A high-speed Ethernet data filtering method and system based on FPGA

Abstract

This invention provides a high-speed Ethernet data filtering method and system based on FPGA. Through hardware acceleration, preprocessing is performed on data packets before they reach the processor, effectively reducing the processor's workload and improving overall system performance. It quickly identifies and discards packets that do not conform to the policy, improving processing efficiency, and is particularly suitable for data centers and server environments that need to handle large amounts of network traffic. It achieves efficient Ethernet packet filtering. This invention not only possesses the advantages of Xilinx 1G Ethernet subsystem IP built-in filters—simple to use and highly compatible with multiple systems—but also boasts performance advantages comparable to FF-Shark. Furthermore, it supports more filtering conditions and features frame integrity protection and VLAN compatibility.

Description

Technical Field

[0001] This invention belongs to the field of Ethernet data acquisition and processing technology, specifically relating to a high-speed Ethernet data filtering method and system based on FPGA. Background Technology

[0002] With the continuous development of network switch technology, network communication bandwidth and traffic are increasing significantly. In high-speed Ethernet environments (such as 40G and 100G), the performance of traditional embedded processors is insufficient to implement data filtering functions for 10 Gigabit or higher speed Ethernet interfaces. Achieving efficient data filtering is a major challenge for embedded systems. In high-speed network environments, traditional processor-based software-level network filtering methods face significant performance bottlenecks. Typically, this filtering mechanism involves the processor matching data packets received from the socket with preset filtering rules using software algorithms. This process not only involves data copying, increasing memory access latency, but also requires the processor to perform complex searches and processing for each packet, leading to significant CPU resource consumption. As network bandwidth continues to grow, from 10Gbps to 100Gbps, the requirements for data processing speed also increase. In this context, mainstream embedded processors, due to their limited computing power and memory bandwidth, are increasingly unable to effectively handle such massive amounts of network data. Therefore, the industry has begun to explore new solutions to reduce the processor's burden and improve the efficiency of network packet filtering. To solve this problem, the solution of using FPGAs as coprocessors to implement data filtering is gradually emerging. This FPGA-based network packet filtering solution achieves efficient data processing through hardware acceleration, significantly improving the overall system performance. As a programmable hardware logic device, the FPGA can customize packet parsing and filtering according to specific network protocols and filtering rules, greatly reducing the processor's workload and allowing it to focus on more complex tasks, thus improving the system's real-time response and processing efficiency. Filtered valid data packets are directly DMA (Direct Memory Access) to the processor's memory via the PCIe (Peripheral Component Interconnect Express) interface, avoiding CPU intervention and further reducing data transmission latency, thus improving the real-time performance of data processing. Simultaneously, the FPGA's parallel processing capabilities enable the simultaneous processing of data streams from multiple interfaces, enhancing the system's throughput and flexibility. Furthermore, the FPGA's stable operation, high data processing accuracy, and low power consumption make it ideal for applications with stringent requirements for real-time performance, stability, and energy efficiency, such as high-performance computing, network security, cloud computing, and the Internet of Things (IoT), providing strong technical support for real-time filtering of 10 Gigabit and higher network data using embedded and desktop processors.

[0003] Currently, there are two main popular FPGA-based Ethernet data filtering solutions: FFShark and the network packet filters built into the 1G Ethernet subsystem IP provided by Xilinx. FFShark, proposed at FCCM 2020, uses logic resources within the FPGA to build multiple simple processors dedicated to network data filtering for parallel filtering. It supports real-time filtering using arbitrary filtering conditions written in PCAP (Packet Capture, a file format for network packet capture and analysis) syntax, and can be used for full network analysis of 100G traffic. However, FFShark has a complex system architecture, consumes significant logic resources, and has low support for operating systems other than Linux. Furthermore, because multiple dedicated processors within FFShark need to work simultaneously, a data arbitration mechanism is required to distribute network packets, which may lead to disordered order of data packets received by the FPGA—an unacceptable consequence in certain application scenarios.

[0004] Xilinx's 1G Ethernet Subsystem IP built-in filter does not have the aforementioned shortcomings. Users can easily implement filtering by simply setting the filtering conditions in the corresponding registers of the IP. Its structure is simple, consumes fewer logical resources, and does not disrupt the order of network packets. However, its limitations are also obvious: it is only integrated into the 1G Ethernet Subsystem IP and cannot implement packet filtering in 10G and higher network environments. Furthermore, it can only set a maximum of 12 filtering conditions, which does not meet the needs of some specific scenarios.

[0005] Current FPGA-based network packet filtering methods still have the following problems:

[0006] (1) Incomplete data packets: In high-speed network environments of 40Gbps or 100Gbps, many FPGA-based network packet filtering solutions are designed for rates of only 1Gbps or 10Gbps and lack a mechanism to protect frame integrity. When faced with performance bottlenecks that lead to data overflow, incomplete data packets will be generated, which in turn will trigger backend software lag or crashes.

[0007] (2) Limited number of filtering conditions: Currently popular FPGA network packet filtering solutions support a limited number of filtering conditions and cannot dynamically adjust the number of filtering parameters according to specific project requirements, making it difficult to meet the needs of projects in certain specific environments. For example, Xilinx's 1G ethernet subsystem IP only supports 12 sets of filtering conditions in its built-in filtering function, which is insufficient in complex network environments.

[0008] (3) Lack of VLAN packet filtering support: Many open-source FPGA network packet filtering projects currently do not support VLAN (Virtual Local Area Network) packet filtering, especially the false filtering caused by VLAN packet field offsets. One solution is to use a method similar to the built-in filter in Xilinx's 1G Ethernet subsystem IP, which avoids false filtering by setting two filtering conditions (VLAN format and normal format) for a filter tuple. While effective, this method increases the number of filtering conditions, leading to resource waste.

[0009] (4) Insufficient compatibility: Most publicly available high-speed Ethernet filter solutions above 10Gbps have poor support for operating systems other than Linux, limiting their application in environments such as VxWorks, Windows, and Kylin. For example, FFshark only supports the pCap filtering command, which makes it very difficult to port to some real-time operating systems.

[0010] Combining the high-performance network environment adaptability of FF Shark with the ease of use and low resource consumption of Xilinx IP built-in filters, an Ethernet data filtering solution was designed and implemented, providing embedded systems with more efficient, flexible, and widely applicable filtering capabilities. The core idea of ​​this solution is to construct a network data filtering architecture within the FPGA that combines high performance with low resource consumption, while ensuring that the data packet order remains unchanged during the filtering process. This meets the real-time data filtering requirements in high-performance network environments while reducing the complexity and barrier to entry for the solution.

[0011] First, the filter should optimize the utilization efficiency of logic resources in FF Shark, reducing its consumption of FPGA resources. Simultaneously, it should simplify the system architecture and improve support for multiple operating systems to enhance the versatility and portability of the solution. This can be achieved by refactoring the FF Shark filtering engine, employing more efficient hardware design and data processing algorithms, such as reducing unnecessary data arbitration mechanisms and optimizing data flow control and scheduling strategies, to achieve accurate and fast filtering of network packets without affecting the original order of the data packets.

[0012] Secondly, the solution should have scalable filtering condition settings to adapt to the needs of different scenarios. This can be achieved by designing a dynamically configurable filtering rule engine within the FPGA, allowing users to set multiple sets of filtering conditions according to actual applications. Simultaneously, this filtering engine should be able to exchange data efficiently with external processors via high-speed interfaces (such as PCIe), ensuring that filtered, valid data is transmitted to the processor in a timely manner for processing by upper-layer applications.

[0013] Finally, the filter should possess good compatibility and adaptability, capable of stable operation in network environments ranging from 1G to 100G and above, providing consistent data filtering services for embedded systems. This requires that the design fully consider the scalability of network bandwidth and adopt a modular and flexible architecture to adapt to future developments and changes in network technologies. Summary of the Invention

[0014] The technical problem to be solved by the present invention is to provide a high-speed Ethernet data filtering method and system based on FPGA for efficient filtering of Ethernet packets.

[0015] The technical solution adopted by this invention to solve the above-mentioned technical problems is as follows: a high-speed Ethernet data filtering method based on FPGA, comprising the following steps:

[0016] S1: Obtain the network data to be filtered and the filtering conditions;

[0017] S2: Based on internal control signals and valid bus signals, discard current data when backend buffer space is insufficient, and perform frame integrity protection for network data;

[0018] S3: Perform bit-width conversion on the data after frame integrity protection;

[0019] S4: Parse network packets to extract key information, retain matching information and discard unmatched information by comparing and filtering conditions;

[0020] S5: Select to retain or discard data frames based on the filtering conditions, and correctly process messages that meet or do not meet the conditions.

[0021] S6: Output the filtered data.

[0022] According to the above scheme, the specific steps in step S2 are as follows:

[0023] The valid signals of the bus include valid input signals and valid output signals. The valid input signals of the bus are ANDed with the internal control signals to obtain the valid output signals of the bus, which are used to control the flow of data. By controlling the internal control signals, the current data is discarded when the back-end buffer space is insufficient to prevent system overload or data loss.

[0024] Furthermore, in step S2, the data volume signal of the backend data is monitored to calculate whether the backend has enough space to buffer an entire frame of network data; if the buffer space is sufficient, the internal control signal is pulled high to receive the next frame of network data; if the buffer space is insufficient, the internal control signal is pulled low to not receive new data frames.

[0025] When receiving the last frame of data, the input end signal and input valid signal are simultaneously pulled high, and the internal control signals are updated to ensure that the network data is received in whole frames or discarded.

[0026] According to the above scheme, the specific steps for controlling the internal control signal in step S3 are as follows:

[0027] Bit width conversion enables data streams of different widths to be compatible with each other; when data is converted from a narrower width to a wider width, the low bits of the data are copied to fill the high bits according to the configuration, or a user-defined value is inserted into the high bits; when data is converted from a wider width to a narrower width, the high or low bits of the data are selected for output according to the configuration.

[0028] Insert or delete empty spaces in the output data according to the configuration to ensure that the converted data is correctly aligned with the interface.

[0029] The parameters for bit-width conversion include input and output data width, conversion direction, data alignment, and the value of inserted or deleted empty bits.

[0030] According to the above scheme, the specific steps in step S4 are as follows:

[0031] Frame boundaries are identified by monitoring the valid and ready signals of the bus, and the position of each field in the message is determined.

[0032] The system parses the input network packets field by field, extracts and stores information including MAC address, IP address, frame type and port number; and caches the parsed data information in registers.

[0033] When the bus end signal goes high, the frame ends, and the parsed information is compared with the filtering conditions preset in the control register.

[0034] When the current frame is terminated, the comparison results are summarized. If the comparison results are a match, the message is retained and a retention instruction is generated and stored in the discard flag for subsequent processing. If the comparison results are not a match, a discard instruction is generated and stored in the discard flag to ensure that invalid or non-compliant messages are not processed further.

[0035] Furthermore, in step S4, filtering rules are received and stored, expected values ​​of Ethernet frame fields are processed, and filtering conditions are flexibly set through field matching enable switches; in complex filtering scenarios, the number of filtering conditions is matched with data frame information through parameterized configuration.

[0036] Furthermore, in step S4, VLAN packets are identified by checking VLAN-specific flags, the VLAN detection signal is raised, and the data of each field is shifted 4 bytes backward during the subsequent parsing of the current frame to avoid false filtering of valid data frames.

[0037] According to the above scheme, in step S5, a state machine is set to select whether to retain or discard data frames, ensuring that messages that do not meet the conditions are processed correctly; the specific steps are as follows:

[0038] When the state machine is in an idle state, it continuously monitors the empty or full state of the front-end drop flag buffer. When the drop flag is detected to be non-empty, it indicates that at least one frame of Ethernet data has been received and stored in the data buffer. At this time, a drop flag data is immediately read from the drop flag buffer and it is determined whether the first frame in the current data buffer is a frame that needs to be dropped. Based on the drop flag information, it jumps to different states to realize the function of data drop or retransmission.

[0039] If the current frame needs to be retained, the state machine jumps to the pass-through state, connecting the bus input ready signal and the output valid signal together to realize the backward pass-through transmission of data;

[0040] If the current frame needs to be discarded, the bus input preparation signal is pulled high and the output valid signal is pulled low. The Ethernet data in the data buffer is continuously read out and not written to the subsequent processing module. When the bus input end signal and valid signal are pulled high at the same time, indicating that all the Ethernet frames currently being transmitted have been discarded, the state machine immediately jumps back to the idle state using combinational logic to avoid the data of the next frame being discarded in advance.

[0041] Then, in the idle state machine, the status of the discard flag buffer is checked and the previous process is repeated; the function of discarding messages that do not meet the filtering conditions is continuously implemented.

[0042] A high-speed Ethernet data filtering system based on FPGA.

[0043] The data acquisition submodule is used to acquire the network data to be filtered and the filtering conditions;

[0044] The frame integrity protection submodule is used to discard the current data when the backend buffer space is insufficient, based on internal control signals and valid signals of the bus, and to protect the frame integrity of network data.

[0045] The bit-width conversion submodule is used to convert the bit-width of the data after frame integrity protection.

[0046] The data frame parsing submodule is used to parse network packets to extract key information, retain matching information and discard unmatched information by comparing and filtering conditions.

[0047] The data discarding submodule is used to select whether to keep or discard data frames based on filtering conditions, and to correctly process messages that meet or do not meet the conditions.

[0048] The data output submodule is used to output the filtered data.

[0049] A computer memory storing a computer program executable by a computer processor, the computer program executing a high-speed Ethernet data filtering method based on an FPGA.

[0050] The beneficial effects of this invention are as follows:

[0051] 1. This invention discloses a high-speed Ethernet data filtering method and system based on FPGA. Through hardware acceleration, preprocessing is performed on data packets before they reach the processor, effectively reducing the processor's burden and improving the overall system performance. It quickly identifies and discards packets that do not conform to the policy, improving processing efficiency. It is particularly suitable for data centers and server environments that need to handle large amounts of network traffic, and achieves efficient filtering of Ethernet packets. This invention not only possesses the advantages of Xilinx 1GEthernet subsystem IP built-in filters—simple to use and highly supportive of multiple systems—but also boasts performance advantages comparable to FF-Shark. Furthermore, it supports more filtering conditions and features frame integrity protection and VLAN compatibility.

[0052] 2. This invention features a highly configurable and flexible architecture, specifically optimized for VLAN packets. Filtering rules can be flexibly configured on the FPGA, adapting to constantly changing network environments and ensuring accurate data filtering and management in various network conditions.

[0053] 3. Under the default 4-channel 10Gb fiber optic transmission, the filtering performance of this invention can reach 4096MB / s. After modifying the data bit width by the bit width conversion module, it can support real-time filtering of 100Gb Ethernet packets, which improves the data filtering performance and reaches a high level in the industry.

[0054] 4. The design of this invention in the data frame parsing stage supports parameterized configuration of more data comparison modules to support more filtering conditions. Compared to FF-Shark's microprocessor-based comparison method, the comparator structure of this invention is simpler and can support more filtering conditions while consuming the same amount of logic resources. Compared to the built-in filtering function of Xilinx's 1GEthernet subsystem IP, which only supports a maximum of 12 sets of filtering conditions, this invention does not limit the number of filtering conditions as long as logic resources allow.

[0055] 5. This invention includes a data frame integrity protection design, ensuring that the Ethernet data transmitted to subsequent stages remains intact even in the event of data overflow due to excessive data traffic. Compared to other solutions, this invention improves the stability of the filter in high-speed network environments.

[0056] 6. To ensure proper operation in network environments where VLAN packets and regular network packets coexist, this invention incorporates a VLAN packet compatibility design in the data comparison module during data frame parsing. In network environments containing VLAN packets, this invention reduces filtering condition settings by half compared to the filters provided in Xilinx 1G Ethernet subsystem IP.

[0057] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a flowchart of an embodiment of the present invention.

[0060] Figure 2 This is a flowchart of the module operation of an embodiment of the present invention.

[0061] Figure 3 This is a flowchart of the data frame parsing process according to an embodiment of the present invention.

[0062] Figure 4 This is a diagram showing the connection relationship between the top layer and the outside in an embodiment of the present invention.

[0063] Figure 5 This is a timing diagram of the applicable AXI stream bus in an embodiment of the present invention. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0065] Example 1

[0066] See Figure 1 The specific steps of a high-speed Ethernet data filtering method based on FPGA are as follows:

[0067] S1: Obtain the network data to be filtered and the data filtering conditions;

[0068] S2: Based on the control signal and the bus valid flag signal, discard the current data when the backend buffer space is insufficient, and protect the network data for frame integrity.

[0069] In implementing packet filtering using FPGA, network frames need to be parsed, thus requiring the corresponding network data to be cached. When the cache is full and data overflows, frame integrity protection is needed for Ethernet frames to ensure data integrity and prevent backend program crashes. To address this issue, this embodiment uses frame integrity protection to ensure that all received network data frames are pre-processed by this module before entering subsequent processing flows, thereby effectively protecting data integrity.

[0070] The frame integrity protection module monitors the usedWord (data volume) signal of the backend data FIFO (First In First Out), which provides information about the amount of data currently stored in the FIFO. Based on this information, the module calculates whether the backend data FIFO has enough space to buffer an entire frame of network data. If the FIFO has sufficient space, the module pulls its internal gate (control signal) high, indicating that the system can receive the next frame of network data. Conversely, if the buffer space is insufficient, the gate signal is pulled low, meaning the system cannot currently receive new data frames. To ensure data processing consistency and integrity, the frame integrity protection module uses the valid (valid flag) signal of the AXI Stream bus to control data flow. In the frame integrity protection module, the output valid signal is obtained by performing a logical AND operation between the input AXI Stream bus valid signal and the gate signal. This allows the module to discard current data at appropriate times when the backend buffer space is insufficient, preventing system overload or data loss by controlling the gate signal.

[0071] To ensure that network data is received or discarded frame by frame, the timing of the gate signal update in the frame integrity protection module requires special attention. The gate signal is only allowed to be updated during the last frame of data reception, specifically when the `last` (end flag) signal and the `valid` signal of the input module's AXI Stream signal are simultaneously pulled high. This design ensures that even with insufficient buffer space, data frames are processed in their entirety, preventing partial reception or discarding, thus guaranteeing data integrity and network communication reliability.

[0072] The frame integrity protection module ensures the system's stability and data integrity when dealing with high data volumes.

[0073] S3: Perform bit-width conversion on the data after frame integrity protection;

[0074] The primary function of the bit-width conversion module is to ensure compatibility between data streams of different widths. This invention primarily utilizes the AXI Stream Data Width Converter IP core from the Xilinx Vivado Design Suite. When data is converted from a narrower width to a wider width, the IP core copies the low-order bits of the data to fill the high-order bits, or inserts user-defined values ​​into the high-order bits, depending on the configuration. Conversely, when data is converted from a wider width to a narrower width, the IP core selects either the high-order or low-order bits for output, depending on the configuration. To ensure the converted data is correctly aligned with the AXI Stream interface, the IP core performs data alignment operations according to the configuration. This includes inserting or deleting empty bits in the output data to achieve proper alignment.

[0075] The bit-width conversion module allows for detailed parameter settings in the IP parameter configuration interface, including input and output data width, conversion direction (wide to narrow or narrow to wide), data alignment, and the insertion or deletion of empty bits. These configuration options enable the data filtering system to adapt to various application scenarios.

[0076] S4: Extracts key information by parsing network packets, compares it with filtering conditions, retains matching information, and discards unmatched information; in complex filtering scenarios, it parameterizes filtering conditions and matches data frame information; it also avoids false filtering of valid data frames by identifying VLAN packets.

[0077] The main function of the data frame parsing module is to support parameterized configuration of filtering conditions, accurately match data frame information, and identify VLAN packets to prevent data from being mistakenly filtered. The data parsing module comprises four sub-modules: a data comparison module, a result aggregation module, a filtering condition setting module, and a VLAN packet processing module.

[0078] The data comparison module is the core of the entire network data filtering system. Each data comparison module receives network packets input from the AXIStream bus and parses them field by field, accurately extracting and storing all key information from MAC address and IP address to frame type and port number. To ensure processing accuracy and real-time performance, the data comparison module identifies frame boundaries by monitoring the valid and ready signals of the AXIStream bus, thereby accurately determining the position of each field in the packet. The parsed data information is cached in registers. When a frame ends, i.e., when the last signal of the AXIStream bus goes high, the data comparison module compares the parsed information with the filtering conditions preset in the control register by the user.

[0079] When the current frame ends transmission, the results from each data comparison module are aggregated in the result synthesis module. If any comparator finds a match, the result synthesis module generates a retain instruction, instructing the system to retain the message, and stores this instruction information in the discard flag FIFO for later processing. Conversely, if no match is found by any comparator, the message is marked as to be discarded, and this status is also recorded in the discard flag FIFO, ensuring that invalid or non-compliant messages are not further processed, thereby improving the overall efficiency of the system.

[0080] The design specifically considers VLAN packet processing, a scenario often overlooked by many traditional filters. VLAN packets insert a 4-byte identifier after the source MAC address, which causes subsequent fields to shift, further leading to the incorrect filtering of some valid data frames in a VLAN environment. To solve this problem, this invention designs a VLAN packet processing module that checks whether bytes 13-15 (excluding the preamble) contain the VLAN-specific 0x8100 flag during frame parsing. Once a VLAN packet is identified, the VLan_detect (VLAN detection) register signal within the module is pulled high. During subsequent parsing of the current frame, the data offset of each field will be shifted 4 bytes backward, ensuring the correct parsing of all information.

[0081] The filtering condition setting module is responsible for receiving and storing filtering rules, using the APB bus as the control bus to ensure flexible rule settings and efficient communication between modules. This module can not only handle the expected values ​​of various Ethernet frame fields, but also supports field matching enable / disable switches, making the setting of filtering conditions flexible and diverse. Furthermore, the design supports parameterized comparator number configuration, allowing users to adjust the number of comparators according to specific needs, thereby supporting more complex filtering scenarios. Each comparator can match the parsed network frame information with the expected fields sent by the host computer, meaning that one comparator corresponds to the support of one filtering condition. This embodiment does not limit the number of comparators; theoretically, an unlimited number of filtering conditions can be supported as long as FPGA resources allow, greatly improving the system's adaptability and scalability.

[0082] S5: By selecting to retain or discard data frames, we can ensure that messages that meet or do not meet the conditions are processed correctly.

[0083] The data discard module primarily selects whether to retain or discard data frames, ensuring that ineligible packets are processed correctly. This embodiment uses a state machine to implement this function. When in the IDLE state, it continuously checks the empty / full state of the front-end discard flag FIFO. When the data discard module detects that the discard flag FIFO is not empty, it indicates that at least one frame of Ethernet data has been received and stored in the data FIFO. At this time, the data discard module immediately reads a discard flag from the discard flag FIFO and determines whether the first frame in the current data FIFO is a frame that needs to be discarded. Based on the discard flag information, it jumps to different states to achieve the function of discarding or forwarding data. If the current frame needs to be retained, it jumps to the BYPASS state, connecting the AXI stream bus ready signal of the input data discard module and the AXI stream bus valid signal of the output data discard module together to achieve forward data transmission. If the current frame needs to be discarded, the ready signal of the AXI stream bus of the input data discarding module is pulled high, and the valid signal of the AXI stream bus of the output data discarding module is pulled low. During this time, Ethernet data in the data FIFO will be continuously read out but not written to the subsequent processing module. Until the last and valid signals of the input AXI stream bus are simultaneously pulled high, indicating that all currently transmitted Ethernet frames have been discarded, the state machine immediately jumps back to the IDLE state using combinational logic to prevent the next frame's data from being prematurely discarded. Subsequently, the state machine in the IDLE state will continue to check the state of the discard flag FIFO and repeat the previous process, thus continuously implementing the function of discarding packets that do not meet the filtering conditions.

[0084] This embodiment uses hardware acceleration to preprocess data packets before they reach the processor, effectively reducing the processor's burden and improving the overall system performance. It quickly identifies and discards packets that do not conform to the policy, improving processing efficiency. It is particularly suitable for data centers and server environments that need to handle large amounts of network traffic. It also achieves the function of efficiently filtering Ethernet packets.

[0085] Example 2

[0086] This embodiment is used to construct a high-speed Ethernet data filtering system based on FPGA by implementing the principles of the above method embodiments, such as... Figure 4 As shown, the FPGA top-level module in this embodiment includes three ports: AXI stream format data input and output ports, and APB format register control ports. These ports are designed to achieve signal synchronization with external networks and back-end data processing units.

[0087] (1) Connection between the AXI stream input port and the Ethernet MAC module

[0088] In this design, the primary purpose of the AXI stream input port is to receive network data streams from the system front-end. To achieve this, this input port should be connected to an Ethernet MAC module (such as Xilinx's 10GEthernet subsystem IP) within the FPGA. If the MAC module uses a different data format interface, the network data stream format needs to be converted to AXI stream format before connecting it to the data input interface of this design. The AXI stream format data stream should contain, for example,... Figure 5 The key signals shown are: Valid, Ready, Data, Keep, and last. The Valid signal indicates the validity of the data; the Ready signal confirms the data receiver's readiness to receive data; the Data signal carries the actual data; the Keep signal controls the data bits; and the last signal marks the end of a data frame.

[0089] (2) Connection between the AXI stream output port and the back-end data processing module

[0090] The data processed by the filtering system needs to be transmitted to the FPGA's back-end data processing module or DMA module via the AXI stream output port. The back-end data processing module can be a further data analysis unit, while the DMA module is responsible for writing the data directly into system memory for subsequent processing by the CPU or other processors. The output port design also follows the AXI stream standard to ensure interface compatibility with the back-end module and data transmission efficiency.

[0091] (3) Register control port (APB format)

[0092] In addition to data input and output ports, the top-level module also includes an APB-formatted register control port. This port is primarily used to receive configuration information and control commands from the CPU, such as filter parameter settings and operating mode switching. Through this port, the CPU can monitor and adjust the filtering system in real time to adapt to changes in the network environment.

[0093] This embodiment features a highly configurable and flexible architecture, specifically optimized for VLAN packets. Filtering rules can be flexibly configured on the FPGA, adapting to constantly changing network environments and ensuring accurate data filtering and management in various network conditions.

[0094] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0095] Example 3

[0096] The steps in this embodiment are the same as in Embodiment 1, except that each step is applied to Embodiment 2. After the filtering system in this embodiment is connected to the FPGA network data interface and DMA data interface, it proceeds according to... Figure 2 The filtering process begins with the following steps:

[0097] (1) The software transmits the filtering condition information to the filtering condition setting module in advance through the corresponding drive control APB bus of this design. The filtering condition information is then transmitted to the data comparison module after being cached in the register.

[0098] (2) The user opens the data receiving function of the network MAC module through the host computer software. After the data is preprocessed by the frame integrity protection module and the bit width conversion module, it is transmitted to the data comparison module to start data parsing and comparison.

[0099] (3) See Figure 3 During Ethernet frame parsing, the data parsing module parses the data packets received from the bit-width conversion module, extracting the packet's IP address, MAC address, port number, and frame type information. This information is then matched against the filtering conditions provided by the register setting module. If a match is found, a data retention flag (default 1) is generated; otherwise, a data discard flag (default 0) is generated.

[0100] (4) After parsing is complete, the data comparison module will capture the network data and transmit it to the backend data FIFO. After a frame of network data is completely stored in the data FIFO, the module will store the corresponding flag information of the frame in the backend flag FIFO, indicating that a complete frame of Ethernet data has been stored in the data FIFO, and whether the data frame should be discarded can be extracted from the discard flag FIFO. Then the data comparison module will jump back to the IDLE state and wait for the next frame of network data to arrive.

[0101] (5) While the data comparison module is working, the data discarding module will continuously detect the empty or full state of the flag FIFO. When the flag FIFO is detected to be non-empty, the data discarding module will extract one frame of flag information, then extract one frame of data from the data FIFO, and perform a follow-up transmission or discard operation on the extracted data frame according to the obtained flag information, thereby realizing the data filtering function.

[0102] (6) After the data is filtered, it is output from the data discard module to the subsequent data processing module or DMA module through the AXI stream interface. Then the processor can directly receive the filtered data without the processor having to perform any further filtering on the data.

[0103] It should be noted that, depending on the implementation needs, the various steps / components described in this application can be broken down into more steps / components, or two or more steps / components or parts of the operation of steps / components can be combined into new steps / components to achieve the purpose of this invention.

[0104] This embodiment also includes a processor, a communication interface, a memory, and a communication bus; wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory stores a computer program, and when the program is executed by the processor, the processor performs the steps of a high-speed Ethernet data filtering method based on FPGA.

[0105] This embodiment also provides a computer-readable storage medium storing executable instructions that, when executed by a processor, enable the processor to implement a high-speed Ethernet data filtering method based on an FPGA.

[0106] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects.

[0107] Furthermore, this application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0108] This application is described with reference to the flowchart of the method and computer program product according to Embodiment 1 and the block diagram of the device (system) according to Embodiment 3. It should be understood that each step or block in the flowchart or block diagram, as well as combinations of steps or blocks in the flowchart or block diagram, can be implemented by computer program instructions.

[0109] These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which are executable by the processor of the computer or other programmable data processing device, produce instructions for implementing the process. Figure 1 One or more processes or boxes Figure 1 A high-speed Ethernet data filtering system based on FPGA that specifies functions in one or more boxes.

[0110] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes or boxes Figure 1 The function specified in one or more boxes.

[0111] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes or boxes Figure 1 The steps of a high-speed Ethernet data filtering method based on FPGA are specified in one or more boxes.

[0112] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A high-speed Ethernet data filtering method based on FPGA, characterized in that: Includes the following steps: S1: Obtain the network data to be filtered and the filtering conditions; S2: Based on internal control signals and valid bus signals, discard current data when backend buffer space is insufficient, and perform frame integrity protection for network data; S3: Perform bit-width conversion on the data after frame integrity protection; specifically: Bit width conversion enables data streams of different widths to be compatible with each other; when data is converted from a narrower width to a wider width, the low bits of the data are copied to fill the high bits according to the configuration, or a user-defined value is inserted into the high bits; when data is converted from a wider width to a narrower width, the high or low bits of the data are selected for output according to the configuration. Insert or delete empty spaces in the output data according to the configuration to ensure that the converted data is correctly aligned with the interface. The parameters for bit-width conversion include input and output data width, conversion direction, data alignment, and the value of inserted or deleted empty bits; S4: Parse network packets to extract key information, and retain matching information while discarding unmatched information by comparing and filtering conditions; specifically: Frame boundaries are identified by monitoring the valid and ready signals of the bus, and the position of each field in the message is determined. The system parses the input network packets field by field, extracts and stores information including MAC address, IP address, frame type and port number; and caches the parsed data information in registers. When the bus end signal goes high, the frame ends, and the parsed information is compared with the filtering conditions preset in the control register. When the current frame is terminated, the comparison results are summarized. If the comparison results are a match, the message is retained and a retention instruction is generated and stored in the discard flag for subsequent processing. If the comparison results are not a match, a discard instruction is generated and stored in the discard flag to ensure that invalid or non-compliant messages are not processed further. S5: Select to retain or discard data frames based on the filtering conditions, and correctly process messages that meet or do not meet the conditions. S6: Output the filtered data.

2. The high-speed Ethernet data filtering method based on FPGA according to claim 1, characterized in that: The specific steps in step S2 are as follows: The valid signals of the bus include valid input signals and valid output signals. The valid input signals of the bus are ANDed with the internal control signals to obtain the valid output signals of the bus, which are used to control the flow of data. By controlling the internal control signals, the current data is discarded when the back-end buffer space is insufficient to prevent system overload or data loss.

3. The high-speed Ethernet data filtering method based on FPGA according to claim 2, characterized in that: In step S2, the data volume signal of the backend data is monitored to calculate whether the backend has enough space to buffer an entire frame of network data; if the buffer space is sufficient, the internal control signal is pulled high to receive the next frame of network data; if the buffer space is insufficient, the internal control signal is pulled low to prevent the reception of new data frames. When receiving the last frame of data, the input end signal and input valid signal are simultaneously pulled high, and the internal control signals are updated to ensure that the network data is received or discarded in whole frames.

4. The high-speed Ethernet data filtering method based on FPGA according to claim 1, characterized in that: In step S4, filtering rules are received and stored, expected values ​​of Ethernet frame fields are processed, and filtering conditions are flexibly set through field matching enable switches. In complex filtering scenarios, the number of filtering conditions is matched to the data frame information by parameterizing the configuration.

5. The high-speed Ethernet data filtering method based on FPGA according to claim 1, characterized in that: In step S4, VLAN packets are identified by checking VLAN-specific flags, the VLAN detection signal is raised, and the data of each field is shifted 4 bytes backward during the parsing of the current frame to avoid false filtering of valid data frames.

6. The high-speed Ethernet data filtering method based on FPGA according to claim 1, characterized in that: In step S5, a state machine is set to select whether to retain or discard data frames, ensuring that messages that do not meet the conditions are processed correctly; the specific steps are as follows: When the state machine is in an idle state, it continuously monitors the empty or full state of the front-end drop flag buffer; when the drop flag is detected to be non-empty, it indicates that at least one frame of Ethernet data has been received and stored in the data buffer. At this point, a discard flag data is immediately read from the discard flag buffer and it is determined whether the first frame in the current data buffer is a frame that needs to be discarded. Based on the discard flag information, the system jumps to different states to achieve the function of discarding or transmitting data. If the current frame needs to be retained, the state machine jumps to the pass-through state, connecting the bus input ready signal and the output valid signal together to realize the backward pass-through transmission of data; If the current frame needs to be discarded, the bus input preparation signal is pulled high and the output valid signal is pulled low. The Ethernet data in the data buffer is continuously read out and not written to the subsequent processing module. When the bus input end signal and valid signal are pulled high at the same time, indicating that all the Ethernet frames currently being transmitted have been discarded, the state machine immediately jumps back to the idle state using combinational logic to avoid the data of the next frame being discarded in advance. Then, in the idle state machine, the status of the discard flag buffer is checked and the previous process is repeated; the function of discarding messages that do not meet the filtering conditions is continuously implemented.

7. A high-speed Ethernet data filtering system based on FPGA, characterized in that: The data acquisition submodule is used to acquire the network data to be filtered and the filtering conditions; The frame integrity protection submodule is used to discard the current data when the backend buffer space is insufficient, based on internal control signals and valid signals of the bus, and to protect the frame integrity of network data. The bit-width conversion submodule is used to perform bit-width conversion on the data after frame integrity protection; specifically: Bit width conversion enables data streams of different widths to be compatible with each other; when data is converted from a narrower width to a wider width, the low bits of the data are copied to fill the high bits according to the configuration, or a user-defined value is inserted into the high bits; when data is converted from a wider width to a narrower width, the high or low bits of the data are selected for output according to the configuration. Insert or delete empty spaces in the output data according to the configuration to ensure that the converted data is correctly aligned with the interface. The parameters for bit-width conversion include input and output data width, conversion direction, data alignment, and the value of inserted or deleted empty bits; The data frame parsing submodule is used to parse network packets to extract key information, retain matching information and discard unmatched information by comparing and filtering conditions. Specifically: Frame boundaries are identified by monitoring the valid and ready signals of the bus, and the position of each field in the message is determined. The system parses the input network packets field by field, extracts and stores information including MAC address, IP address, frame type and port number; and caches the parsed data information in registers. When the bus end signal goes high, the frame ends, and the parsed information is compared with the filtering conditions preset in the control register. When the current frame is terminated, the comparison results are summarized. If the comparison results are a match, the message is retained and a retention instruction is generated and stored in the discard flag for subsequent processing. If the comparison results are not a match, a discard instruction is generated and stored in the discard flag to ensure that invalid or non-compliant messages are not processed further. The data discarding submodule is used to select whether to keep or discard data frames based on filtering conditions, and to correctly process messages that meet or do not meet the conditions. The data output submodule is used to output the filtered data.

8. A computer memory, characterized in that: It contains a computer program that can be executed by a computer processor, which performs a high-speed Ethernet data filtering method based on FPGA as described in any one of claims 1 to 6.

Images