Flow table management method and related apparatus

Abstract

The application discloses a flow table management method and related device to reduce hotspot rule frequent replacement and improve on-chip flow table hit rate. The method comprises: in response to a packet matching request, querying an on-chip flow table and an off-chip flow table in turn based on a to-be-processed packet in the packet matching request to obtain a query result; in the case that the query result represents that the to-be-processed packet does not hit the on-chip flow table and hits the off-chip flow table, obtaining a rule identifier of the hit off-chip flow table rule; querying a swap-in permission table according to the rule identifier, and when a swap-in permission item corresponding to the rule identifier is hit, determining the off-chip flow table rule as a candidate flow table rule; in the case that a swap-in position of the candidate flow table rule in the on-chip flow table already exists a resident flow table rule, if a swap-out protection score of the resident flow table rule meets a preset swap-out condition, swapping the candidate flow table rule into the on-chip flow table; if the preset swap-out condition is not met, keeping the resident flow table rule in the on-chip flow table.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to flow table management methods and related devices. Background Technology

[0002] Currently, network processing devices such as smart network interface cards (NICs) and data processing units (DPUs) typically process packets according to preset flow table rules. In order to balance rule storage capacity and packet lookup latency under massive flow table rules, it is usually necessary to store all rules in off-chip storage area and cache frequently accessed hot rules in on-chip high-speed storage, thereby improving the rule matching efficiency of high-frequency traffic by utilizing limited on-chip resources.

[0003] In related technologies, the hierarchical flow table design typically prioritizes searching the on-chip hotspot flow table. If no hotspot flow table rule is found on-chip, it continues to search the full flow table outside the chip. Based on the hit rate of the full flow table outside the chip, the hotspot rule to be swapped into the on-chip is determined. Therefore, short-term bursts of traffic or noisy traffic outside the chip may be identified as hotspot rules to be swapped into the on-chip, which will cause these flow table rules to be frequently swapped in and out between the on-chip and off-chip, resulting in flow table buffer jitter, reducing the on-chip flow table hit rate and the packet processing stability of network processing devices. Summary of the Invention

[0004] In view of the above problems, this application provides a flow table management method and related apparatus to reduce the probability of frequent rule swapping caused by short-term burst traffic or noisy traffic, thereby improving the on-chip flow table hit rate and the packet processing stability of network processing equipment. The specific solution is as follows:

[0005] The first aspect of this application provides a flow table management method applied to a network processing device, the network processing device including a swap-in permission table and off-chip flow tables and on-chip flow tables configured for the same flow table template, the method comprising:

[0006] In response to a packet matching request, the on-chip flow table and the off-chip flow table are queried sequentially based on the unprocessed packets in the packet matching request to obtain the query results;

[0007] If the query result indicates that the message to be processed does not match the intra-chip flow table but matches the extra-chip flow table, obtain the rule identifier of the matching extra-chip flow table rule;

[0008] The swap-in permission table is queried according to the rule identifier, and when a swap-in permission item corresponding to the rule identifier is matched, the off-chip flow table rule is determined as a candidate flow table rule.

[0009] If a resident flow table rule already exists at the swap-in position of the candidate flow table rule in the intra-chip flow table, and the swap-out protection score of the resident flow table rule meets the preset swap-out condition, then the candidate flow table rule is swapped into the intra-chip flow table.

[0010] If the swap protection score of the resident flow table rule does not meet the preset swap condition, then the resident flow table rule remains in the intra-chip flow table.

[0011] Optionally, the network processing device further includes a swap-in entry ring, wherein the swap-in license entries in the swap-in license table are generated in the following ways:

[0012] When the message to be processed hits the external flow table, the hit event of the external flow table rule is sampled according to the preset sampling strategy, and when the hit event meets the sampling conditions, the hit information including the rule identifier of the external flow table rule is written into the swap-in table entry ring.

[0013] According to the preset statistical period, read multiple hit information in the swapped-in table entry ring, and according to the rule identifier in each hit information, aggregate and statistically analyze the hit information in the preset statistical window to obtain the rule popularity corresponding to each outflow table rule.

[0014] Based on the rule popularity, hot spot flow table rules are determined from multiple off-chip flow table rules, swap-in license items corresponding to the rule identifiers of the hot spot flow table rules are generated, and the swap-in license items are written into the swap-in license table.

[0015] Optionally, the swap-in license item includes a license protection score; writing the swap-in license item into the swap-in license table includes:

[0016] Determine the license write location of the swap-in license item in the swap-in license table;

[0017] If the license write location is empty, the swap-in license item is written to the license write location, and the license protection score of the swap-in license item is set to the first initial score;

[0018] If an original swapped-in license item already exists at the license write location, and if the license protection score of the original swapped-in license item meets the preset license retention conditions, then the original swapped-in license item is retained, and the license protection score of the original swapped-in license item is reduced.

[0019] If the license protection score of the original replacement license does not meet the preset license retention conditions, then the original replacement license is replaced by the replacement license, and the license protection score of the replacement license is set to the first initial score.

[0020] Optionally, the method further includes:

[0021] If the same outflow table rule is identified as the hotspot flow table rule in multiple consecutive preset statistical windows, the license protection score of the swap-in license item corresponding to the outflow table rule is increased.

[0022] Obtain the license update time of the swapped-in license item, and if the time difference between the current time and the license update time reaches a first preset duration, reduce or clear the license protection score of the swapped-in license item.

[0023] Optionally, the method further includes:

[0024] If the message to be processed matches a resident flow table rule in the on-chip flow table, increase the swap-out protection score of the resident flow table rule.

[0025] Obtain the hit update time of the resident flow table rule, and if the time difference between the current time and the hit update time reaches a second preset duration, reduce or clear the swap-out protection score of the resident flow table rule.

[0026] The preset swapping conditions include the swapping protection score of the resident flow table rule being less than or equal to a preset swapping threshold.

[0027] Optionally, the method further includes:

[0028] If the candidate flow table rule is empty at the swap-in position in the intra-chip flow table, the candidate flow table rule is written into the swap-in position, and the swap-out protection score of the candidate flow table rule is set to the second initial score.

[0029] If the swap-out protection score of the resident flow table rule meets the preset swap-out condition, the resident flow table rule is swapped out, the candidate flow table rule is written into the swap-in position, and the swap-out protection score of the candidate flow table rule is set to the second initial score.

[0030] If the swap protection score of the resident flow table rule does not meet the preset swap condition, the swap protection score of the resident flow table rule is reduced.

[0031] Optionally, the swap-in permission table has a swap-in enabled state; the method further includes:

[0032] Determine the set similarity between the rule sets of hotspot flow tables corresponding to multiple consecutive preset statistical windows;

[0033] If the set similarity meets the preset stability condition, the swap-in enable state is set to the off state to stop swapping new candidate flow table rules into the intra-slice flow table;

[0034] If the swap-in enable state is off, and the miss situation of the on-chip flow table or the change of the hot spot flow table rule set meets the preset relearning conditions, the swap-in enable state is set to on.

[0035] Optionally, the off-chip flow table and the on-chip flow table extract the same packet matching field for the same packet to be processed, and perform flow table rule matching based on the extracted packet matching field; the storage capacity of the off-chip flow table is greater than the storage capacity of the on-chip flow table.

[0036] During the flow table initialization phase, flow table rules belonging to the flow table template are written into the off-chip flow table;

[0037] When the candidate flow table rule is swapped into the intra-chip flow table, an intra-chip copy of the candidate flow table rule is created in the intra-chip flow table, and an off-chip copy of the candidate flow table rule in the off-chip flow table is retained.

[0038] A second aspect of this application provides a flow table management apparatus applied to a network processing device, the network processing device including a swap-in permission table and off-chip flow tables and on-chip flow tables configured for the same flow table template, the apparatus comprising:

[0039] The flow table query module is used to respond to a packet matching request by sequentially querying the on-chip flow table and the off-chip flow table based on the packet to be processed in the packet matching request to obtain the query result;

[0040] The identifier acquisition module is used to acquire the rule identifier of the matched external flow table rule when the query result indicates that the message to be processed does not match the intra-chip flow table but matches the external flow table.

[0041] The candidate determination module is used to query the swap-in license table according to the rule identifier, and when a swap-in license item corresponding to the rule identifier is matched, the off-chip flow table rule is determined as a candidate flow table rule.

[0042] The rule processing module is used to replace the candidate flow table rule into the intra-chip flow table if a resident flow table rule already exists at the replacement position of the candidate flow table rule in the intra-chip flow table, and if the replacement protection score of the resident flow table rule meets the preset replacement condition.

[0043] The rule processing module is also used to keep the resident flow table rule in the on-chip flow table if the swap protection score of the resident flow table rule does not meet the preset swap condition.

[0044] A third aspect of this application provides a computer program product including computer-readable instructions that, when executed on a network processing device, cause the network processing device to implement the flow table management method of the first aspect or any implementation thereof.

[0045] A fourth aspect of this application provides a network processing device, comprising at least one processor and a memory connected to the processor, wherein:

[0046] The memory is used to store computer programs;

[0047] The processor is used to execute the computer program so that the network processing device can implement the flow table management method of the first aspect or any implementation thereof.

[0048] The fifth aspect of this application provides a computer storage medium carrying one or more computer programs, which, when executed by a network processing device, enable the network processing device to implement the flow table management method described in the first aspect or any implementation thereof.

[0049] By employing the above technical solution, the flow table management method provided in this application, after a packet to be processed hits an off-chip flow table rule, queries the swap-in permission table based on the rule identifier of the off-chip flow table rule, and determines the off-chip flow table rule as a candidate flow table rule when a corresponding swap-in permission item is found. Further, if a resident flow table rule already exists at the on-chip swap-in position corresponding to the candidate flow table rule, the method determines whether to swap it into the on-chip flow table based on the swap-out protection score of the resident flow table rule. The candidate flow table rule is swapped into the on-chip flow table only when the swap-out protection score meets the preset swap-out conditions; otherwise, the resident flow table rule remains in the on-chip flow table. This reduces the probability of off-chip flow table rules replacing hot flow table rules corresponding to short-term burst traffic or noise traffic, reduces frequent swapping in and out of flow table rules, prevents hot flow table rules from being repeatedly replaced, and thus improves the on-chip flow table hit rate and the packet processing stability of the network processing equipment. Attached Figure Description

[0050] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0051] Figure 1 A flowchart illustrating a flow table management method provided in this application embodiment;

[0052] Figure 2A schematic diagram of the interaction architecture between the software control plane and the hardware data plane in a flow table management method provided in an embodiment of this application;

[0053] Figure 3 This is a schematic diagram of another flow table management method provided in an embodiment of this application;

[0054] Figure 4 A schematic diagram of a flow table management device provided in an embodiment of this application;

[0055] Figure 5 This is a schematic diagram of a network processing device structure provided in an embodiment of this application. Detailed Implementation

[0056] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is for explaining specific embodiments only and is not intended to limit the scope of this application.

[0057] The embodiments of this application will now be described with reference to the accompanying drawings. Those skilled in the art will recognize that, with technological advancements and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are equally applicable to similar technical problems.

[0058] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0059] To address the aforementioned problems, this application provides a flow table management method. The flow table management method of this application embodiment will be described in detail below with reference to the accompanying drawings.

[0060] The flow table management method provided in this application is applied to a network processing device, which includes a swap-in permission table and external and internal flow tables configured for the same flow table template. In this embodiment, the network processing device can be a smart network interface card (NIC), a data processor (DPU), a switching chip, or other devices capable of matching packets based on flow table rules. The network processing device configures internal and external flow tables for the same flow table template. The flow table template specifies which fields to extract from the packet and how to perform flow table queries. For example, the source address, destination address, source port, destination port, and protocol type can be extracted from the packet to form a query key for flow table queries. The external flow table stores all flow table rules under the corresponding flow table template, while the internal flow table stores flow table rules swapped in from the external flow table that have high access value. Flow table rules in the internal flow table can be called resident flow table rules. "Resident" means that the flow table rule is currently stored in the internal flow table and can participate in matching with priority in subsequent packet matching processes.

[0061] Reference Figure 1 , Figure 1 This is a flowchart illustrating a flow table management method provided in an embodiment of this application, as shown below. Figure 1 As shown in the embodiment of this application, a flow table management method may include steps 110 to 150, which are described in detail below.

[0062] 110. In response to the message matching request, query the on-chip flow table and off-chip flow table sequentially based on the message to be processed in the message matching request to obtain the query results.

[0063] A packet matching request can be automatically generated when a packet to be processed arrives at the network processing device. The packet matching request may include the packet to be processed, or it may include indication information such as the packet identifier and storage address used to obtain the packet to be processed, enabling the network processing device to obtain the packet to be processed and trigger a flow table query. A packet to be processed refers to a packet for which forwarding, dropping, header modification, or other processing actions need to be determined according to flow table rules. The network processing device extracts at least one packet field from the packet to be processed, such as source address, destination address, source port, destination port, and protocol type, according to the field extraction method specified in the flow table template. The extracted packet fields are then combined to form a flow table matching field combination, which is used to query the on-chip flow table and off-chip flow tables.

[0064] It should be noted that the sequential query here refers to querying in the order of priority for in-chip flow tables, followed by supplementary queries for out-of-chip flow tables. It does not mean that if an in-chip flow table match is found, an out-of-chip flow table query is still necessary. Specifically, the network processing device first uses the aforementioned flow table matching field combination to query the in-chip flow table. If the packet to be processed matches a resident flow table rule in the in-chip flow table, the packet processing action corresponding to that resident flow table rule can be directly executed, and the protection score (protect_score) of that resident flow table rule is updated based on this in-chip match to reflect that the resident flow table rule still has in-chip residency value. If the packet to be processed does not match an in-chip flow table, the network processing device continues to use the same flow table matching field combination to query the out-of-chip flow table. If the packet to be processed also does not match an out-of-chip flow table, the default processing action or the no-match processing procedure can be executed. Therefore, the query results can be used to characterize the match status of the packet to be processed against the in-chip and out-of-chip flow tables, and can further include the matched flow table rules and their corresponding packet processing actions.

[0065] 120. If the query result indicates that the message to be processed does not hit the intra-chip flow table but hits the extra-chip flow table, obtain the rule identifier of the hit extra-chip flow table rule.

[0066] If an off-chip flow table contains a flow table rule that matches a packet to be processed, but this rule is not currently stored in an on-chip flow table, or the on-chip copy corresponding to this rule has not been found, a situation may arise where the packet to be processed misses the on-chip flow table but hits the off-chip flow table. Rule identifiers are used to distinguish different flow table rules in the network processing device. In one implementation, if the rule identifier for each flow table rule is globally unique within the network processing device, the rule identifier can be the rule number. In another implementation, if the rule identifier is unique only within its own flow table template or within its own flow table template, the rule identifier can include both the flow table template identifier and the rule number, for example, using a combination of "RP_ID: rule_id". Here, RP_ID identifies the rule configuration file to which the hit off-chip flow table belongs, and rule_id identifies the specific flow table rule in that rule configuration file. Furthermore, the rule number rule_id can also be combined with the batch identifier generation to distinguish flow table rules created at different times but reusing the same rule number. The batch identifier `generation` is used to characterize the creation batch or lifecycle of a flow table rule. When an original flow table rule is deleted and recreated, or when the same `rule_id` is assigned to a new flow table rule, the corresponding `generation` can be updated. For example, if the original flow table rule's identifier is "RP_ID:rule_id:1", and this rule is deleted, but the same `rule_id` is reused by a new flow table rule, the identifier of the new rule can be set to "RP_ID:rule_id:2". When the network processing device queries the swap-in permission table, reads hit information, or identifies on-chip replicas, it can simultaneously compare `RP_ID`, `rule_id`, and `generation`. Only when all three are consistent is it determined to be the same flow table rule. This avoids incorrectly associating residual original rule information from the swap-in permission table, swap-in entry ring, or on-chip flow table with a new rule reusing the same `rule_id`, improving the accuracy of distinguishing between different rule lifecycles.

[0067] 130. Query the swap-in license table based on the rule identifier, and when a swap-in license item corresponding to the rule identifier is matched, determine the off-chip flow table rule as a candidate flow table rule.

[0068] In this embodiment, the swap_cache_table is used to record off-chip flow table rules that are eligible for in-chip swapping. Each swap_cache entry in the swap_cache_table is associated with a corresponding off-chip flow table rule and includes at least a rule identifier to identify the off-chip flow table rule, and may also include other information required to complete the swap_cache determination. The swap_cache entry characterizes whether the corresponding off-chip flow table rule is eligible to participate in the in-chip swapping determination.

[0069] Network processing devices can directly query the rule identifier of the matched off-chip flow table rule in the swap-in permission table, or they can extract fields such as flow table template identifier and rule number from the rule identifier and query them in the swap-in permission table.

[0070] If no swap-in permission entry corresponding to the rule identifier is found, it indicates that the off-chip flow table rule is not currently eligible for on-chip swap-in. The network processing device will not initiate on-chip swap-in for this off-chip flow table rule and can continue to execute the packet processing actions corresponding to the off-chip flow table rule. If a swap-in permission entry corresponding to the rule identifier is found, it indicates that the off-chip flow table rule is eligible to participate in the on-chip swap-in judgment, and the network processing device will determine the off-chip flow table rule as a candidate flow table rule. It can be understood that a candidate flow table rule refers to an off-chip flow table rule that has passed the swap-in permission judgment and can participate in the competition for on-chip storage locations. Then, the network processing device also needs to determine whether to swap in the on-chip flow table rule based on the occupancy status of the specific on-chip swap-in locations in the candidate flow table rules and the swap-out protection score of the resident flow table rules in those locations.

[0071] 140. If a resident flow table rule already exists at the swap-in position of a candidate flow table rule in the intra-chip flow table, and the swap-out protection score of the resident flow table rule meets the preset swap-out condition, then the candidate flow table rule is swapped into the intra-chip flow table.

[0072] Because the storage capacity of on-chip flow tables is limited, and on-chip flow tables may also be managed using hashing, different flow table rules may correspond to the same on-chip swap-in location. When another flow table rule is already stored at that swap-in location, the stored flow table rule is the resident flow table rule that competes for position with the candidate flow table rule.

[0073] The swap-out protection score is used to characterize the current activity level of a resident flow table rule or its value in continuing to reside in the in-slice flow table. The more times a resident flow table rule is hit in the in-slice flow table recently, or the more active its hit status, the higher its swap-out protection score can be; if a resident flow table rule has not been hit for a long time or its activity level decreases, its swap-out protection score can be lowered accordingly.

[0074] A preset replacement condition is a criterion used by network processing devices to determine whether a resident flow table rule can be replaced. This preset replacement condition can be represented by a comparison between the replacement protection score of the resident flow table rule and a preset threshold. For example, if a higher replacement protection score indicates a more active resident flow table rule, the preset replacement condition could be that the replacement protection score is less than or equal to the corresponding replacement threshold. The specific value of the preset replacement condition can be configured based on the on-chip flow table capacity, packet processing rate, allowed rule replacement frequency, or service processing requirements; this embodiment does not impose such limitations.

[0075] If the replacement protection score of a resident flow table rule meets the preset replacement conditions, it indicates that the current on-chip retention value of the resident flow table rule is relatively low, and the network processing device can replace the candidate flow table rule into the on-chip flow table. In the event of a position conflict, replacing a candidate flow table rule into the on-chip flow table may include: moving the original resident flow table rule out of the corresponding on-chip replacement position or invalidating the original resident flow table rule at that position, and writing the matching information and action information of the candidate flow table rule into the replacement position of the on-chip flow table. When the off-chip flow table is used as a full rule storage area, the replacement operation may be to create an on-chip copy of the candidate flow table rule in the on-chip flow table, while the rules of the candidate flow table rule in the off-chip flow table can still be retained. Therefore, even if the candidate flow table rule is subsequently replaced out of the on-chip flow table, the network processing device can still query the flow table rule through the off-chip flow table.

[0076] 150. If the swap protection score of a resident flow table rule does not meet the preset swap conditions, then the resident flow table rule will remain in the intra-chip flow table.

[0077] If a resident flow table rule still has high activity or in-chip retention value, even if a candidate flow table rule has been matched with the swap-in permission table and qualified for swap-in, it is not enough to replace the current resident flow table rule, resulting in the failure of the candidate flow table rule swap-in. However, the currently pending packets corresponding to the candidate flow table rule can still perform corresponding actions according to the matched off-chip flow table rules; it's just that the candidate flow table rule cannot be written to the in-chip flow table for the time being.

[0078] By employing the above technical solution, the flow table management method provided in this application, after a packet to be processed hits an off-chip flow table rule, queries the swap-in permission table based on the rule identifier of the off-chip flow table rule, and determines the off-chip flow table rule as a candidate flow table rule when a corresponding swap-in permission item is found. Further, if a resident flow table rule already exists at the on-chip swap-in position corresponding to the candidate flow table rule, the method determines whether to swap it into the on-chip flow table based on the swap-out protection score of the resident flow table rule. The candidate flow table rule is swapped into the on-chip flow table only when the swap-out protection score meets the preset swap-out conditions; otherwise, the resident flow table rule remains in the on-chip flow table. This reduces the probability of off-chip flow table rules replacing hot flow table rules corresponding to short-term burst traffic or noise traffic, reduces frequent swapping in and out of flow table rules, prevents hot flow table rules from being repeatedly replaced, and thus improves the on-chip flow table hit rate and the packet processing stability of the network processing equipment.

[0079] In one implementation, the network processing device further includes a swap entry ring. The generation method of swap entry entries in the swap entry permission table includes: when a packet to be processed hits an off-chip flow table, sampling the hit events of off-chip flow table rules according to a preset sampling strategy, and writing the hit information including the rule identifier of the off-chip flow table rule into the swap entry ring when the hit event meets the sampling conditions; reading multiple hit information in the swap entry ring according to a preset statistical period, and aggregating and statistically analyzing the hit information within a preset statistical window according to the rule identifier in each hit information to obtain the rule popularity corresponding to each off-chip flow table rule; determining hot flow table rules from multiple off-chip flow table rules according to the rule popularity, generating swap entry entries corresponding to the rule identifier of the hot flow table rules, and writing the swap entry entries into the swap entry permission table.

[0080] Please refer to Figure 2 , Figure 2 This application provides a schematic diagram of the interaction architecture between the software control plane and the hardware data plane, as shown in the embodiments of this application. Figure 2 As shown, network processing devices can be functionally divided into a software control plane and a hardware data plane. The software control plane refers to the processing unit primarily responsible for management functions such as flow table configuration, hit information statistics, hotspot rule learning, and permission table updates. The software control plane can be implemented by software programs running on an embedded processor, DPU processor, or a host processor connected to the network processing device. The hardware data plane refers to the processing unit primarily responsible for rapid packet processing functions such as packet reception, field extraction, flow table lookup, packet processing action execution, and rule insertion judgment. The hardware data plane can be implemented by dedicated table lookup circuits, programmable packet processing pipelines, network processors, or other hardware units capable of high-speed packet processing. It should be noted that the division between the software control plane and the hardware data plane is based on their respective functions and does not necessarily require them to be located in separate chips or devices.

[0081] Figure 2 In this context, RP stands for Rule Profile, also known as a flow table template. In-chip rule profiles (IPRs) and out-of-chip rule profiles (ROPs) represent rule matching instances configured in the in-chip and out-of-chip flow tables for the same flow table template, respectively. RPs can be used to define the packet matching fields extracted from the packet to be processed, the matching method of the flow table rules, and the corresponding packet processing actions. In-chip and out-of-chip RPs can use consistent packet matching fields and rule matching relationships for the same packet to be processed. This allows out-of-chip flow table rules to continue matching the same type of packets after a copy is created in the in-chip environment.

[0082] Please refer to Figure 2As shown in the process diagram, after a packet to be processed enters the hardware data plane, the hardware data plane first queries the on-chip flow table based on the on-chip RP. If a resident flow table rule is matched in the on-chip flow table, the packet processing action corresponding to that resident flow table rule is executed. If no on-chip flow table is matched, the process continues to query the off-chip flow table based on the off-chip RP. Since the off-chip flow table can store all flow table rules belonging to the corresponding flow table template, when an off-chip flow table match is found, the hardware data plane can determine the processing action of the packet to be processed based on the matched off-chip flow table rule and obtain the rule identifier of that off-chip flow table rule.

[0083] When an off-chip flow table rule is hit, the hardware data plane can also sample the hit event according to a preset sampling strategy. The preset sampling strategy determines whether the corresponding hit event needs to be reported to the software control plane; specifically, it can use full sampling, proportional sampling, or hash sampling. For example, hit events can be selected according to a sampling ratio of 1 / 64, or a hash operation can be performed on the rule identifier, and the corresponding hit event can be selected when the hash result meets preset conditions. Sampling reduces the number of events that need to be processed by the software control plane, avoiding increased processing overhead caused by performing software statistics for each off-chip flow table hit.

[0084] When a hit event meets the sampling conditions, the hardware data plane writes the hit information, including the rule identifier, into the swap-in entry ring. The swap-in entry ring can adopt a circular queue structure where the hardware data plane writes the information and the software control plane reads it. The hardware data plane can determine the write position of the hit information using a producer pointer, while the software control plane can determine the hit information to be read using a consumer pointer. In addition to the rule identifier, the hit information may also include the flow table template identifier, sampling time, sampling sequence number, or other information used for hotspot statistics. When the swap-in entry ring is full, the currently pending hit information can be discarded, or historical hit information that meets preset conditions can be overwritten. The number of discarded events is recorded so that the software control plane can adjust the sampling ratio or reading cycle based on the event discard situation.

[0085] The software control plane consumes sampled events from the swapped-in entry ring according to a preset statistical period. This consumption can be understood as reading hit information from the swapped-in entry ring and moving the corresponding consumer pointer so that the already read storage location can be reused by subsequent hit information. For example, the software control plane can read the swapped-in entry ring every 100 milliseconds and perform statistics on the hit information within the preset statistical window of the most recent second.

[0086] The software control plane aggregates the hit information within a preset statistical window according to the rule identifier to obtain the rule popularity corresponding to each off-chip flow table rule. In this embodiment, rule popularity is used to characterize the access activity of the corresponding off-chip flow table rule within the statistical window. It can be determined based on the number of sampled events corresponding to the same rule identifier, or it can be determined by combining the sampling ratio, the event weight of different time periods, or the statistical results of multiple consecutive statistical windows. The software control plane can identify off-chip flow table rules whose rule popularity reaches a preset popularity threshold as hot flow table rules, or it can sort the rules according to their popularity from high to low and identify the top K off-chip flow table rules as hot flow table rules. K is a preset positive integer.

[0087] After determining the hotspot flow table rule, the software control plane generates a swap-in license entry corresponding to that rule and writes it into the swap-in license table. The swap-in license entry must at least include the rule identifier of the corresponding hotspot flow table rule; additionally, it may include information such as license protection score, license update time, or validity status.

[0088] pass Figure 2 The coordination between the software control plane and the hardware data plane can avoid the hardware data plane performing complex statistical processing for each packet hit, reducing the impact of flow table rule popularity statistics on packet processing speed. At the same time, only off-chip flow table rules that are determined to have a high access frequency after a period of statistics can be replaced into on-chip flow tables. This can also reduce the probability that rules corresponding to short-term burst traffic or noise traffic will repeatedly replace existing resident flow table rules on the chip.

[0089] To prevent swap-in permits corresponding to hot flow table rules from being directly overwritten by swap-in permits corresponding to short-term burst traffic when write location conflicts occur, and to allow swap-in permits that have not been identified as hotspots for a long time to gradually exit the swap-in permit table, in one optional implementation, swap-in permits include a permit protection score (permit_score). The permit protection score is used to characterize the retention priority of swap-in permits in the swap-in permit table. The higher the score, the less likely the corresponding hot flow table rule is to be replaced by a new swap-in permit in the event of a location conflict, thereby reducing the replacement of hotspot learning results by short-term bursts of traffic or noisy traffic. In practical applications, the swap-in permit table can adopt a hash structure, a multi-way group-associative structure, a cuckoo hash structure, a hash structure with a stash, or other conflict management structures. Taking a hash structure as an example, the permit write location is determined based on the rule identifier of the hot flow table rule. The rule identifier can be RP_ID:rule_id, where RP_ID identifies the flow table template instance to which the rule belongs, and rule_id identifies the specific flow table rule in that instance. For example, when the swapped-in license table includes 1024 license write locations, a hash calculation can be performed on the rule identifier, and the remainder obtained by taking the modulo 1024 can be used to determine the license write location. Different rule identifiers may correspond to the same license write location after hash calculation, which will result in a license item conflict.

[0090] Based on this, the above steps of writing the replacement license item into the replacement license table include: determining the license writing position of the replacement license item in the replacement license table; if the license writing position is empty, writing the replacement license item into the license writing position and setting the license protection score of the replacement license item to the first initial score; if the original replacement license item already exists in the license writing position, if the license protection score of the original replacement license item meets the preset license retention conditions, then retaining the original replacement license item and reducing the license protection score of the original replacement license item; if the license protection score of the original replacement license item does not meet the preset license retention conditions, then replacing the original replacement license item with the replacement license item and setting the license protection score of the replacement license item to the first initial score.

[0091] When the write location is empty, the swapped-in license is written to that location, and its license protection score is set to the first initial score. The first initial score is the protection value configured when the swapped-in license is first written, and can be preset according to the score bit width, the capacity of the swapped-in license table, and the hotspot change rate. For example, if the license protection score uses a 4-bit saturation counter with a value range of 0 to 15, the first initial score can be set to 8.

[0092] If the original replaced license item already exists at the license write location, the system determines whether the preset license retention conditions are met based on the license protection score of the original replaced license item. The preset license retention conditions are used to determine whether the original replaced license item still has retention value; for example, the license protection score can be greater than or equal to a preset license retention threshold.

[0093] If the original replaced license item meets the preset license retention conditions, the original replaced license item will be retained, the current replacement operation will be rejected, and the license protection score of the original replaced license item will be reduced. The reduction can be achieved by subtracting a preset score, proportionally attenuating the score, or reducing it to an adjacent protection level. For example, if the preset license retention threshold is 6 and the original replaced license item has a license protection score of 9, the original replaced license item can be retained, and its score reduced to 6 to prevent historical hotspots from occupying the license write position for an extended period.

[0094] If the original replacement license does not meet the preset license retention conditions, a new replacement license will replace the original one, and the license protection score of the new replacement license will be set to the first initial score. For example, if the original replacement license has a score of 4, which is lower than the threshold of 6, it can be replaced, and the score of the new replacement license will be set to 8. Thus, replacement licenses corresponding to flow table rules that are consistently identified as hotspots can be retained for a longer period; flow table rules that appear occasionally in a short period are unlikely to directly replace existing hotspot licenses, while licenses that have not been identified as hotspots for a long time will be replaced by subsequent licenses as their license protection scores decrease.

[0095] In one optional implementation, the swapped-in license item includes a license protection score and a license update time; the license update time is used to record the time when the swapped-in license item was last written, identified as a hotspot, or when its license protection score was increased. The method in this application embodiment further includes: when the same out-of-chip flow table rule is identified as a hotspot flow table rule in multiple consecutive preset statistical windows, increasing the license protection score of the swapped-in license item corresponding to the out-of-chip flow table rule; obtaining the license update time of the swapped-in license item, and when the time difference between the current time and the license update time reaches a first preset duration, decreasing or clearing the license protection score of the swapped-in license item.

[0096] In this embodiment, the preset statistical window refers to the time range used to count the hit rate of external flow table rules, such as 500 milliseconds or 1 second. Multiple consecutive preset statistical windows can be 3 consecutive, 5 consecutive, or other preset numbers of statistical windows.

[0097] When the same outflow table rule is identified as a hotspot flow table rule in multiple consecutive preset statistical windows, it indicates that the outflow table rule does not only have a high hit rate due to concentrated packet arrivals in a short period of time, but maintains a high hit frequency over a continuous period of time. In this case, the license protection score of the corresponding swap-in license item can be increased by a preset increment, and the license update time can be updated to the current time. In this embodiment, the license protection score can adopt a saturation counting method, meaning that it will not continue to increase after reaching a preset upper limit. For example, the license protection score is represented by 4 bits, with a value range of 0 to 15, and an initial score of 8. Whenever the corresponding outflow table rule is identified as a hotspot flow table rule in multiple consecutive preset statistical windows, the license protection score is increased by 2, so the license protection score can increase from 8 to 10, 12, and 14 sequentially. Therefore, flow table rules that maintain a high hit frequency over a continuous period of time can obtain a higher retention priority, and when a position conflict occurs in the swap-in license table, their corresponding swap-in license item is less likely to be replaced by other swap-in license items.

[0098] The first preset duration is used to determine whether the off-chip flow table rule corresponding to the swapped-in license item has not been identified as a hot flow table rule for a relatively long time. It can be set according to the length of the preset statistical window, the rate of change in network traffic, and the update frequency of the swapped-in license table. For example, if the preset statistical window is 1 second, the first preset duration can be set to 5 seconds. When the time difference between the current time and the license update time reaches the first preset duration, it indicates that the off-chip flow table rule corresponding to the swapped-in license item has not maintained a high hit frequency recently, and the license protection score of the swapped-in license item can be reduced or cleared. Reducing the license protection score can be done by subtracting a preset value, attenuating it according to a preset ratio, or reducing it to an adjacent protection level, for example, reducing the license protection score from 14 to 7; clearing it means directly setting the license protection score to 0, so that the swapped-in license item can be replaced by a newly generated swapped-in license item when a position conflict occurs later. The above processing can be performed according to a preset cycle, or it can be performed according to the license update time when the swapped-in license item is queried, written, or when a position conflict occurs.

[0099] Through the above processing, when a position conflict occurs, the swap-in permission table can determine whether to retain or replace swap-in permission items based on the hit rate of flow table rules over a period of time and the permission protection score. Flow table rules that maintain a high hit frequency in multiple consecutive preset statistical windows can have their corresponding swap-in permission items retain a high permission protection score and continue to be retained in the swap-in permission table; flow table rules that only have a high hit rate in a few statistical windows are unlikely to directly replace existing swap-in permission items based on a single statistical result; the permission protection score of swap-in permission items that have not been identified as hot flow table rules for a long time can be gradually reduced or cleared to zero, so that the swap-in permission item can be replaced by subsequently generated swap-in permission items, avoiding flow table rules that are no longer frequently accessed from occupying permission write positions for a long time.

[0100] In one optional implementation, the resident flow table rules in the on-chip flow table are further configured with a swap-out protection score and a hit update time. The swap-out protection score (protect_score) is used to characterize the necessity for the resident flow table rule to continue to remain in the on-chip flow table. The higher the score, the more frequently the rule has been accessed recently, and the less suitable it is to be replaced by a candidate flow table rule. The hit update time is used to record the time when the resident flow table rule was last hit in the on-chip flow table.

[0101] Based on this, the method of this application embodiment further includes: increasing the swap-out protection score of the resident flow table rule when the packet to be processed hits the resident flow table rule in the on-chip flow table; obtaining the hit update time of the resident flow table rule, and reducing or clearing the swap-out protection score of the resident flow table rule when the time difference between the current time and the hit update time reaches a second preset duration; wherein, the preset swap-out condition includes the swap-out protection score of the resident flow table rule being less than or equal to a preset swap-out threshold.

[0102] In this embodiment, when a packet to be processed does not match an intra-chip flow table rule but matches an extra-chip flow table rule, the network processing device queries the swap-in permission table based on the rule identifier of the extra-chip flow table rule. The rule identifier can consist of a flow table template instance identifier and a rule number. The flow table template instance identifier RP_ID is used to determine the flow table template instance to which the flow table rule belongs, and the rule number rule_id is used to determine the specific flow table rule within that flow table template instance. If no corresponding swap-in permission item is found, the packet to be processed continues to be processed according to the extra-chip flow table rule, and no intra-chip swap-in operation is initiated; if a corresponding swap-in permission item is found, the extra-chip flow table rule is identified as a candidate flow table rule to further determine whether the candidate flow table rule can achieve intra-chip swap-in.

[0103] When a pending packet hits a resident flow table rule, the swap-out protection score of that resident flow table rule is increased, and the hit update time of the resident flow table rule is updated to the current time. The swap-out protection score can use a counting method that stops increasing after reaching a certain limit. For example, if the swap-out protection score is represented by 4 bits and ranges from 0 to 15, with an initial score of 6, and increases by 2 for each in-chip hit, it can increase from 6 to 8, 10, and 12, and stop increasing after reaching 15.

[0104] The second preset duration is used to determine whether a resident flow table rule has not been hit for a relatively long time; for example, it can be set to 5 seconds. When the time difference between the current time and the hit update time reaches the second preset duration, the replacement protection score of the resident flow table rule can be reduced or cleared. The reduction method can be subtracting a preset score, decaying according to a preset ratio, or reducing to an adjacent protection level. For example, if the score is 12 and it has not been hit for 5 consecutive seconds, it can be reduced to 8; if it is still not hit after another 5 seconds, it can be further reduced to 4. The above operation of reducing or clearing the replacement protection score of the resident flow table rule can be executed according to a preset cycle, or it can be executed when a candidate flow table rule initiates replacement; if the resident flow table rule is not replaced in this time, the replacement protection score of the resident flow table rule can also be reduced according to the preset method.

[0105] The preset replacement conditions include a replacement protection score that is less than or equal to a preset replacement threshold. For example, the replacement protection score ranges from 0 to 15. If the preset replacement threshold is 4 and the replacement protection score of a resident flow table rule is 3, then the candidate flow table rule is allowed to be replaced. However, if the preset replacement threshold is 4 and the replacement protection score of a resident flow table rule is 9, then the resident flow table rule is retained. Thus, rules that are frequently accessed recently can continue to be retained, while rules that have not been accessed for a longer period of time have their retention priority gradually reduced. This reduces the frequent replacement of on-chip flow table rules and avoids rules with low access frequency occupying on-chip storage space for extended periods.

[0106] In an optional implementation, the method of this application embodiment further includes: when the swap-in position of the candidate flow table rule in the on-chip flow table is empty, writing the candidate flow table rule into the swap-in position and setting the swap-out protection score of the candidate flow table rule to a second initial score; when the swap-out protection score of the resident flow table rule meets the preset swap-out condition, swapping out the resident flow table rule, writing the candidate flow table rule into the swap-in position, and setting the swap-out protection score of the candidate flow table rule to the second initial score; when the swap-out protection score of the resident flow table rule does not meet the preset swap-out condition, reducing the swap-out protection score of the resident flow table rule.

[0107] The swap-in location refers to the rule storage location determined in the on-chip flow table based on the flow table template, packet matching field, or preset address mapping method to which the candidate flow table rule belongs. In actual implementation, candidate flow table rules can also be called challenge rules. After the candidate flow table rule has passed the swap-in permission judgment, the network processing device determines whether to execute the swap-in based on the occupancy status of the on-chip swap-in location and the swap-out protection score of the resident flow table rules.

[0108] When the swap-in position is empty, there are no resident flow table rules that need protection. Therefore, candidate flow table rules can be directly written into this swap-in position, and the swap-out protection score of the candidate flow table rules can be set as the second initial score. The second initial score is the protection score obtained when a flow table rule is first written into the on-chip flow table. It is used to prevent newly swapped-in rules from being immediately swapped out because they have not been hit again in a short period of time. The second initial score can be preset according to the score bit width, the on-chip flow table capacity, and the flow change rate.

[0109] If a resident flow table rule already exists at the swap-in location, its swap-out protection score is compared with a preset swap-out threshold. The preset swap-out condition can be that the swap-out protection score is less than or equal to the preset swap-out threshold. If the preset swap-out condition is met, it indicates that the resident flow table rule currently has low on-chip retention value, and the resident flow table rule can be swapped out from the corresponding swap-in location. A candidate flow table rule is then written to that location, and its swap-out protection score is set to the second initial score.

[0110] If the swap-out protection score of a resident flow table rule exceeds a preset swap-out threshold, the challenge for this candidate flow table rule fails, and the resident flow table rule will remain in the intra-segment flow table instead of being written to the intra-segment flow table. In this case, the swap-out protection score of the resident flow table rule can be slightly or moderately reduced, for example, by subtracting 1 or 2 points, or reducing it according to a preset ratio, ensuring that the reduced score is not less than 0. By appropriately reducing the swap-out protection score after a failed challenge, the resident flow table rule can be prevented from occupying an intra-segment position for an extended period solely based on historical hits, and opportunities for subsequent frequently accessed candidate flow table rules to swap in can be provided. To prevent multiple candidate flow table rules from launching challenges consecutively within a short period, causing the score to drop too quickly, a maximum reduction of once per preset period can be implemented.

[0111] For example, the swap-out protection score is represented by 4 bits, ranging from 0 to 15, with a second initial score of 6 and a preset swap-out threshold of 4. When the swap-out protection score of a resident flow table rule is 3, a candidate flow table rule is allowed to replace the resident flow table rule, and the swap-out protection score of the newly swapped-in rule is set to 6. When the swap-out protection score of a resident flow table rule is 9, the resident flow table rule is retained, and its swap-out protection score is reduced to 7. If the resident flow table rule is subsequently frequently hit by packets, the swap-out protection score can be increased again; if it is not hit for a long time and continues to be challenged by candidate flow table rules, the swap-out protection score of the resident flow table rule will gradually decrease until the preset swap-out condition is met.

[0112] Therefore, the swap-out protection score can provide further protection for frequently used flow table rules in the on-chip flow table, preventing them from being directly replaced by a single candidate rule challenge. At the same time, resident flow table rules that have not been hit for a long time can gradually reduce the swap-out protection score, thereby reducing the frequent replacement of on-chip flow table rules and gradually allocating the limited on-chip storage space to flow table rules with higher current access frequency.

[0113] Based on any of the above embodiments, the swap-in permission table in this application embodiment has a swap-in enabled state; the method in this application embodiment further includes: determining the set similarity between the hot spot flow table rule sets corresponding to multiple consecutive preset statistical windows; when the set similarity meets a preset stability condition, setting the swap-in enabled state to a closed state to stop swapping new candidate flow table rules into the on-chip flow table; when the swap-in enabled state is closed, and the miss situation of the on-chip flow table or the change situation of the hot spot flow table rule set meets a preset relearning condition, setting the swap-in enabled state to an open state.

[0114] In this embodiment, the swap-in permission table can be set to a swap-in enable state (also known as enable). The swap-in enable state controls whether the network processing device currently allows new candidate flow table rules to be swapped into the on-chip flow table. The swap-in permission table can be implemented using software writing and hardware reading. That is, the software control plane generates or updates swap-in permission items based on the hit statistics of off-chip flow table rules, and the hardware data plane queries the swap-in permission table after a packet hits an off-chip flow table, and determines whether to continue executing on-chip swapping based on the swap-in enable state. When the swap-in enable state is off, the hardware data plane still queries the on-chip and off-chip flow tables normally and processes packets according to the hit flow table rules, but no longer initiates new on-chip swapping, thereby keeping the rules in the on-chip flow table relatively stable.

[0115] During the learning process, the hardware data plane continuously writes off-chip flow table hit information that meets the sampling conditions into the swapped-in entry ring. The software control plane reads the corresponding hit information according to a preset statistical period and determines the hot spot flow table rule set within each preset statistical window. The hot spot flow table rule set refers to the set of off-chip flow table rules that have reached a preset popularity threshold or are ranked among the top preset number of hits within a preset statistical window.

[0116] The software control plane can compare the sets of hotspot flow table rules corresponding to multiple consecutive preset statistical windows and calculate the set similarity between adjacent sets or multiple sets. Set similarity is used to characterize the degree of overlap of hotspot flow table rules within different statistical windows. For example, the ratio of the number of rules in the intersection of two hotspot flow table rule sets to the number of rules in their union can be determined as set similarity. The higher the set similarity, the closer the frequently accessed flow table rules are within multiple consecutive statistical windows, and the more stable the hotspot rules corresponding to the current business traffic are.

[0117] Preset stability conditions may include: the set similarity of a consecutive preset number of statistical windows is greater than or equal to a preset similarity threshold. For example, when the software control plane detects that the set similarity between adjacent hot flow table rule sets is higher than 95% in five consecutive preset statistical windows, it can be determined that the hot flow table rule sets have stabilized, and the swap-in enable state of the swap-in permission table is set to off, causing flow table management to enter frozen mode from learning mode. In frozen mode, the hardware data plane still performs on-chip and off-chip flow table queries normally, but no new candidate flow table rules are swapped into the on-chip flow table, thereby avoiding unnecessary swap-in judgments and rule replacements after the hot flow rules have basically stabilized.

[0118] Even when the enabled state is switched to the disabled state, the software control plane can still continue to acquire information on misses in the on-chip flow tables and changes in the hot spot flow table rule set to determine whether the current service traffic has changed. Misses in the on-chip flow tables can be represented by the number of misses, the miss rate, or the number of times external flow tables were queried due to on-chip misses. Changes in the hot spot flow table rule set can be represented by the degree of decrease in set similarity, the number of newly added hot spot rules, or the number of removed hot spot rules.

[0119] Preset relearning conditions may include an in-chip flow table miss rate reaching a preset miss threshold, a similarity of hot flow table rule sets across multiple consecutive statistical windows falling below a preset change threshold, or a significant change in the main access rules within the service traffic. When the preset relearning conditions are met, the software control plane resets the swap-in enable state to the on state and enters relearning mode. In relearning mode, the software control plane re-determines the current hot flow table rules based on the off-chip flow table hit information in the swap-in table entry ring and updates the swap-in permission table to allow new candidate flow table rules to be swapped into the in-chip flow table.

[0120] For example, if the software control plane detects a similarity of over 95% for the hotspot flow table rule set across five consecutive statistical windows, it disables the swap-in enable state, putting the system into a frozen mode. Subsequently, when the intra-chip flow table miss rate significantly increases, or when the hotspot flow table rule set changes significantly across multiple consecutive statistical windows, it re-enables the swap-in enable state, initiating a new round of learning and swapping. This reduces unnecessary swapping operations when hotspot rules are stable and promptly restores hotspot rule updates when business traffic changes, enabling intra-chip flow tables to adapt to the current actual access situation.

[0121] Based on any of the above embodiments, further, in the embodiments of this application, the off-chip flow table and the on-chip flow table extract the same packet matching field for the same packet to be processed, and perform flow table rule matching according to the extracted packet matching field; the storage capacity of the off-chip flow table is greater than the storage capacity of the on-chip flow table; during the flow table initialization stage, the flow table rules belonging to the flow table template are written into the off-chip flow table; when replacing the candidate flow table rule into the on-chip flow table, an on-chip copy of the candidate flow table rule is established in the on-chip flow table, and the off-chip copy of the candidate flow table rule in the off-chip flow table is retained.

[0122] Based on any of the above embodiments, the network processing device can establish a pair of rule configuration RP files for the same flow table template, namely an off-chip rule configuration file (off-chip flow table rule) and an on-chip rule configuration file (on-chip flow table rule). The flow table template is used to specify the packet matching fields, field extraction positions, matching methods, mask formats, priority relationships, and packet processing action formats used by the flow table rules. The off-chip rule configuration file and the on-chip rule configuration file use the same template semantics, enabling them to extract the same packet matching fields for the same packet to be processed and to perform queries according to the same rule matching method. The flow table query key formed by the corresponding packet matching fields may include at least one of source address, destination address, source port, destination port, and protocol type, and is used to find the flow table rule that matches the packet to be processed in the on-chip flow table and the off-chip flow table.

[0123] The on-chip / off-chip attribute (on_chip) of an off-chip flow table can be set to indicate off-chip storage. The hash capacity attribute (hash_size) of an off-chip flow table can be set to a large value, and the hash address attribute (hash_addr) is used to indicate the starting address or address range of the corresponding storage area for the off-chip flow table. Off-chip flow tables have a large storage capacity to store all flow table rules belonging to the corresponding flow table template. The on_chip attribute of an on-chip flow table can be set to indicate on-chip storage. The hash_size of an on-chip flow table is smaller than the hash_size described in the off-chip rule configuration, and hash_addr is used to indicate the on-chip high-speed storage area. On-chip flow tables are used to store some frequently accessed resident flow table rules selected from the full set of rules. For example, the hash_size of an off-chip flow table can correspond to 1,048,576 rule storage locations, and the hash_size of an on-chip flow table can correspond to 16,384 rule storage locations, but the specific capacity can be set according to off-chip storage resources, on-chip high-speed storage resources, and the scale of business traffic.

[0124] The off-chip rule configuration description and the on-chip rule configuration description are identical except for runtime attributes related to storage location and storage capacity, such as on_chip, hash_size, and hash_addr. All other template attributes related to packet matching remain the same. Therefore, when the same flow table rule is moved from the off-chip flow table to the on-chip flow table, the matching conditions and packet processing actions do not change, ensuring that the packet to be processed receives consistent results regardless of whether the rule is matched in the on-chip or off-chip flow table.

[0125] During the flow table initialization phase, the network processing device can simultaneously create both external and internal flow tables. All flow table rules belonging to the corresponding flow table template are written to the external flow table, without pre-writing the corresponding flow table rules to the internal flow table, leaving the internal flow table initially empty. Here, "all flow table rules" refers to the set of rules issued by the control program for that flow table template and currently in a valid state. This ensures the integrity of rule storage through the external flow table, and then, based on actual packet access patterns, frequently accessed rules are gradually written to the internal flow table.

[0126] When an external flow table rule is identified as a candidate flow table rule and meets the swap-in conditions, the network processing device establishes an intra-chip copy at the swap-in location in the intra-chip flow table based on the matching conditions and packet processing actions of the candidate flow table rule. The intra-chip copy and the external copy correspond to the same logical flow table rule, and their packet matching conditions and processing actions are consistent. However, information related to storage management, such as storage address, swap-out protection score, and hit update time, may differ. After the intra-chip copy is established, the original flow table rule's external copy in the external flow table remains retained and is not deleted due to the establishment of the intra-chip copy.

[0127] Retaining off-chip copies allows off-chip flow tables to continuously store the complete set of rules. When an on-chip copy is removed due to replacement, conflict, or other reasons, subsequent packets can still find the corresponding rule in the off-chip flow table without needing to reissue the rule. Furthermore, the rule replacement process only requires adding a copy to the on-chip flow table; rule migration or deletion operations are not required in the off-chip flow table. This reduces the number of off-chip flow table updates and avoids situations where rule migration temporarily prevents both on-chip and off-chip flow tables from finding the corresponding rule, thus balancing flow table storage capacity and packet query efficiency.

[0128] like Figure 3 As shown in the embodiments of this application, the learning, permissioning, and replacement process of flow table rules is illustrated using an external flow table and an internal flow table with a hash structure as an example. External rule configuration descriptions and internal rule configuration descriptions are configured separately for the same flow table template, wherein the hash capacity of the external rule configuration description is 2. 24 It is used to store all flow table rules belonging to this flow table template; the hash capacity of the on-chip rule configuration description is 2. 14 This is used to store some frequently matched flow table rules selected from the off-chip flow table. When a packet arrives at the network device, it first queries the on-chip flow table. If a resident flow table rule in the on-chip flow table is matched, the switchout protection score of that resident flow table rule is increased, and the corresponding packet processing action is executed. If no match is found in the on-chip flow table, the query continues to the off-chip flow table. If no match is found in the off-chip flow table either, the current flow table matching ends. If a match is found in an off-chip flow table rule, the corresponding packet processing action is executed according to that rule, and a rule identifier consisting of a rule configuration description identifier and a rule number is obtained.

[0129] For hit events in the off-chip flow table, the network processing device can select a portion of the hit events at a sampling ratio of 1 / 256 and write the sampled rule identifiers into the swap-in table entry ring. The software control plane uses 1000 milliseconds as a statistical window (corresponding to...). Figure 3 The software learning window reads the sampling records in the swapped-in table loop, counts the number of hits of each external flow table rule according to the rule identifier, and selects the flow table rules ranked in the Top-K positions (e.g., the first 4096 positions) as hot flow table rules (corresponding to...). Figure 3 (For hot entries in the table), try to write the corresponding swap-in license entry into the swap-in license table.

[0130] The swap-in license table uses a hash method to determine the license write location for each swap-in license item. If a license write location is empty, the new swap-in license item is written directly; if a license write location is already occupied by another swap-in license item, a license item conflict occurs. In this case, the license protection score of the original swap-in license item is compared (corresponding to...). Figure 3(License score). If the original swapped-in license has a low license protection score, it will be replaced with a new swapped-in license. If the original swapped-in license has a high license protection score, it will be retained, the write operation will be rejected, and its license protection score will be lowered. If the original swapped-in license is subsequently hit again, its license protection score can be increased again. If it is not subsequently hit again, its license protection score, after being lowered, can be replaced by a newly generated swapped-in license, thus preventing historical hotspots from occupying the license write position for a long time.

[0131] When an external flow table rule is hit again in subsequent packet processing, the network device queries the swap-in permission table based on the rule identifier of the external flow table rule. If the corresponding swap-in permission entry is not matched, no intra-chip swap-in is initiated; if matched, the external flow table rule is identified as a candidate flow table rule, and the swap-in position of the external flow table rule in the intra-chip flow table is checked. If the swap-in position is empty, the candidate flow table rule is directly written, and the swap-out protection score of the external flow table rule is set (corresponding to...). Figure 3 The protection score is calculated as follows: If a resident flow table rule already exists at the swap-in location, the swap-out protection score of that resident flow table rule is compared with a preset swap-out threshold. If the swap-out protection score is low, the original resident flow table rule is swapped out, the candidate flow table rule is written to that location, and the swap-out protection score is reset. If the swap-out protection score is high, the original resident flow table rule is retained, the candidate flow table rule is not swapped in, and the swap-out protection score of the original resident flow table rule is appropriately reduced. Thus, this embodiment of the application allows only external flow table rules that have been statistically determined to be high-frequency hits and have passed the swap-in permission judgment to have a chance to enter the on-chip flow table. At the same time, by combining the permission protection score and the swap-out protection score, the situation of frequent replacement of existing high-frequency rules by rules in a short period of time is reduced.

[0132] The above describes a flow table management method provided by the embodiments of this application. The following describes the apparatus for performing the above flow table management method.

[0133] Please see Figure 4 , Figure 4 This is a schematic diagram of a flow table management device provided in an embodiment of this application. Figure 4 As shown, the flow table management device includes:

[0134] The flow table query module 401 is used to respond to the packet matching request and query the on-chip flow table and off-chip flow table in sequence based on the packet to be processed in the packet matching request to obtain the query result;

[0135] The identifier acquisition module 402 is used to acquire the rule identifier of the matched external flow table rule when the query result indicates that the message to be processed does not match the intra-chip flow table but matches the external flow table.

[0136] The candidate determination module 403 is used to query the swap-in license table according to the rule identifier, and when the swap-in license item corresponding to the rule identifier is matched, the off-chip flow table rule is determined as a candidate flow table rule;

[0137] The rule processing module 404 is used to replace the candidate flow table rule into the on-chip flow table if the replacement protection score of the resident flow table rule meets the preset replacement condition when the replacement position of the candidate flow table rule in the on-chip flow table already exists.

[0138] The rule processing module 405 is also used to keep the resident flow table rule in the on-chip flow table if the swap protection score of the resident flow table rule does not meet the preset swap conditions.

[0139] Optionally, the network processing device further includes an incoming entry ring, and the flow table management device further includes a permission item generation module. The permission item generation module is used to sample the hit events of the off-chip flow table rules according to a preset sampling strategy when the packet to be processed hits the off-chip flow table, and write the hit information including the rule identifier of the off-chip flow table rule into the incoming entry ring when the hit event meets the sampling conditions; read multiple hit information in the incoming entry ring according to a preset statistical period, and aggregate and statistically analyze the hit information in the preset statistical window according to the rule identifier in each hit information to obtain the rule popularity corresponding to each off-chip flow table rule; determine the hot flow table rules from multiple off-chip flow table rules according to the rule popularity, generate the incoming permission item corresponding to the rule identifier of the hot flow table rule, and write the incoming permission item into the incoming permission table.

[0140] Optionally, the replacement license item includes a license protection score; the license item generation module is further configured to determine the license write position of the replacement license item in the replacement license table; if the license write position is empty, the replacement license item is written to the license write position, and the license protection score of the replacement license item is set to a first initial score; if the original replacement license item already exists in the license write position, if the license protection score of the original replacement license item meets the preset license retention conditions, the original replacement license item is retained, and the license protection score of the original replacement license item is reduced; if the license protection score of the original replacement license item does not meet the preset license retention conditions, the original replacement license item is replaced by the replacement license item, and the license protection score of the replacement license item is set to the first initial score.

[0141] Optionally, the flow table management device further includes a license protection score maintenance module; the license protection score maintenance module is used to increase the license protection score of the swap-in license item corresponding to the external flow table rule when the same external flow table rule is determined as a hot flow table rule in multiple consecutive preset statistical windows; obtain the license update time of the swap-in license item, and reduce or clear the license protection score of the swap-in license item when the time difference between the current time and the license update time reaches a first preset duration.

[0142] Optionally, the flow table management device further includes a swap-out protection score update module; the swap-out protection score update module is used to increase the swap-out protection score of a resident flow table rule when the packet to be processed hits a resident flow table rule in the on-chip flow table; obtain the hit update time of the resident flow table rule, and reduce or clear the swap-out protection score of the resident flow table rule when the time difference between the current time and the hit update time reaches a second preset duration; wherein, the preset swap-out conditions include the swap-out protection score of the resident flow table rule being less than or equal to a preset swap-out threshold.

[0143] Optionally, the flow table management device further includes a swap-in / swap-out execution module; the swap-in / swap-out execution module is used to write the candidate flow table rule into the swap-in position and set the swap-out protection score of the candidate flow table rule to the second initial score when the swap-in position of the candidate flow table rule in the on-chip flow table is empty; when the swap-out protection score of the resident flow table rule meets the preset swap-out conditions, swap out the resident flow table rule, write the candidate flow table rule into the swap-in position and set the swap-out protection score of the candidate flow table rule to the second initial score; when the swap-out protection score of the resident flow table rule does not meet the preset swap-out conditions, reduce the swap-out protection score of the resident flow table rule.

[0144] Optionally, the swap-in permission table has a swap-in enabled state; the flow table management device also includes a learning control module; the learning control module is used to determine the set similarity between the hot flow table rule sets corresponding to multiple consecutive preset statistical windows; when the set similarity meets the preset stability condition, the swap-in enabled state is set to the closed state to stop swapping new candidate flow table rules into the on-chip flow table; when the swap-in enabled state is the closed state, and the miss situation of the on-chip flow table or the change of the hot flow table rule set meets the preset relearning condition, the swap-in enabled state is set to the open state.

[0145] Optionally, the flow table management device further includes a flow table configuration module; the flow table configuration module is used to extract the same packet matching field for the same packet to be processed from the off-chip flow table and the on-chip flow table, and to perform flow table rule matching based on the extracted packet matching field; the storage capacity of the off-chip flow table is greater than the storage capacity of the on-chip flow table; during the flow table initialization phase, the flow table rules belonging to the flow table template are written into the off-chip flow table; when replacing the candidate flow table rule into the on-chip flow table, an on-chip copy of the candidate flow table rule is established in the on-chip flow table, and the off-chip copy of the candidate flow table rule in the off-chip flow table is retained.

[0146] This application also provides a network processing device in its embodiments. (See reference...) Figure 5 The diagram illustrates a network processing device suitable for implementing the flow table management method in this application. The network processing device in this application may include, but is not limited to, devices such as smart network interface cards (SmartNICs), data processing units (DPUs), network processors (NPs), switching chips, routing devices, gateway devices, or other devices capable of matching and processing packets based on flow table rules. Figure 5 The network processing device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0147] like Figure 5As shown, the network processing device may include a processing unit 501, which may include at least one of a central processing unit (CPU), a network processor, a processing core in a data processor, a field-programmable gate array (FPGA), or an application-specific integrated circuit (ASIC). When the processing unit 501 includes a programmable processor, it can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) 502 or a program loaded from storage device 508 into random access memory (RAM) 503. When the network processing device is powered on, RAM 503 also stores various programs and data required for the operation of the network processing device. The processing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output interface (I / O) 505 is also connected to the bus 504.

[0148] Input device 506 connected to I / O interface 505 may include a message receiving interface, flow table configuration interface, device management interface, debugging interface, or other devices for receiving messages, control commands, and configuration data; output device 507 may include a message sending interface, status indication interface, alarm output interface, or other devices for outputting processed messages and device status information; storage device 508 may include flash memory, memory card, disk, solid state drive (SSD), or other storage devices capable of storing flow table rules, computer programs, and runtime data; communication device 509 may be used for wired or wireless communication between the network processing device and host device, control device, or other network device to receive messages to be processed, flow table rules, and control information, or to send processed messages and runtime status information. Communication device 509 may include an Ethernet communication interface, a Peripheral Component Interconnect Express (PCIe) interface, or other communication interfaces. The network processing device can also transmit message data or flow table data between the communication device 509, RAM 503, storage device 508, and processing device 501 via Direct Memory Access (DMA). Although Figure 5A network processing apparatus with various devices is shown; however, it should be understood that implementation or possession of all the devices shown is not required. More or fewer devices may be implemented alternatively.

[0149] This application also provides a computer program product including computer-readable instructions, which, when executed on a network processing device, cause the network processing device to implement any of the flow table management methods provided in this application.

[0150] This application also provides a computer-readable storage medium that carries one or more computer programs. When the one or more computer programs are executed by a network processing device, the network processing device can implement any of the flow table management methods provided in this application.

[0151] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the accompanying drawings of the device embodiments provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0152] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, and of course, it can also be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a network processing device to execute the methods of the various embodiments of this application.

[0153] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0154] A computer program product includes one or more computer program instructions. When these computer-readable instructions are loaded into a network processing device and executed by a corresponding processing apparatus, they can produce, in whole or in part, the processes or functions according to embodiments of this application. The computer-readable instructions can be stored in a computer-readable storage medium or transmitted to a network processing device from a storage device, host device, control device, or data center via a wired or wireless communication link. The wired communication link may include coaxial cable, twisted pair, or optical fiber, etc., and the wireless communication link may include a wireless local area network, a cellular communication network, or other wireless communication methods.

Claims

1. A flow table management method, characterized in that, Applied to a network processing device, the network processing device including a swap-in permission table and off-chip flow tables and on-chip flow tables configured for the same flow table template, the method includes: In response to a packet matching request, the on-chip flow table and the off-chip flow table are queried sequentially based on the unprocessed packets in the packet matching request to obtain the query results; If the query result indicates that the message to be processed does not match the intra-chip flow table but matches the extra-chip flow table, obtain the rule identifier of the matching extra-chip flow table rule; The swap-in permission table is queried according to the rule identifier, and when a swap-in permission item corresponding to the rule identifier is matched, the off-chip flow table rule is determined as a candidate flow table rule. If a resident flow table rule already exists at the swap-in position of the candidate flow table rule in the intra-chip flow table, and the swap-out protection score of the resident flow table rule meets the preset swap-out condition, then the candidate flow table rule is swapped into the intra-chip flow table. If the swap protection score of the resident flow table rule does not meet the preset swap condition, then the resident flow table rule remains in the intra-chip flow table.

2. The flow table management method according to claim 1, characterized in that, The network processing device further includes a swap-in entry ring, wherein the swap-in license entries in the swap-in license table are generated in the following ways: When the message to be processed hits the external flow table, the hit event of the external flow table rule is sampled according to the preset sampling strategy, and when the hit event meets the sampling conditions, the hit information including the rule identifier of the external flow table rule is written into the swap-in table entry ring. According to the preset statistical period, read multiple hit information in the swapped-in table entry ring, and according to the rule identifier in each hit information, aggregate and statistically analyze the hit information in the preset statistical window to obtain the rule popularity corresponding to each outflow table rule. Based on the rule popularity, hot spot flow table rules are determined from multiple off-chip flow table rules, swap-in license items corresponding to the rule identifiers of the hot spot flow table rules are generated, and the swap-in license items are written into the swap-in license table.

3. The method according to claim 2, characterized in that, The swap-in license item includes a license protection score; the step of writing the swap-in license item into the swap-in license table includes: Determine the license write location of the swap-in license item in the swap-in license table; If the license write location is empty, the swap-in license item is written to the license write location, and the license protection score of the swap-in license item is set to the first initial score; If an original swapped-in license item already exists at the license write location, and if the license protection score of the original swapped-in license item meets the preset license retention conditions, then the original swapped-in license item is retained, and the license protection score of the original swapped-in license item is reduced. If the license protection score of the original replacement license does not meet the preset license retention conditions, then the original replacement license is replaced by the replacement license, and the license protection score of the replacement license is set to the first initial score.

4. The method according to claim 3, characterized in that, The method further includes: If the same outflow table rule is identified as the hotspot flow table rule in multiple consecutive preset statistical windows, the license protection score of the swap-in license item corresponding to the outflow table rule is increased. Obtain the license update time of the swapped-in license item, and if the time difference between the current time and the license update time reaches a first preset duration, reduce or clear the license protection score of the swapped-in license item.

5. The method according to claim 1, characterized in that, The method further includes: If the message to be processed matches a resident flow table rule in the on-chip flow table, increase the swap-out protection score of the resident flow table rule. Obtain the hit update time of the resident flow table rule, and if the time difference between the current time and the hit update time reaches a second preset duration, reduce or clear the swap-out protection score of the resident flow table rule. The preset swapping conditions include the swapping protection score of the resident flow table rule being less than or equal to a preset swapping threshold.

6. The method according to claim 5, characterized in that, The method further includes: If the candidate flow table rule is empty at the swap-in position in the intra-chip flow table, the candidate flow table rule is written into the swap-in position, and the swap-out protection score of the candidate flow table rule is set to the second initial score. If the swap-out protection score of the resident flow table rule meets the preset swap-out condition, the resident flow table rule is swapped out, the candidate flow table rule is written into the swap-in position, and the swap-out protection score of the candidate flow table rule is set to the second initial score. If the swap protection score of the resident flow table rule does not meet the preset swap condition, the swap protection score of the resident flow table rule is reduced.

7. The method according to any one of claims 1 to 6, characterized in that, The swap-in permission table has a swap-in enabled state; the method further includes: Determine the set similarity between the rule sets of hotspot flow tables corresponding to multiple consecutive preset statistical windows; If the set similarity meets the preset stability condition, the swap-in enable state is set to the off state to stop swapping new candidate flow table rules into the intra-slice flow table; If the swap-in enable state is off, and the miss situation of the on-chip flow table or the change of the hot spot flow table rule set meets the preset relearning conditions, the swap-in enable state is set to on.

8. The method according to any one of claims 1 to 6, characterized in that, The off-chip flow table and the on-chip flow table extract the same packet matching field for the same packet to be processed, and perform flow table rule matching based on the extracted packet matching field; the storage capacity of the off-chip flow table is greater than the storage capacity of the on-chip flow table. During the flow table initialization phase, flow table rules belonging to the flow table template are written into the off-chip flow table; When the candidate flow table rule is swapped into the intra-chip flow table, an intra-chip copy of the candidate flow table rule is created in the intra-chip flow table, and an off-chip copy of the candidate flow table rule in the off-chip flow table is retained.

9. A network processing device, characterized in that, It includes at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is configured to execute the computer program to enable the network processing device to implement the method as described in any one of claims 1 to 8.

10. A computer storage medium, characterized in that, The storage medium carries one or more computer programs that, when executed by a network processing device, enable the network processing device to implement the method as described in any one of claims 1 to 8.

Images