g., the keyword may be a signature of one or more header fields); in embodiments, the search keyword may be a composite search keyword (defined below).

[0055] Comparison values: A set of predefined comparison data compared to the search keywords. For example, Figure 2 The destination port number {2, 6, 3, 3, 6, 31} is in column 204.

[0056] Comparison columns: A set of comparison values ​​compared to a single search keyword. There may be more than one comparison column comparing to more than one keyword. For example, columns 204 and 206... Figure 2 ).

[0057] Data column: Compared with one or more comparison columns (e.g., Figure 2 A set of data elements associated with the corresponding comparison value in data column 208.

[0058] Comparison Row: A row element containing a single comparison value for the comparison column (or, if there is more than one comparison column, a single comparison value from each comparison column) and the corresponding data column element.

[0059] Output vector: Data elements in the comparison row where the search key equals the comparison value (or, if there is more than one comparison column, all keys equal the corresponding comparison value). In some embodiments, the output vector may indicate an action; in other embodiments, the output vector is a provisional comparison result.

[0060] Comparison circuit: A circuit used to compare one or more input search keywords with one or more corresponding comparison columns and to output an output vector. In some embodiments, the comparison circuit may include a TCAM.

[0061] Synthetic search keywords: search keywords that include header fields (or representations of header fields) and additional search data; in some embodiments, the output vector generated by the first comparison circuit is additional data of the synthetic search keywords input to the second comparison circuit.

[0062] Member groups: Groups that compare all unique key values ​​in a column. For example, in column 204 ( Figure 2 In the set {2, 3, 6, 31}, the K1 member group is the set {138.100.17.07, 138.100.17.09, 138.100.17.43, 138.100.17.63}.

[0063] Member ID: An ID number assigned to each element in a member group. In the example embodiment, the minimum member ID is 0, assigned to the minimum value of the related key; the next member ID is 1, assigned to the next minimum key value, and so on. For example, for the member group K1 {2, 3, 6, 31}, member IDs 0, 1, 2, and 3 are assigned to the K1 values ​​2, 3, 6, and 31 respectively (other one-to-one mappings may be used in alternative embodiments).

[0064] Vector membership: When ASC selects a given action in response to a given first header field value and any one of a set of second header field values, the member ID of that set of second header field values ​​is called the vector membership of the given first header field value.

[0065] One-hot vector: A multi-element vector with one set element and all other elements unset. In some embodiments, the unset element is represented by a logical -0 value.

[0066] Example of action selection circuit configuration and association methods

[0067] Next, we will describe two types of ASC according to embodiments of the present invention: a membership vector rule type and a vector membership type. In both types, the ASC includes two interconnected comparison circuits; however, the two types have different comparison circuit configurations and different provisional retrieval result structures.

[0068] In embodiments, the search column may include an "ignore" bit, which always matches the corresponding input search keyword bit. In some embodiments (e.g., when the search circuitry includes TCAM or algorithmic TCAM), more than one search value may match the input search keyword; in embodiments, the comparison circuitry is configured to assign priority to data rules (e.g., based on row order), and if more than two rows match, output the data corresponding to the highest priority rule.

[0069] Membership Vector Rule ASC

[0070] Figure 3 This is a schematic block diagram illustrating a membership vector rule type ASC 300 according to an embodiment of the present invention. ASC 300 includes a first comparison circuit 302 and a second comparison circuit 304. The first comparison circuit 302 receives a search keyword K2 corresponding to the destination IP address header field and outputs a temporary search result, K2_vector. The second comparison circuit 304 receives a composite search keyword including a keyword K1 corresponding to the destination port header field and the uniquely hot K2_vector.

[0071] The first comparison circuit 302 includes a retrieval circuit 306 and a binary-to-one-hot decoder 308. The retrieval circuit compares the retrieval keyword K2 (e.g., the destination IP address header field connected to the packet) with the comparison column 310, and in response to a match, outputs the corresponding data column 312 value, including a list of K2-IDs, to the binary-to-one-hot decoder 308, which then converts the K2 IDs into a temporary one-hot K2_vector retrieval result.

[0072] The second comparison circuit 304 includes a comparison column K1 314 storing comparison values ​​of K1 (e.g., the destination port field of the packet header), a comparison column 316 storing comparison values ​​of K2-vectors, and a data column 318 storing the desired packet action to be performed (e.g., by the packet processor) if a match is found in the corresponding rows of the K1 column 314 and the K2-vector column 316. Comparison column 316 stores an "I don't care" value when an action is needed (if the corresponding row in comparison column 314 indicates a match) and a logic -0 for when no action is needed. The concatenation of K1 and K2-vectors is the composite search key of the second comparison circuit.

[0073] (According to the example embodiment, ASC 300 indicates only a single action; therefore, action column 318 is not required—if a match exists in any comparison row, the second comparison circuit will indicate forwarding.)

[0074] The above description will be more fully understood if we examine, for example, the second line of the second comparator circuit. According to the second line, if K1 = 3 and the K2 vector matches the value 0XX0 (i.e., 0 in bits 0 and 3, and 0 or 1 in bits 1 and 2), then a forwarding action will be indicated. Table 200 ( Figure 2 By definition, if K1 = 3 and K2 is 138.100.17.09 or 138.100.17.43, then the second comparator circuit should indicate a forwarding action.

[0075] We now look at the first comparator circuit. If K2 = 138.100.17.09, then K2 ID = 1 (second member, starting from 0), and the K2 vector will read 0010 (second bit set); if K2 = 138.100.17.43, then K2 ID = 2 and the K2 vector = 0100. In both cases, bits 0 and 3 are 0, and either bit 1 or bit 2 is logic 1. In other words, if K1 = 3 and K is 2138.100.17.09 or 138.100.17.43, the second row of K1 will match the second row of the K2 vector, and ASC will indicate a forwarding action.

[0076] In this embodiment, the total number of retrieval units in the action selection circuit 300 with membership vector rule type is:

[0077] N*Nw+M*(Mw+N)

[0078] And the number of data bits (e.g., column K2, 310) is:

[0079] N*logN

[0080] Where N is the number of K2 distinct values, Nw is the width of K2 entries (in bits), M is the number of K1 distinct values, and the log operation is rounded up to the nearest integer (base 2).

[0081] Figure 3 The configuration of the action selection circuit 300 shown and described above is an example cited for clarity of concept only. Other configurations may be used in alternative embodiments. For example, in some embodiments, more than two header fields (e.g., K1 to K) are retrieved. n The first comparison circuits 302 output temporary one-hot search result vectors related to header fields 2 to n, and these vectors are input to the second comparison circuit 304. In addition to the K1 comparison columns 314, the second comparison circuit includes n-1 comparison columns to compare the vectors output from the n-1 first comparison circuits.

[0082] In other embodiments, the data column of the comparator circuit 302 includes a one-hot K2 vector instead of K2ID. This makes the data column wider (in... Figure 3 In the example shown—4 bits instead of 2 bits—this eliminates the need for binary-to-hot circuit 308.

[0083] Figure 4A This is a flowchart 400 schematically illustrating a method for programming a comparison circuit of an ASC having a membership vector rule type according to an embodiment of the present invention. The flowchart is generated by processor 110 ( Figure 1 The method includes programming a first comparison circuit and a second comparison circuit, each having a comparison value corresponding to a first header field and a second header field (in the current context, the first header field refers to the destination port, and the second header field refers to the destination IP address (other header fields may be used in alternative embodiments)).

[0084] The flowchart begins with operation 402, "Fill First Compare CircuitSearch Column," where the processor fills the comparison column of the first comparison circuit with a list of comparison values ​​related to the header field values ​​of the second header field. Next, the processor proceeds to operation 404, "Fill First Compare Circuit Data Column," where the processor fills the data column of the first comparison circuit with an output vector that includes the ID of the corresponding value in the comparison column (e.g., the ID of the first unique comparison value could be 0, the ID of the second unique comparison value could be 1, and so on). If there are N unique comparison values ​​in the comparison column, the number of bits in each output vector will be log₂N, rounded up to the next integer (note that the size of the one-hot vector will be 2^N). N ).

[0085] In operation 406, filling the first comparison column of the second comparison circuit, the processor fills the first comparison column of the second comparison circuit with the value of the first header field (in some embodiments, the comparison value may include an "ignored" value). Next, in operation 408, filling the second search field of the second comparison circuit, the processor fills the second comparison column of the second comparison circuit with rows that will include "ignored" elements at positions matching the K2 member, and fills the other elements with logic -0 (e.g., in...). Figure 3 In line 2, because the combination of K1=3 and K2-ID=1 or K2-ID=2 results in a forwarding action, the processor fills the second search field of the second comparison circuit with 0XX0.

[0086] Finally, in the Fill Data Field Column operation 410, the processor fills the data column with actions corresponding to the combination of K1 and K2 in the matched comparison rows.

[0087] To ensure clarity, examples will be used to illustrate the concepts. Figure 4A The configuration of flowchart 400, shown in the diagram and described above, is illustrated. In alternative embodiments, the order of operations may differ and / or some of the operations may be performed concurrently. In some embodiments, when adding a new rule or removing an existing rule, the ASC settings can be incrementally modified by altering values ​​in different comparison columns and data columns.

[0088] Figure 4B This is a flowchart 450 schematically illustrating a method for determining an action using a membership vector rule according to an embodiment of the present invention. This flowchart is based on ASC 106 (…). Figure 1 ) is executed, and includes access to what is preset (e.g., according to Figure 4A The flowchart 400 shows two comparison circuits.

[0089] The flowchart begins with Access First Compare Circuit operation 452, where ASC uses K2 (the content of the second header field) as a search keyword to access the first comparison circuit. In some embodiments, the signature of the second header field is used as the search keyword.

[0090] Next, in the Get K2-ID operation 454, ASC reads the ID of the matching K2 value from the first comparator circuit. As described above (refer to...). Figure 4A The number of bits in K2 ID is log2N, where N is the number of unique search values ​​in the search column of the first comparator circuit, and log2N is rounded to the next higher integer.

[0091] ASC then converts the K2 ID to a one-hot vector at Convert-to-One-Hot operation 456, setting one bit (e.g., at logic -1) and clearing all other bits (e.g., at logic -0).

[0092] Next, in the Generate Composite Search Vector operation 458, the ASC concatenates the one-hot K2 vector with K1—the content of the first header field (or, in this embodiment, the signature of the first header field)—to generate a composite search keyword. Then, in the Access to Second Comparison Circuit operation 460, the ASC uses the composite search vector to retrieve data from the second comparison circuit. Finally, in the Action Acquisition operation 462, the ASC reads the action matching K1 and K2 from the second comparison circuit.

[0093] exist Figure 4B The configuration of flowchart 450 shown and described above is an example configuration cited for clarity of concept. Other configurations may be used in alternative embodiments. For example, in some embodiments, the first comparison circuit does not include a binary-to-one-hot decoder; instead, the data column of the first comparison circuit includes the decoded vector values ​​(and in this case, the retrieval circuit 306 is the only component of the first comparison circuit 304, which can be discarded).

[0094] In other embodiments, additional header fields may be used in the first and second comparison circuits; in one embodiment, the ASC obtains the encoding of the action in operation 462 (e.g., "1" for transfer, "0" for drop). In other embodiments, the output of the second comparison circuit may be coupled to the outputs of other comparison circuits to generate the desired action, and in other embodiments, the output of the second comparison circuit may be used to generate another synthetic retrieval vector to access more comparison circuits.

[0095] Vector Membership ASC

[0096] Figure 5 This is a schematic block diagram illustrating a vector membership type ASC 500 according to an embodiment of the present invention. ASC 500 includes a first comparison circuit 502 and a second comparison circuit 504. The first comparison circuit 502 receives a keyword K1 corresponding to a destination port header field and outputs a temporary search result K2_vector (also referred to as K2 vector membership). The second comparison circuit 504 is accessed by the synthesized search keyword and outputs an action.

[0097] The first comparison circuit 502 compares the keyword K1 (e.g., the destination port field connected to the packet header) with the comparison column 510 and, in response to a match, outputs the corresponding membership vector. The membership vector in the comparison row of column 510 with a given K1 value includes a setting element at the position corresponding to the K2 value, which, when combined with the given K1 value, will cause an action.

[0098] For example, (see) Figure 2 When the destination port in the first header field is 3, a forwarding action is defined if the destination IP address is 138.100.17.09 or 138.100.17.43. The member ID of 138.100.17.09 is 1 (with a one-hot representation of 0010), and the member ID of 138.100.17.43 is 2, with a one-hot representation of 0100 (see the member ID definition above). Therefore, the membership vector output by the first comparator circuit in response to destination port = 3 is 0010|0100 = 0110.

[0099] The second comparison circuit 504 retrieves a synthesized retrieval vector, which includes the K2 input and the K2 membership vector output by the first comparison circuit. The second comparison circuit 504 includes a comparison column K2 514 storing comparison values ​​of K2 (e.g., the destination IP address field of the packet header), a K2-vector retrieval column 516 storing comparison values ​​of K2-vectors, and an action column 518 storing the desired packet action to be performed (e.g., by the packet processor) if a match is found in the corresponding rows of the K1 column 514 and the K2-vector column 516. (It should be noted that the second table preform is a simple function: it checks whether the vector is set in index = K2. In an implementation, TCAM can be used for this bit extraction and comparison. When the number of K2 values ​​is small, TCAM will include a smaller table.)

[0100] K2-vector comparison column 516 includes a one-hot representation of the member ID of the corresponding K2 value in the K2 comparison column, where unset elements are in the "not important" value. For example, in the upper comparison row, the destination IP address is 138.100.17.07, which is the first member of the K2 group; the corresponding K2 vector column is XXX1, where X represents "not important".

[0101] Compared with the ASC 300 implementation ( Figure 3 As in the previous example, ASC 500 can indicate only a single action type (forwarding); therefore, action column 518 is not needed—if a match exists in any comparison row, the second comparison circuit will indicate forwarding.

[0102] In this embodiment, the total number of retrieval units in the action selection circuit 500 for vector membership types is:

[0103] M*Mw+N*(Nw+N)

[0104] And the number of data units is: M*B

[0105] Where N is the number of K2 rules, Nw is the width of K2 entries (in bits), and M is the number of K1 rules.

[0106] It should be noted that the assignment of header fields to K1 and K2 is arbitrary. Other suitable assignments may be used in alternative embodiments.

[0107] Figure 5 The configuration of the action selection circuit 500 shown and described above is an example cited for clarity of concept only. Other configurations may be used in alternative embodiments. For example, in some embodiments, more than two header fields (e.g., K1 to K) are retrieved. n The first comparator circuit 502 outputs n-1 membership vectors, which are combined and then compared with the nth key K. n The circuits are cascaded to create a synthetic search keyword, which is then input to the nth comparison circuit.

[0108] Figure 6A This is a flowchart 600 schematically illustrating a method for comparing circuitry for an ASC of a programming vector membership type according to an embodiment of the present invention. The flowchart is generated by processor 110 ( Figure 1 The method includes programming a first comparison circuit and a second comparison circuit, each having comparison values ​​corresponding to a first header field and a second header field (in the current context, the first header field refers to the destination port, and the second header field refers to the destination IP address).

[0109] The flowchart begins with filling the first comparison column (Fill-First-Compare-Circuit-Compare-Column) 602, where the processor fills the first comparison column of the first comparison circuit with a list of comparison values ​​related to the header field value of the first header field.

[0110] Next, the processor enters the Fill-First-Compare-Circuit-Data-Column operation 604, in which the processor fills the data column of the first comparison circuit with the membership output vector, wherein each element of the output vector is set if ASC should apply an action to the group when the first header field matches the corresponding K1 member in the K1 comparison column 510 and the second header field matches the K2 member corresponding to the element position in the membership vector.

[0111] The processor then proceeds to operation 606, "Fill-Second-Compare-Circuit-First-Compare-Column," and populates the comparison column of the second comparison circuit with a list of comparison values ​​related to the header field values ​​of the second header field. Next, in operation 608, "Fill-Second-Compare-Circuit-Second-Compare-Column," the processor represents the second comparison column of the second comparison circuit with the one-hot member IDs of column K2, where unset elements of the one-hot vectors are in the "ignore" value. For example, if 138.110.17.07 is the first K2 member value, the corresponding one-hot vector is XXX1; if the third member value is 138.110.17.43, the vector is X1XX.

[0112] Finally, in the Fill-Second-Compare-Circuit-Data-Column operation 610, the processor fills the second comparison circuit's data column with the data to be applied to the packet (corresponding to the K1 and K2 values). In an embodiment, this action can be forward-only (or discard if no forwarding action is selected), and operation 610 can be skipped.

[0113] To ensure clarity, examples will be used. Figure 6A The configuration of flowchart 600, shown in the diagram and described above, is illustrated. In alternative embodiments, the order of operations may differ and / or some of the operations may be performed concurrently. In some embodiments, when adding a new rule or removing an existing rule, the ASC settings can be incrementally modified by modifying values ​​in different retrieval and data columns.

[0114] Figure 6B This is a schematic diagram of a flowchart 650 for determining a vector membership method for actions according to an embodiment of the present invention. This flowchart is based on ASC 106 (…). Figure 1 ) is executed, and includes retrieving data from two pre-set comparison circuits (e.g., according to...). Figure 6A (Flowchart 600).

[0115] The flowchart begins with Search First Compare Circuit operation 652, where ASC uses K1 (the content of the first header field) as the comparison key to retrieve the first comparison circuit. In some embodiments, the signature of the first header field is used as the comparison key.

[0116] Next, in the Get Output-Membership-Vector operation 654, ASC reads the membership vector, including the set bit for each K2 member, which will cause an action when it matches the corresponding K1 value.

[0117] Next, in the Generate Composite Search Vector operation 656, ASC concatenates the K2 membership vector with the content of K2—the second header field (or, in this embodiment, the signature of the second header field). Next, in the Search Second Compare Circuit operation 658, ASC uses the composite search vector to search the second comparison circuit. Finally, in the Get Action operation 669, ASC reads the action corresponding to the header field combination {K1, K2}.

[0118] exist Figure 6B The configuration of flowchart 650 shown and described above is an example configuration cited for clarity of concept. Other configurations may be used in alternative embodiments. For example, in some embodiments, additional header fields may be used in the first and second comparison circuits; in one embodiment, the ASC obtains the encoding of the action in operation 660 (e.g., "1" for transmission, "0" for discard). In other embodiments, the output of the second comparison circuit may be coupled to the outputs of other comparison circuits to generate the desired action, and in other embodiments, the output of the second comparison circuit may be used to generate another synthetic retrieval vector to access more comparison circuits.

[0119] Figure 7 A graph 700 schematically illustrates the total number of comparison bits required for the selection action according to an embodiment of the invention. This graph includes graphs 702 and 704, where graph 702 shows the number of comparison bits in an ASC with a membership specification vector type, and graph 704 indicates the number of comparison bits when the ASC is a membership vector type. In both graphs, the number of members in the smaller header field is 0.1% of the number of members in the larger header field. It can be seen that, according to the embodiment, when the larger header field (e.g., destination IP address) includes 100,000 members (therefore, the smaller one (e.g., destination port ID) includes 100,000 * 0.1% = 100 members), the total number of comparison bits in the first and second comparison circuits is 10,000,000 for vector membership and 20,000,000 for a membership rule vector ASC. These numbers should be compared to the 100 * 100,000 = 100,000,000 comparison bits required for a complete comparison of all combinations.

[0120] The configuration of network device 100, including rule table 200, membership vector rule type ASC 300, and membership vector type ASC 106 (including corresponding comparison circuits 302, 304, 502, 504, methods 400 and 600 for programming the comparison circuits, and methods 450 and 650 for determining actions based on header fields), is an example configuration, table, and method shown purely for conceptual clarity. Any other suitable configuration, table, and method may be used in alternative embodiments.

[0121] In various embodiments, the various action selection and / or group ID selection tasks described above can be performed by hardware, by software, or by a combination of hardware and software.

[0122] In various embodiments, different circuits of network device 100 (including various ASCII and various comparator circuits) can be implemented using suitable hardware such as one or more application-specific integrated circuits (ASICs) or field-programmable gate arrays (FPGAs) or a combination of ASICs and FPGAs.

[0123] Processor 110 and packet processor 108 typically include one or more general-purpose processors that are software-programmed to perform packet processing functions. The software may be downloaded to the processor electronically, for example, via a network, or it may be alternatively or additionally provided and / or stored on a non-transitory tangible medium, such as magnetic, optical, or electronic memory.

[0124] Therefore, it should be understood that the above embodiments are cited by way of example, and the invention is not limited to what is specifically shown and described above. Rather, the scope of the invention includes combinations and sub-combinations of the various features described above, as well as variations and modifications thereof that would occur to those skilled in the art upon reading the above description and which are not disclosed in the prior art. Documents incorporated herein by reference are considered part of this application, and the definitions in this specification should be considered only to the extent that any terms defined in these incorporated documents conflict with the express or implied definitions in this specification.

Claims

1. A network device, comprising: One or more ports for exchanging packets over a network, each packet including a packet header having at least a first header field and a second header field; Action selection circuit, used for: For a given group, a first search keyword is determined based on the first header field of the given group, and a second search keyword is determined based on the second header field of the given group; The first search keyword is compared with a first set of comparison values ​​corresponding to the first header field, and a multi-element vector is output in response to a match between the first search keyword and the first comparison value in the first set. A composite search keyword is generated by concatenating the second search keyword and the multi-element vector. as well as The synthesized search keyword is compared with a second set of comparison values, and an action indicator for applying to the given group is output in response to a match between the synthesized search keyword and a second comparison value in the second set. as well as A packet processor is configured to process the packet in response to the packet header, including applying an action to the given packet in response to an action indicator output by a comparator circuit. The second comparison value in the second group includes (i) a second value corresponding to the second header field, and (ii) a comparison vector corresponding to the multi-element vector.

2. The network device of claim 1, wherein the multi-element vector comprises a one-hot vector having a marker element, the position of which in the one-hot vector indicates the index of the first comparison value found in the first group that matches the first search keyword.

3. The network device of claim 2, wherein each comparison vector comprises: The combination of the second value corresponding to (i) and the first comparison value corresponding to (ii) guarantees the output of the "I don't care" value in one or more positions of the action indicator; as well as Unset values ​​in one or more other locations.

4. The network device according to claim 1, wherein the multi-element vector is defined such that: Set one or more elements of the multi-element vector to have an index corresponding to the index of the second comparison value in the second group that matches the second search keyword; and One or more elements of the multi-element vector that are not set have an index corresponding to the index in the second group that does not match the second search keyword.

5. The network device according to claim 4, wherein: The comparison values ​​in the second group include: (i) a second search keyword value, and (ii) a multi-element vector comparison value, wherein one or more elements at the position indicating the index of the first search keyword value are set, and elements at other positions are set to the "don't care" value.

6. The network device of claim 1, wherein at least one of the first comparison value and the second comparison value includes an "I don't care" value.

7. The network device according to claim 1, wherein the multi-element vector includes binary elements.

8. The network device according to claim 1, wherein the action selection circuit includes a tri-state content addressing memory (TCAM) for storing one or both of the first set of comparison values ​​and the second set of comparison values.

9. A method in a network device, the method comprising: Packets are exchanged over the network, each packet including a packet header having at least a first header field and a second header field; For a given group, a first search keyword is determined based on a first header field of the given group, and a second search keyword is determined based on a second header field of the given group; The first search keyword is compared with a first set of comparison values ​​corresponding to the first header field, and a multi-element vector corresponding to the first comparison value is output in response to the match between the first search keyword and the first comparison value in the first set. A composite search keyword is generated by concatenating the first search keyword and the multi-element vector. The synthesized search keyword is compared with a second set of comparison values, and an action indicator for applying to the given group is output in response to a match between the synthesized search keyword and a second comparison value in the second set. as well as Processing the packet in response to the packet header includes applying an action to the given packet in response to an action indicator output by a comparator circuit. The second comparison value in the second group includes (i) a second value corresponding to the second header field, and (ii) a comparison vector corresponding to the multi-element vector.

10. The method of claim 9, wherein the multi-element vector comprises a one-hot vector having a marker element whose position in the one-hot vector indicates the index of the second comparison value found in the second group to match the second search keyword.

11. The method of claim 10, wherein each comparison vector comprises: The combination of the second value corresponding to (i) and the first comparison value corresponding to (ii) guarantees the output of the "I don't care" value in one or more positions of the action indicator; as well as Unset values ​​in one or more other locations.

12. The method of claim 9, wherein the multi-element vector is defined such that: Set one or more elements of the multi-element vector to have an index corresponding to the index of the second comparison value in the second group that matches the second search keyword; and One or more elements of the multi-element vector that are not set have an index corresponding to the index in the second group that does not match the second search keyword.

13. The method according to claim 12, wherein: The comparison values ​​in the second group include: (i) a second search keyword value, and (ii) a multi-element vector comparison value, wherein one or more elements at the position indicating the index of the first search keyword value are set, and elements at other positions are set to the "don't care" value.

14. The method of claim 9, wherein at least one of the first comparison value and the second comparison value includes a "not concerned" value.

15. The method of claim 9, wherein the multi-element vector comprises binary elements.

16. The method of claim 9, wherein the method includes storing one or both of the first set of comparison values ​​and the second set of comparison values ​​in a tri-state content-addressable memory (TCAM).

17. A method for determining an action to be applied to a packet in a network device, the method comprising: For a given packet being processed in the network device, a first search keyword is determined based on a first header field of the given packet, and a second search keyword is determined based on a second header field of the given packet; The first search keyword is compared with the first set of comparison values ​​corresponding to the first header field, and a multi-element vector is output in response to the match; A composite search keyword is generated by concatenating the first search keyword and the multi-element vector. The synthesized search keyword is compared with a second set of comparison values, and an action indicator for applying to the given group is output in response to a match between the synthesized search keyword and a second comparison value in the second set. The second comparison value in the second group includes (i) a second value corresponding to the second header field, and (ii) a comparison vector corresponding to the multi-element vector.

Images