KR102880085B1 - Network Interface Device - Google Patents

Abstract

A network interface device comprising a hardware module comprising a plurality of processing units, each of which is associated with at least one predefined operation thereof. At compile time, the hardware module is configured to arrange at least some of the plurality of processing units to perform at least one operation of each of them in a predetermined order in relation to the data packet, in order to perform a function in relation to the data packet. A compiler is provided for assigning different processing stages to each processing unit. A controller is provided for switching between different processing circuitry on the fly, such that one processing circuitry may be used while another processing circuitry is being compiled.

Description

Network Interface Device

The present application relates to a network interface device for performing a function in relation to a data packet.

Network interface devices are known and are commonly used to provide an interface between a computing device and a network. A network interface device may be configured to process data received from a network and/or to process data to be placed on a network.

According to one aspect, a network interface device for interfacing a host device to a network is provided, the network interface device comprising: a first interface, the first interface configured to receive a plurality of data packets; a configurable hardware module comprising a plurality of processing units, each processing unit being associated with a predefined type of operation executable in a single step, wherein at least some of the plurality of processing units are associated with different predefined types of operations, and the hardware module is configured to interconnect at least some of the plurality of processing units to provide a first data processing pipeline for processing one or more of the plurality of data packets to perform a first function in relation to the one or more of the plurality of data packets.

In some embodiments, the first function comprises a filtering function. In some embodiments, the function comprises at least one of tunneling, encapsulation, and routing functions. In some embodiments, the first function comprises an extended Berkley packet filter function.

In some embodiments, the first function comprises a distributed denial of service scrubbing operation.

In some embodiments, the first function comprises firewall operation.

In some embodiments, the first interface is configured to receive a first data packet from a network.

In some embodiments, the first interface is configured to receive a first data packet from a host device.

In some embodiments, at least two of the plurality of processing units are configured to perform their associated at least one predefined operation in parallel.

In some embodiments, at least two of the plurality of processing units are configured to perform their associated predefined types of operations in response to a common clock signal of the hardware module.

In some embodiments, at least two of the plurality of processing units are each configured to perform their associated predefined type of operation within a predefined length of time defined by a clock signal.

In some embodiments, at least two of the plurality of processing units are configured to: access the first data packet within a time period of a predefined length; and, in response to the expiration of the time period of the predefined length, transmit the results of each of the at least one operations to a next processing unit.

In some embodiments, the result includes at least one of the following: a value from at least one of the plurality of data packets; an update to the map state; and metadata.

In some embodiments, each of the plurality of processing units includes an application-specific integrated circuit configured to perform at least one operation associated with each processing unit.

In some embodiments, each of the processing units includes a field programmable gate array. In some embodiments, each of the processing units includes any other type of soft logic.

In some embodiments, at least one of the plurality of processing units includes a digital circuit and a memory that stores state related to processing performed by the digital circuit, wherein the digital circuit is configured to communicate with the memory and perform a predefined type of operation associated with each processing unit.

In some embodiments, the network interface device includes a memory accessible to two or more of the plurality of processing units, the memory configured to store a state associated with the first data packet, and during performance of the first function by the hardware module, the two or more of the plurality of processing units are configured to access and modify the state.

In some embodiments, at least a first one of the plurality of processing units is configured to stall during access of a value of a state by a second one of the plurality of processing units.

In some embodiments, one or more of the plurality of processing units are individually configurable to perform operations unique to each pipeline based on their associated predefined types of operations.

In some embodiments, the hardware module is configured to receive a command and, in response to the command, to do at least one of the following: interconnecting at least some of the plurality of processing units to provide a data processing pipeline for processing one or more of the plurality of data packets; causing one or more of the plurality of processing units to perform their associated predefined types of operations with respect to the one or more data packets; adding one or more of the plurality of processing units to the data processing pipeline; and removing one or more of the plurality of processing units from the data processing pipeline.

In some embodiments, the predefined operation includes at least one of the following: loading at least one value of the first data packet from memory; storing at least one value of the data packet to memory; and performing a lookup against a lookup table to determine an action to be performed with respect to the data packet.

In some embodiments, the hardware module is configured to receive a command, wherein the hardware module is configured to interconnect at least some of the plurality of processing units to provide a data processing pipeline for processing one or more of the plurality of data packets, in response to the command, the command comprising a data packet transmitted through the third processing pipeline.

In some embodiments, at least one of the plurality of processing units is configured, in response to the instruction, to perform a selected operation among their associated predefined types of operations with respect to the one or more data packets among the plurality of data packets.

In some embodiments, the plurality of components comprises a second one of the plurality of components configured to provide the first function in circuitry different from the hardware module, wherein the network interface device comprises at least one controller configured to cause a data packet passing through the processing pipeline to be processed by one of the first one of the plurality of components and the second one of the plurality of components.

In some embodiments, a network interface device includes at least one controller configured to issue a command to cause a hardware module to initiate performance of a first function relating to a data packet, the command being configured to cause a first one of the plurality of components to be inserted into a processing pipeline.

In some embodiments, a network interface device includes at least one controller configured to issue a command to cause a hardware module to begin performing a first function in connection with a data packet, the command comprising a control message transmitted through a processing pipeline and configured to cause a first one of the plurality of components to become active.

In some embodiments, for at least one of the plurality of processing units, the associated at least one operation comprises at least one of the following: loading at least one value of the first data packet from memory of the network interface device; storing at least one value of the first data packet to memory of the network interface device; and performing a lookup against a lookup table to determine an action to be performed with respect to the first data packet.

In some embodiments, at least one of the plurality of processing units is configured to pass at least one result of its associated at least one predefined operation to a next processing unit in the first processing pipeline, wherein the next processing unit is configured to perform a next predefined operation dependent on the at least one result.

In some embodiments, each of the different predefined types of actions is defined by a different template.

In some embodiments, the predefined type of operation includes at least one of the following: accessing a data packet; accessing a lookup table stored in a memory of a hardware module; performing a logical operation on data loaded from the data packet; and performing a logical operation on data loaded from the lookup table.

In some embodiments, the hardware module comprises routing hardware, wherein the hardware module is configured to interconnect at least some of the plurality of processing units to provide a first data processing pipeline by configuring the routing hardware to route data packets among the plurality of processing units in a particular order defined by the first data processing pipeline.

In some embodiments, the hardware module is configured to interconnect at least some of the plurality of processing units to perform a second function different from the first function by providing a second data processing pipeline for processing one or more of the plurality of data packets.

In some embodiments, the hardware module is configured to interconnect at least some of the plurality of processing units to provide a first data processing pipeline, and then interconnect at least some of the plurality of processing units to provide a second data processing pipeline.

In some embodiments, the network interface device includes additional circuitry separate from the hardware module and configured to perform a first function for one or more of the plurality of data packets.

In some embodiments, the additional circuitry includes at least one of: a field programmable gate array; and a plurality of central processing units.

In some embodiments, the network interface device comprises at least one controller, wherein additional circuitry is configured to perform a first function with respect to a data packet during a compilation process for a first function to be performed in a hardware module, and wherein the at least one controller is configured to control the hardware module to initiate performance of the first function with respect to the data packet in response to completion of the compilation process.

In some embodiments, the additional circuitry includes a plurality of central processing units.

In some embodiments, at least one controller is configured to control additional circuitry to stop performing the first function associated with the data packet in response to determining that the compilation process for the first function to be performed in the hardware module is complete.

In some embodiments, the network interface device comprises at least one controller, wherein the hardware module is configured to perform a first function with respect to a data packet during a compilation process for a first function to be performed in an additional circuitry, and wherein the at least one controller is configured to determine that the compilation process for the first function to be performed in the additional circuitry is complete, and, in response to the determination, control the additional circuitry to initiate performance of the first function with respect to the data packet.

In some embodiments, the additional circuitry includes a field programmable gate array.

In some embodiments, at least one controller is configured to control a hardware module to stop performing the first function associated with the data packet in response to a determination that the compilation process for the first function to be performed in the additional circuitry has been completed.

In some embodiments, the network interface device includes at least one controller configured to perform a compilation process to provide a first function to be performed in a hardware module.

In some embodiments, the compilation process includes providing instructions for providing a control plane interface that responds to control messages from hardware modules.

According to another aspect, a data processing system is provided comprising a network interface device and a host device according to the first aspect, wherein the data processing system comprises at least one controller configured to perform a compilation process to provide a first function to be performed in a hardware module.

In some embodiments, at least one controller is provided by one or more of the following: a network interface device; and a host device.

In some embodiments, the compilation process is performed in response to a determination by at least one controller that the computer program representing the first function is safe for execution in kernel mode of the host device.

In some embodiments, at least one controller is configured to perform a compilation process by assigning, to each of at least some of the plurality of processing units, at least one operation from a plurality of operations represented by a sequence of computer code instructions to be performed in a particular order in a first data processing pipeline, wherein the plurality of operations provide a first function in relation to one or more of the plurality of data packets.

In some embodiments, at least one controller is configured to: prior to completion of the compilation process, transmit a first command to cause additional circuitry of the network interface device to perform a first function with respect to the data packet; and subsequent to completion of the compilation process, transmit a second command to cause the hardware module to begin performing the first function with respect to the data packet.

In another aspect, a method for implementation in a network interface device is provided, the method comprising: receiving, at a first interface, a plurality of data packets; and configuring a hardware module to interconnect at least some of a plurality of processing units of the hardware module to provide a first data processing pipeline for processing at least one of the plurality of data packets to perform a first function in relation to the at least one of the plurality of data packets, wherein each processing unit is associated with a predefined type of operation executable in a single step, and wherein at least some of the plurality of processing units are associated with different predefined types of operations.

In another aspect, a non-transitory computer-readable medium is provided comprising program instructions for causing a network interface device to perform a method, the method comprising: receiving, at a first interface, a plurality of data packets; and configuring a hardware module to interconnect at least some of a plurality of processing units of the hardware module to provide a first data processing pipeline for processing at least one of the plurality of data packets to perform a first function in relation to the at least one of the plurality of data packets, wherein each processing unit is associated with a predefined type of operation executable in a single step, and wherein at least some of the plurality of processing units are associated with different predefined types of operations.

In another aspect, a processing unit is provided, the processing unit configured to: perform at least one predefined operation in relation to a first data packet received at a network interface device; be connected to a first additional processing unit configured to perform a first additional at least one predefined operation in relation to the first data packet; be connected to a second additional processing unit configured to perform a second additional at least one predefined operation in relation to the first data packet; receive, from the first additional processing unit, a result of the first additional at least one predefined operation; perform at least one predefined operation dependent on a result of the first additional at least one predefined operation; and transmit a result of the at least one predefined operation to the second additional processing unit for processing in the second additional at least one predefined operation.

In some embodiments, the processing unit is configured to receive a clock signal for timing at least one predefined operation, wherein the processing unit is configured to perform at least one predefined operation in at least one cycle of the clock signal.

In some embodiments, the processing unit is configured to perform at least one predefined operation in a single cycle of a clock signal.

In some embodiments, the at least one predefined operation, the first additional at least one predefined operation, and the second additional at least one predefined operation form part of a function performed in connection with a first data packet received at the network interface device.

In some embodiments, the first data packet is received from a host device, wherein the network interface device is configured to interface the host device to a network.

In some embodiments, the first data packet is received from a network, wherein the network interface device is configured to interface the host device to the network.

In some embodiments, the function is a filtering function.

In some embodiments, the filtering function is an extended Berkeley packet filter function.

In some embodiments, the processing unit comprises a custom integrated circuit configured to perform at least one predefined operation.

In some embodiments, the processing unit includes: a digital circuit configured to perform at least one predefined operation; and a memory that stores state related to the at least one predefined operation being performed.

In some embodiments, the processing unit is configured to access a memory accessible to the first additional processing unit and the second additional processing unit, the memory being configured to store a state associated with the first data packet, and wherein the at least one predefined operation comprises modifying the state stored in the memory.

In some embodiments, the processing unit is configured to read a value of the state from memory during a first clock cycle and provide the value to a second additional processing unit for modification by the second additional processing unit, wherein the processing unit is configured to stall during a second clock cycle following the first clock cycle.

In some embodiments, the at least one predefined operation comprises at least one of the following: loading a first data packet from memory of the network interface device; storing the first data packet in memory of the network interface device; and performing a lookup on a lookup table to determine an action to be performed with respect to the first data packet.

According to another aspect, a method implemented in a processing unit is provided, the method comprising: performing at least one predefined operation in relation to a first data packet received at a network interface device; connecting to a first additional processing unit configured to perform a first additional at least one predefined operation in relation to the first data packet; connecting to a second additional processing unit configured to perform a second additional at least one predefined operation in relation to the first data packet; receiving from the first additional processing unit a result of the first additional at least one predefined operation; performing at least one predefined operation dependent on a result of the first additional at least one predefined operation; and transmitting the result of the at least one predefined operation to the second additional processing unit for processing in the second additional at least one predefined operation.

In another aspect, a computer-readable non-transitory storage device is provided that stores instructions that, when executed by a processing unit, cause the processing unit to perform a method comprising: performing at least one predefined operation in relation to a first data packet received at a network interface device; connecting to a first additional processing unit configured to perform a first additional at least one predefined operation in relation to the first data packet; connecting to a second additional processing unit configured to perform a second additional at least one predefined operation in relation to the first data packet; receiving from the first additional processing unit a result of the first additional at least one predefined operation; performing at least one predefined operation dependent on a result of the first additional at least one predefined operation; and transmitting a result of the at least one predefined operation to the second additional processing unit for processing in the second additional at least one predefined operation.

In another aspect, a network interface device for interfacing a host device to a network is provided, the network interface device comprising: at least one controller; a first interface, the first interface configured to receive a data packet; a first circuitry configured to perform a first function in relation to a data packet received at the first interface; and a second circuitry, wherein the first circuitry is configured to perform the first function in relation to the data packet received at the first interface during a compilation process for the first function to be performed at the second circuitry, and wherein the at least one controller is configured to determine whether the compilation process for the first function to be performed at the second circuitry is complete and, in response to the determination, control the second circuitry to initiate performance of the first function in relation to the data packet received at the first interface.

In some embodiments, at least one controller is configured to control the first circuit unit to stop performing the first function with respect to the data packet received at the first interface in response to a determination that the compilation process for the first function to be performed at the second circuit unit is complete.

In some embodiments, at least one controller is configured to control the first circuit unit to, in response to a determination that the compilation process for the first function to be performed in the second circuit unit is complete: to start performing the first function with respect to a data packet of the first data flow received at the first interface; and to stop performing the first function with respect to the data packet of the first data flow.

In some embodiments, the first circuit unit includes at least one central processing unit, each of the at least one central processing unit configured to perform a first function in relation to at least one data packet received at the first interface.

In some embodiments, the second circuit unit includes a field programmable gate array configured to initiate performance of a first function in connection with a data packet received at the first interface.

In some embodiments, the second circuit unit comprises a hardware module comprising a plurality of processing units, each processing unit being associated with at least one predefined operation, the first interface being configured to receive the first data packet, and the hardware module being configured to cause at least some of the plurality of processing units to perform their associated at least one predefined operation in a particular order to perform the first function in relation to the first data packet, subsequent to a compilation process for the first function to be performed in the second circuit unit.

In some embodiments, the first circuit unit comprises a hardware module comprising a plurality of processing units, each processing unit being associated with at least one predefined operation, the first interface being configured to receive a first data packet, and the hardware module being configured to cause, during a compilation process for a first function to be performed in the second circuit unit, at least some of the plurality of processing units to perform their associated at least one predefined operation in a particular order to perform the first function in relation to the first data packet.

In some embodiments, at least one controller is configured to perform a compilation process to compile the first function to be performed by the second circuit unit.

In some embodiments, at least one controller is configured to: instruct the first circuit to perform a first function with respect to a data packet received at the first interface prior to completion of the compilation process.

In some embodiments, a compilation process for compiling a first function to be performed by a second circuit unit is performed by a host device, wherein at least one controller is configured to determine that the compilation process is complete in response to receiving an indication of completion of the compilation process from the host device.

In some embodiments, a processing pipeline for processing a data packet received at a first interface is provided, the processing pipeline including a plurality of components each configured to perform one of a plurality of functions in relation to the data packet received at the first interface, a first of the plurality of components being configured to provide the first function when provided by the first circuitry, and a second of the plurality of components being configured to provide the first function when provided by the second at least one processing unit.

In some embodiments, at least one controller is configured to control the second circuitry to initiate performance of a first function in connection with a data packet received at the first interface by inserting a second one of the plurality of components into the processing pipeline.

In some embodiments, at least one controller is configured to control the first circuit unit to stop performing the first function with respect to the data packet received at the first interface by removing a first one of the plurality of components from the processing pipeline in response to determining that the compilation process for the first function to be performed at the second circuit unit is complete.

In some embodiments, at least one controller is configured to control the second circuitry to initiate performance of a first function in connection with a data packet received at the first interface by sending a control message through the processing pipeline to activate a second one of the plurality of components.

In some embodiments, at least one controller is configured to control the first circuit unit to stop performing the first function with respect to the data packet received at the first interface by sending a control message through the processing pipeline to disable a second one of the plurality of components in response to a determination that the compilation process for the first function to be performed at the second circuit unit is complete.

In some embodiments, a first of the plurality of components is configured to provide a first function in relation to data packets of a first data flow passing through the processing pipeline, and a second of the plurality of components is configured to provide a first function in relation to data packets of a second data flow passing through the processing pipeline.

In some embodiments, the first function includes filtering data packets.

In some embodiments, the first interface is configured to receive data packets from a network.

In some embodiments, the first interface is configured to receive data packets from a host device.

In some embodiments, the compilation time of the first function for the second circuit unit is greater than the compilation time of the first function for the first circuit unit.

In another aspect, a method is provided, comprising: receiving a data packet at a first interface of a network interface device; performing, at a first circuit portion of the network interface device, a first function with respect to the data packet received at the first interface; wherein the first circuit portion is configured to perform the first function with respect to the data packet received at the first interface during a compilation process for a first function to be performed at a second circuit portion, the method comprising: determining that the compilation process for the first function to be performed at the second circuit portion is complete; and controlling, in response to the determination, the second circuit portion of the network interface device to initiate performance of the first function with respect to the data packet received at the first interface.

In another aspect, a non-transitory computer-readable medium is provided comprising program instructions for causing a data processing system to perform a method, the method comprising: receiving a data packet at a first interface of a network interface device; performing, at a first circuitry of the network interface device, a first function with respect to the data packet received at the first interface, wherein the first circuitry is configured to perform the first function with respect to the data packet received at the first interface during a compilation process for the first function to be performed at a second circuitry, the method comprising: determining that the compilation process for the first function to be performed at the second circuitry is complete; and controlling, in response to the determination, the second circuitry of the network interface device to initiate performance of the first function with respect to the data packet received at the first interface.

In another aspect, a non-transitory computer-readable medium is provided comprising program instructions for causing a data processing system to: perform a compilation process to compile a first function to be performed by a second circuitry of a network interface device; prior to completion of the compilation process, transmitting a first instruction for causing the first circuitry of the network interface device to perform the first function in relation to a data packet received at a first interface of the network interface device; and subsequent to completion of the compilation process, transmitting a second instruction for causing the second circuitry to begin performing the first function in relation to the data packet received at the first interface.

In some embodiments, the non-transitory computer-readable medium includes program instructions for causing the data processing system to perform an additional compilation process to compile a first function to be performed by the first circuitry, wherein the compilation process takes longer than the additional compilation process.

In some embodiments, the data processing system includes a host device, wherein the network interface device is configured to interface the host device with a network.

In some embodiments, the data comprising the system comprises a network interface device, wherein the network interface device is configured to interface the host device with a network.

In some embodiments, the data processing system includes a host device and a network interface device, wherein the network interface device is configured to interface the host device with a network.

In some embodiments, the first function comprises filtering data packets received at the first interface from the network.

In some embodiments, the non-transitory computer-readable medium includes program instructions for causing the data processing system to: transmit a third instruction to cause the first circuit unit to stop performing a function related to a data packet received at the first interface, subsequent to completion of the compilation process.

In some embodiments, a non-transitory computer-readable medium includes program instructions for causing a data processing system to: transmit instructions for causing a second circuit unit to perform a first function with respect to data packets of a first data flow; and transmit instructions for causing the first circuit unit to stop performing the first function with respect to data packets of the first data flow.

In some embodiments, the first circuitry includes at least one central processing unit, wherein prior to completion of the second compilation process, each of the at least one central processing unit is configured to perform a first function in relation to at least one data packet received at the first interface.

In some embodiments, the second circuit unit includes a field programmable gate array configured to initiate performance of a first function in connection with a data packet received at the first interface.

In some embodiments, the second circuitry comprises a hardware module comprising a plurality of processing units, each processing unit being associated with at least one predefined operation, wherein a data packet received at the first interface comprises a first data packet, and wherein the hardware module is configured to perform a first function with respect to the first data packet by causing each processing unit of at least some of the plurality of processing units to perform its respective at least one operation with respect to the first data packet subsequent to completion of the second compilation process.

In some embodiments, the first circuit unit comprises a hardware module comprising a plurality of processing units configured to provide a first function in relation to a data packet, each processing unit being associated with at least one predefined operation, wherein a data packet received at the first interface comprises the first data packet, and wherein the hardware module is configured to perform the first function in relation to the first data packet by causing each processing unit of at least some of the plurality of processing units to perform its respective at least one operation in relation to the first data packet prior to completion of the second compilation process.

In some embodiments, the compilation process includes assigning, to each of the plurality of processing units of the second circuitry, to perform, in a particular order, at least one operation associated with one of the plurality of processing stages of a sequence of computer code instructions.

In some embodiments, the first function provided by the first circuit unit is provided as a component of a processing pipeline for processing a data packet received at the first interface, and the first function provided by the second circuit unit is provided as a component of the processing pipeline.

In some embodiments, the first instruction comprises an instruction configured to cause a first one of the plurality of components to be inserted into the processing pipeline.

In some embodiments, the second instruction comprises an instruction configured to cause a second one of the plurality of components to be inserted into the processing pipeline.

In some embodiments, a non-transitory computer-readable medium includes program instructions for causing a data processing system to: subsequent to completion of a compilation process, transmit a third instruction to cause a first circuit unit to cease performing a first function associated with a data packet received at a first interface, wherein the third instruction comprises instructions configured to cause a first one of the plurality of components to be removed from a processing pipeline.

In some embodiments, the first command includes a control message to be transmitted through the processing pipeline to activate a second one of the plurality of components.

In some embodiments, the second instruction comprises a control message to be transmitted through the processing pipeline to activate a second one of the plurality of components.

In some embodiments, a non-transitory computer-readable medium includes program instructions that cause a data processing system to: subsequent to completion of the compilation process, transmit a third instruction to cause the first circuitry to cease performing a function associated with a data packet received at the first interface, the third instruction comprising a control message that passes through a processing pipeline to disable a first one of the plurality of components.

According to another aspect, a data processing system is provided, comprising at least one processor and at least one memory including computer program code, wherein the at least one memory and the computer program code, together with the at least one processor, are configured to cause the data processing system to: perform a compilation process to compile a function to be performed by a second circuit unit of a network interface device; prior to completion of the compilation process, instruct the first circuit unit of the network interface device to perform a function in relation to a data packet received at a first interface of the network interface device; and subsequent to completion of the second compilation process, instruct a second at least one processing unit to begin performing the function in relation to the data packet received at the first interface.

According to another aspect, a method for implementation in a data processing system is provided, the method comprising: performing a compilation process to compile a function to be performed by a second circuitry of a network interface device; prior to completion of the compilation process, transmitting a first command to cause a first circuitry of the network interface device to perform a function in relation to a data packet received at a first interface of the network interface device; and subsequent to completion of the compilation process, transmitting a second command to cause the second circuitry to start performing the function in relation to the data packet received at the first interface.

In another aspect, a non-transitory computer-readable medium is provided comprising program instructions for causing a data processing system to assign, in a particular order, at least one operation associated with each of a plurality of processing stages of a sequence of computer code instructions to each of a plurality of processing units, wherein the plurality of processing stages provide a first function in relation to a first data packet received at a first interface of a network interface device, wherein each of the plurality of processing units is configured to perform one of a plurality of types of processing, at least some of the plurality of processing units are configured to perform different types of processing, and wherein, for each of the plurality of processing units, the assigning is performed based on determining that the processing unit is configured to perform a type of processing appropriate for performing each of the at least one operation.

In some embodiments, each type of processing is defined by one of a plurality of templates.

In some embodiments, the type of processing includes at least one of the following: accessing a data packet received at a network interface device; accessing a lookup table stored in a memory of a hardware module; performing a logical operation on data loaded from the data packet; and performing a logical operation on data loaded from the lookup table.

In some embodiments, at least two of the plurality of processing units are configured to perform at least one of their associated operations in response to a common clock signal of the hardware module.

In some embodiments, assigning comprises assigning to each of two or more of at least some of the plurality of processing units to perform at least one associated operation within a predefined length of time defined by a clock signal.

In some embodiments, assigning comprises assigning access to the first data packet within a time period of a predefined length to at least two of the plurality of processing units.

In some embodiments, the assigning comprises, in response to the expiration of a time period of a predefined length, assigning to each of two or more of at least some of the plurality of processing units, the results of each of the at least one operations, to be transferred to a next processing unit.

In some embodiments, a non-transitory computer-readable medium includes program instructions for causing a data processing system to: assign at least some of the plurality of stages to occupy a single clock cycle.

In some embodiments, a non-transitory computer-readable medium includes program instructions for causing a data processing system to assign at least one of a plurality of processing units to perform their assigned operations in parallel.

In some embodiments, the network interface device comprises a hardware module comprising a plurality of processing units.

In some embodiments, a non-transitory computer-readable medium includes computer program instructions for causing a data processing system to: perform a compilation process including an assignment; prior to completion of the compilation process, transmit a first instruction for causing circuitry of a network interface device to perform a first function with respect to a data packet received at a first interface; and subsequent to completion of the compilation process, transmit a second instruction for causing a plurality of processing units to begin performing the first function with respect to the data packet received at the first interface.

In some embodiments, for at least one of the plurality of processing units, the assigned at least one operation comprises at least one of the following: loading at least one value of the first data packet from memory of the network interface device; storing at least one value of the first data packet to memory of the network interface device; and performing a lookup against a lookup table to determine an action to be performed with respect to the first data packet.

In some embodiments, a non-transitory computer-readable medium includes computer program instructions for causing a data processing system to issue instructions to configure routing hardware of a network interface device to route a first data packet among a plurality of processing units in a particular order to perform a first function with respect to the first data packet.

In some embodiments, the first function provided by the plurality of processing units is provided as a component of a processing pipeline for processing data packets received at the first interface.

In some embodiments, a non-transitory computer-readable medium includes computer program instructions for causing a data processing system to issue instructions to cause a component to be inserted into a processing pipeline, thereby causing a plurality of processing units to perform a first function in relation to a data packet received at a first interface.

In some embodiments, a non-transitory computer-readable medium includes computer program instructions for causing a plurality of processing units to perform a first function in relation to a data packet received at a first interface by causing the data processing system to issue instructions to cause the components to be activated in a processing pipeline.

In some embodiments, the data processing system includes a host device, wherein the network interface device is configured to interface the host device with a network.

In some embodiments, the data processing system includes a network interface device.

In some embodiments, a data processing system comprises: a network interface device; and a host device, wherein the network interface device is configured to interface the host device with a network.

In another aspect, a data processing system is provided, comprising at least one processor and at least one memory including computer program code, wherein the at least one memory and the computer program code, together with the at least one processor, are configured to cause the data processing system to assign, in a particular order, at least one operation associated with one of a plurality of processing stages of a sequence of computer code instructions to each of a plurality of processing units, the plurality of processing stages providing a first function in relation to a first data packet received at a first interface of a network interface device, each of the plurality of processing units configured to perform one of a plurality of types of processing, at least some of the plurality of processing units configured to perform different types of processing, and wherein, for each of the plurality of processing units, the assigning is performed based on determining that the processing unit is configured to perform a type of processing appropriate for performing each of the at least one operation.

According to another aspect, a method is provided, comprising assigning, to each of a plurality of processing units, to perform, in a particular order, at least one operation associated with one of a plurality of processing stages of a sequence of computer code instructions, the plurality of processing stages providing a first function in relation to a first data packet received at a first interface of a network interface device, each of the plurality of processing units configured to perform one of a plurality of types of processing, at least some of the plurality of processing units configured to perform different types of processing, and for each of the plurality of processing units, the assigning is performed based on determining that the processing unit is configured to perform a type of processing appropriate for performing each of the at least one operation.

The processing units of the hardware modules have been described as performing their types of operations in a single step. However, those skilled in the art will recognize that this feature is merely a desirable feature and is not essential or indispensable to the functioning of the present invention.

According to one aspect, a method is provided comprising: receiving, in a compiler, a bit file description of a circuit, the bit file description including a description of the routing of a portion of the circuit, and a program; and compiling the program using the bit file description to output a bit file for the program.

The method may include using the bit file to configure at least a portion of the circuit to perform a function associated with the program.

The bit file description may also include information regarding routing between multiple processing units of the circuit.

The bit file description may include routing information for at least one of the plurality of processing units that indicates at least one of the following: to which one or more other processing units the data can be output; and from which one or more other processing units the data can be received.

A bit file description may also include routing information indicating one or more routes between two or more respective processing units.

A bit file description may also contain information indicating only the roots that are available to the compiler when compiling a program to provide a bit file for the program.

The bit file may include information indicating, for each processing unit, at least one of the following: whether an input is to be provided in the bit file description for each processing unit from any one or more of the other processing units; and whether an output is to be provided in the bit file description for each processing unit from any one or more of the other processing units.

A portion of the circuit may include at least a portion of a configurable hardware module comprising a plurality of processing units, each processing unit being associated with a predefined type of operation executable in a single step, at least some of the plurality of processing units being associated with different predefined types of operations, the bit file description including information regarding routing between at least some of the plurality of processing units, and the method may include using the bit file to provide a first data processing pipeline for processing one or more of the plurality of data packets to cause hardware to interconnect at least some of the plurality of processing units to perform a first function in relation to the one or more of the plurality of data packets.

The bit file description may be for at least part of the FPGA.

The bit file description may be part of a dynamically programmable FPGA.

The program may include either an eBPF program or a P4 program.

The compiler and FPGA may also be provided in the network interface device.

According to another aspect, a device is provided comprising at least one processor and at least one memory comprising computer code for one or more programs, wherein the at least one memory and the computer code are configured to cause the device, together with the at least one processor, to at least: receive a bit file description, the bit file description including a description of the routing of a portion of a circuit, and a program; and compile the program using the bit file description to output a bit file for the program.

At least one memory and computer code may be configured to cause the device, together with at least one processor, to use the bit file to configure at least a portion of the circuitry to perform a function associated with the program.

The bit file description may also include information regarding routing between multiple processing units of the circuit.

The bit file description may include routing information for at least one of the plurality of processing units that indicates at least one of the following: to which one or more other processing units the data can be output; and from which one or more other processing units the data can be received.

A bit file description may also include routing information indicating one or more routes between two or more respective processing units.

A bit file description may also contain information indicating only the roots that are available to the compiler when compiling a program to provide a bit file for the program.

The bit file may include information indicating, for each processing unit, at least one of the following: whether an input is to be provided in the bit file description for each processing unit from any one or more of the other processing units; and whether an output is to be provided in the bit file description for each processing unit from any one or more of the other processing units.

A portion of the circuit may include at least a portion of a configurable hardware module comprising a plurality of processing units, each processing unit being associated with a predefined type of operation executable in a single step, at least some of the plurality of processing units being associated with different predefined types of operations, the bit file description including information regarding routing between at least some of the plurality of processing units, and at least one memory and computer code configured to cause the device, together with at least one processor, to use the bit file to provide a first data processing pipeline for processing one or more of the plurality of data packets, thereby causing the hardware to interconnect at least some of the plurality of processing units to perform a first function in relation to the one or more of the plurality of data packets.

The bit file description may be for at least part of the FPGA.

The bit file description may be part of a dynamically programmable FPGA.

The program may include either an eBPF program or a P4 program.

In another aspect, a network interface device is provided, comprising: a configurable hardware module comprising: a first interface, the first interface configured to receive a plurality of data packets; a plurality of processing units, each processing unit associated with a predefined type of operation executable in a single step; a compiler, the compiler configured to receive a bit file description, the bit file description including a description of routing of at least a portion of the configurable hardware module; and a program, and to compile the program using the bit file description to output a bit file for the program, wherein the hardware module is configurable using the bit file to perform a first function associated with the program.

A network interface device may be intended to interface a host device to a network.

At least some of the above plurality of processing units may be associated with different predefined types of operations.

The hardware module may be configured to interconnect at least some of the plurality of processing units to provide a first data processing pipeline for processing one or more of the plurality of data packets to perform a first function in relation to the one or more of the plurality of data packets.

In some embodiments, the first function comprises a filtering function. In some embodiments, the function comprises at least one of tunneling, encapsulation, and routing functions. In some embodiments, the first function comprises an extended Berkeley packet filter function.

In some embodiments, the first function comprises a distributed denial-of-service scrubbing operation.

In some embodiments, the first function comprises firewall operation.

In some embodiments, the first interface is configured to receive a first data packet from a network.

In some embodiments, the first interface is configured to receive a first data packet from a host device.

In some embodiments, at least two of the plurality of processing units are configured to perform their associated at least one predefined operation in parallel.

In some embodiments, at least two of the plurality of processing units are configured to perform their associated predefined types of operations in response to a common clock signal of the hardware module.

In some embodiments, at least two of the plurality of processing units are each configured to perform their associated predefined type of operation within a predefined length of time defined by a clock signal.

In some embodiments, at least two of the plurality of processing units are configured to: access the first data packet within a time period of a predefined length; and, in response to the expiration of the time period of the predefined length, transmit the results of each of the at least one operations to a next processing unit.

In some embodiments, the result includes at least one of the following: a value from at least one of the plurality of data packets; an update to the map state; and metadata.

In some embodiments, each of the plurality of processing units includes an application-specific integrated circuit configured to perform at least one operation associated with each processing unit.

In some embodiments, each of the processing units includes a field programmable gate array. In some embodiments, each of the processing units includes any other type of soft logic.

In some embodiments, at least one of the plurality of processing units includes a digital circuit and a memory that stores state related to processing performed by the digital circuit, wherein the digital circuit is configured to communicate with the memory and perform a predefined type of operation associated with each processing unit.

In some embodiments, the network interface device includes a memory accessible to two or more of the plurality of processing units, the memory configured to store a state associated with the first data packet, and during performance of the first function by the hardware module, the two or more of the plurality of processing units are configured to access and modify the state.

In some embodiments, at least a first one of the plurality of processing units is configured to stall during access of a value of a state by a second one of the plurality of processing units.

In some embodiments, one or more of the plurality of processing units are individually configurable to perform operations unique to each pipeline based on their associated predefined types of operations.

In some embodiments, the hardware module is configured to receive a command and, in response to the command, to do at least one of the following: interconnecting at least some of the plurality of processing units to provide a data processing pipeline for processing one or more of the plurality of data packets; causing one or more of the plurality of processing units to perform their associated predefined types of operations with respect to the one or more data packets; adding one or more of the plurality of processing units to the data processing pipeline; and removing one or more of the plurality of processing units from the data processing pipeline.

In some embodiments, the predefined operation includes at least one of the following: loading at least one value of the first data packet from memory; storing at least one value of the data packet to memory; and performing a lookup against a lookup table to determine an action to be performed with respect to the data packet.

In some embodiments, the hardware module is configured to receive a command, wherein the hardware module is configured to interconnect at least some of the plurality of processing units to provide a data processing pipeline for processing one or more of the plurality of data packets, in response to the command, the command comprising a data packet transmitted through the third processing pipeline.

In some embodiments, at least one of the plurality of processing units is configured, in response to the instruction, to perform a selected operation among their associated predefined types of operations with respect to the one or more data packets among the plurality of data packets.

In some embodiments, the plurality of components comprises a second one of the plurality of components configured to provide the first function in a circuit different from the hardware module, wherein the network interface device comprises at least one controller configured to cause a data packet passing through the processing pipeline to be processed by one of: the first one of the plurality of components and the second one of the plurality of components.

In some embodiments, a network interface device includes at least one controller configured to issue a command to cause a hardware module to initiate performance of a first function relating to a data packet, the command being configured to cause a first one of the plurality of components to be inserted into a processing pipeline.

In some embodiments, a network interface device includes at least one controller configured to issue a command to cause a hardware module to begin performing a first function in connection with a data packet, the command comprising a control message transmitted through a processing pipeline and configured to cause a first one of the plurality of components to become active.

In some embodiments, for at least one of the plurality of processing units, the associated at least one operation comprises at least one of the following: loading at least one value of the first data packet from memory of the network interface device; storing at least one value of the first data packet to memory of the network interface device; and performing a lookup against a lookup table to determine an action to be performed with respect to the first data packet.

In some embodiments, at least one of the plurality of processing units is configured to pass at least one result of its associated at least one predefined operation to a next processing unit in the first processing pipeline, wherein the next processing unit is configured to perform a next predefined operation dependent on the at least one result.

In some embodiments, each of the different predefined types of actions is defined by a different template.

In some embodiments, the predefined type of operation includes at least one of the following: accessing a data packet; accessing a lookup table stored in a memory of a hardware module; performing a logical operation on data loaded from the data packet; and performing a logical operation on data loaded from the lookup table.

In some embodiments, the hardware module comprises routing hardware, wherein the hardware module is configured to interconnect at least some of the plurality of processing units to provide a first data processing pipeline by configuring the routing hardware to route data packets among the plurality of processing units in a particular order defined by the first data processing pipeline.

In some embodiments, the hardware module is configured to interconnect at least some of the plurality of processing units to perform a second function different from the first function by providing a second data processing pipeline for processing one or more of the plurality of data packets.

In some embodiments, the hardware module is configured to interconnect at least some of the plurality of processing units to provide a first data processing pipeline, and then interconnect at least some of the plurality of processing units to provide a second data processing pipeline.

In some embodiments, the network interface device includes additional circuitry separate from the hardware module and configured to perform a first function for one or more of the plurality of data packets.

In some embodiments, the additional circuitry includes at least one of: a field programmable gate array; and a plurality of central processing units.

In some embodiments, the network interface device comprises at least one controller, wherein additional circuitry is configured to perform a first function with respect to a data packet during a compilation process for a first function to be performed in a hardware module, and wherein the at least one controller is configured to control the hardware module to initiate performance of the first function with respect to the data packet in response to completion of the compilation process.

In some embodiments, the additional circuitry includes a plurality of central processing units.

In some embodiments, at least one controller is configured to control additional circuitry to stop performing the first function associated with the data packet in response to determining that the compilation process for the first function to be performed in the hardware module is complete.

In some embodiments, the network interface device comprises at least one controller, wherein the hardware module is configured to perform a first function with respect to a data packet during a compilation process for a first function to be performed in an additional circuitry, and wherein the at least one controller is configured to determine that the compilation process for the first function to be performed in the additional circuitry is complete, and, in response to the determination, control the additional circuitry to initiate performance of the first function with respect to the data packet.

In some embodiments, the additional circuitry includes a field programmable gate array.

In some embodiments, at least one controller is configured to control a hardware module to stop performing the first function associated with the data packet in response to a determination that the compilation process for the first function to be performed in the additional circuitry has been completed.

In some embodiments, the network interface device includes at least one controller configured to perform a compilation process to provide a first function to be performed in a hardware module.

In some embodiments, the compilation process includes providing instructions for providing a control plane interface that responds to control messages from the hardware module.

In another aspect, a computer-implemented method is provided, comprising: determining routing information for at least a portion of a configurable hardware module comprising a plurality of processing units, each processing unit being associated with a predefined type of operation executable in a single step, at least some of the plurality of processing units being associated with a different predefined type of operation, and wherein the routing information provides information about available routes at least between the plurality of processing units.

The configurable hardware module may include a substantially static portion and a substantially dynamic portion, wherein the determination includes determining routing information for the substantially dynamic portion.

Determining routing information for the substantially dynamic portion may include determining, in the substantially dynamic portion, routing used by one or more of the processing units in the substantially static portion.

Determining may include analyzing a bit file description of at least some of the configurable hardware modules to determine said routing information.

In another aspect, a non-transitory computer-readable medium is provided comprising program instructions for determining routing information for at least a portion of a configurable hardware module comprising a plurality of processing units, each processing unit being associated with a predefined type of operation executable in a single step, at least some of the plurality of processing units being associated with different predefined types of operations, and wherein the routing information provides information about available routes at least between the plurality of processing units.

A computer program comprising program code means adapted to perform the method(s) may also be provided. The computer program may be stored on and/or otherwise embodied in a carrier medium.

Above, many different embodiments have been described. It should be recognized that additional embodiments may be provided by combinations of any two or more of the embodiments described above.

Various other aspects and additional embodiments are also described in the following detailed description and in the appended claims.

Now, some embodiments will be described by way of example only with reference to the attached drawings, in which:
Figure 1 illustrates a schematic diagram of a data processing system coupled to a network;
FIG. 2 illustrates a schematic diagram of a data processing system including a filtering operation application configured to run in user mode on a host computing device;
FIG. 3 illustrates a schematic diagram of a data processing system including filtering operations configured to run in kernel mode on a host computing device;
FIG. 4 illustrates a schematic diagram of a network interface device including multiple CPUs for performing functions in relation to data packets;
FIG. 5 illustrates a schematic diagram of a network interface device including a field programmable gate array executing an application to perform functions in relation to data packets;
FIG. 6 illustrates a schematic diagram of a network interface device including hardware modules for performing functions in relation to data packets;
FIG. 7 illustrates a schematic diagram of a network interface device including at least one processing unit and a field programmable gate array for performing a function in relation to a data packet;
FIG. 8 illustrates a method implemented in a network interface device according to some embodiments;
FIG. 9 illustrates a method implemented in a network interface device according to some embodiments;
Figure 10 illustrates an example of processing data packets by a series of programs;
Figure 11 illustrates an example of processing a data packet by multiple processing units;
Figure 12 illustrates an example of processing a data packet by multiple processing units;
Figure 13 illustrates an example of a pipeline of processing stages for processing data packets;
Figure 14 illustrates an example of a slice architecture having multiple pluggable components;
Figure 15 illustrates an exemplary representation of the arrangement and order of processing of multiple processing units;
Figure 16 illustrates an exemplary method for compiling a function;
Figure 17 illustrates an example of a stateful processing unit;
Figure 18 illustrates an example of a stateless processing unit;
Figure 19 illustrates a method of some embodiments;
Figures 20a and 20b illustrate routing between slices in an FPGA; and
Figure 21 schematically illustrates a partition on FGPA.

The following description is provided to enable any person skilled in the art to make and use the present invention, and is presented in the context of a specific application. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art.

The general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

When data must be transferred between two data processing systems over a data channel, such as a network, each data processing system must be equipped with an appropriate network interface to allow them to communicate over the channel. Often, the network is based on Ethernet technology. Data processing systems that must communicate over a network must be equipped with a network interface capable of supporting the physical and logical requirements of the network protocol. The physical hardware component of the network interface is referred to as a network interface device or network interface card (NIC).

Most computer systems include an operating system (OS), through which user-level applications communicate with the network. The portion of the operating system known as the kernel contains a protocol stack that translates commands and data between applications and the device drivers specific to network interface devices. Device drivers may also directly control network interface devices. By providing these functions in the operating system kernel, the complexity and differences between network interface devices can be hidden from user-level applications. Network hardware and other system resources (e.g., memory) can be safely shared among many applications, and the system can be protected against flawed or malicious applications.

A typical data processing system (100) for performing transmission over a network is illustrated in FIG. 1. The data processing system (100) includes a host computing device (101) coupled to a network interface device (102) arranged to interface the host to a network (103). The host computing device (101) includes an operating system (104) that supports one or more user-level applications (105). The host computing device (101) may also include a network protocol stack (not shown). For example, the protocol stack may be a component of an application, a library to which an application is linked, or provided by the operating system. In some embodiments, more than one protocol stack may be provided.

The network protocol stack may be a Transmission Control Protocol (TCP) stack. An application (105) can send and receive TCP/IP messages by opening a socket, writing data to the socket, and reading data from the socket, and the operating system (104) causes the message to be transmitted over the network. For example, the application may invoke a system call (syscall) to transmit data to the network (103) through the socket and then through the operating system (104). This interface for sending messages may be known as a message passing interface.

Instead of implementing the stack on the host (101), some systems offload the protocol stack to the network interface device (102). For example, if the stack is a TCP stack, the network interface device (102) may include a TCP Offload Engine (TOE) to perform TCP protocol processing. By performing protocol processing on the network interface device (102) instead of on the host computing device (101), the demands on the host system's processor (101) may be reduced. Data to be transmitted over the network may be transmitted by the application (105) via a TOE-enabled virtual interface driver, partially or completely bypassing the kernel TCP/IP stack. Therefore, data transmitted along this fast path only needs to be formatted to meet the requirements of the TOE driver.

The host computing device (101) may include one or more processors and one or more memories. In some embodiments, the host computing device (101) and the network interface device (102) may communicate via a bus, for example, a peripheral component interconnect express (PCIe bus).

During operation of the data processing system, data to be transmitted over a network may be transmitted from a host computing device (101) to a network interface device (102) for transmission. In one example, data packets may be transmitted directly from the host to the network interface device by the host processor. The host may provide data to one or more buffers (106) located on the network interface device (102). The network interface device (102) may then prepare the data packets and transmit them over the network (103).

Alternatively, the data may be written to a buffer (107) within the host system (101). The data may then be retrieved from the buffer (107) by a network interface device or transmitted over a network (103).

In both of these cases, data is temporarily stored in one or more buffers before being transmitted over the network. Data transmitted over the network can be returned to the host (in a lookback).

When a data packet is transmitted over a network (103) and received therefrom, there are many processing operations that can be expressed as operations on the data packet, either the data packet to be transmitted over the network or the data packet received from the network. For example, to protect the host system (101) from distributed denial of service (DDOS) filtering, a filtering process may be performed on the received data packet. Such a filtering process may be performed by simple pack examination or an extended Berkley packet filter (eBPF). As another example, encapsulation and forwarding may be performed on the data packet to be transmitted over the network (103). These processes may consume a lot of CPU cycles and may be a burden on conventional OS architectures.

Reference is made to FIG. 2, which illustrates one way in which a filtering operation or other packet processing operation may be implemented in a host system (220). The processing performed by the host system (220) is depicted as being performed in either user space or kernel space. A receive path exists in kernel space for forwarding data packets received from a network at the network interface device (210) to a terminating application (250). This receive path includes a driver (235), a protocol stack (240), and a socket (245). The filtering operation (230) is implemented in user space. Incoming packets provided to the host system (220) by the network interface device (210) bypass the kernel (where protocol processing occurs) and are provided directly to the filtering operation (230).

The filtering operation (230) may be provided with a virtual interface (which may be an ether fabric virtual interface (EFVI) or a data plane development kit (DPDK) or any other suitable interface) for exchanging data packets with other elements within the host system (220). The filtering operation (230) may perform DDOS scrubbing and/or other forms of filtering. A DDOS scrubbing process may be performed on all packets that are easily recognized as DDOS candidates, such as sample packets, copies of packets, and packets that have not yet been classified. Packets that are not passed to the filtering operation (230) may be passed directly from the network interface to the driver (235). The operation (230) may provide an extended Berkeley packet filter (eBPF) to perform the filtering. If a received packet passes the filtering provided by operation (230), operation (230) is configured to reinject the packet into a receive path within the kernel for processing the received packet. Specifically, the packet is provided to the driver (235) or stack (240). The packet is then subjected to protocol processing by the protocol stack (240). The packet is then delivered to a socket (245) associated with an end application (250). The end application (250) issues a recv() call to retrieve the data packet from the buffer of the associated socket.

However, this approach has several problems. First, the filtering operation (230) is executed on the host CPU. To perform the filtering (230), the host CPU must process data packets at the rate at which they are received from the network. If the rate at which data is transmitted to and received from the network is high, this can constitute a significant waste of the host CPU's processing resources. The high data flow for the filtering operation (230) can also result in a large consumption of other limited resources, such as I/O bandwidth and internal memory/cache bandwidth.

To perform reinjection of data packets into the kernel, it is necessary to provide a privileged API for performing reinjection in the filtering operation (230). The reinjection process can be cumbersome, requiring attention to packet ordering. In many cases, the operation (230) may require a dedicated CPU core to perform reinjection.

Providing and reinjecting data into an operation requires the data to be copied into or out of memory. This copying places a resource burden on the system.

Similar problems may arise when providing other types of behavior other than filtering on data to be transmitted/received over a network.

Some operations (e.g., DPDK type operations) may require the processed packet to be forwarded back to the network.

Reference is made to FIG. 3, which illustrates another approach. Like elements are referenced using like reference numbers. In this example, an additional layer known as the express data path (XDP) (310) is inserted into the transmit and receive paths within the kernel. Extensions to XDP (310) allow for insertion into the transmit path. An XDP helper allows packets to be transmitted (as a result of a receive operation). XDP (310) is inserted at the driver level of the operating system and allows programs to execute at this level to perform operations on data packets received from the network before the data packets are protocol processed by the stack (240). XDP (310) also allows programs to execute at this level to perform operations on data packets to be transmitted over the network. Thus, eBPF programs and other programs can operate on the transmit and receive paths.

As illustrated in FIG. 3, a filtering operation (320) may be inserted from user space into the XDP to form a program (330) that is part of the XDP (310). The operation (320) is inserted using the XDP control plane to be executed on the data receive path to provide a program (330) that performs a filtering operation (e.g., DDOS scrubbing) on packets on the receive path. Such a program (330) may be an eBPF program.

The program (330) is depicted as being inserted into the kernel between the driver (235) and the protocol stack (240). However, in other examples, the program (330) may be inserted at another point within the kernel's receive path. The program (330) may also be part of a separate control path that receives data packets. The program (330) may also be provided by the application by providing an extension to the application programming interface (API) of the socket (245) for that application.

The program (330) may additionally or alternatively perform one or more operations on data being transmitted over the transmission path. The XDP (310) then calls the transmission function of the driver (235) to transmit data over the network via the network interface device (210). In this case, the program (330) may provide load balancing or routing operations with respect to the data packets to be transmitted over the network. The program (330) may also provide segment recapsulation and forwarding operations with respect to the data packets to be transmitted over the network.

The program (330) may also be used for firewalls and other operations that do not require virtual switching or protocol termination or application processing.

One advantage of using XDP (310) in this manner is that the program (330) can directly access the memory buffers handled by the driver, without intermediate copies.

In order to insert a program (330) into the kernel in this manner, it is necessary to ensure that the program (330) is secure. If an unsecure program is inserted into the kernel, it presents certain risks, including: infinite loops that can crash the kernel; buffer overflows, uninitialized variables, compiler errors, and performance issues caused by large programs.

In order to ensure that the program (330) is safe prior to insertion into the XDP (310) in this manner, a verifier may be run on the host system (220) to verify the safety of the program (330). The verifier may be configured to ensure that no loops exist. Backward jump operations may be allowed if they do not cause loops. The verifier may be configured to ensure that the program (330) has no more than a predefined number of instructions (e.g., 4000). The verifier may also perform checks on the validity of register usage by traversing the data path of the program (330). If there are too many possible paths, the program (330) will be rejected as unsafe to run in kernel mode. For example, if there are more than 1000 branches, the program (330) may be rejected.

It will be recognized by those skilled in the art that XDP - by means of which a secure program (330) may be installed into the kernel - is one example, and that there are other ways in which this can be achieved.

For example, if the operations required to execute code in the kernel can be expressed in a safe (or sandboxed) language, the approach discussed above with respect to FIG. 3 may be just as efficient as the approach discussed above with respect to FIG. 2 . The eBPF language can run efficiently on x86 processors, and Just in Time (JIT) compilation technology enables eBPF programs to be compiled into native machine code. The language is designed to be safe, e.g., state is restricted to mapping only constructs that are shared data structures (e.g., hash tables). Limited looping is allowed, and instead, one eBPF program is allowed to tail-call another program. The state space is restricted.

However, in some implementations, this approach may result in a significant waste of resources (e.g., I/O bandwidth and internal memory/cache bandwidth, host CPU) of the host system (220). Operations on data packets are still performed by the host CPU, which is required to perform such operations at the rate at which data is being transmitted/received.

Another suggestion is to perform the operations discussed above on the network interface device instead of on the host system. Doing so would free up CPU cycles used by the host CPU when executing the operations, in addition to the I/O bandwidth, memory, and cache bandwidth consumed. Moving the processing operations from the host to the hardware of the network interface device can present certain challenges.

One proposal for implementing processing in network hardware is to provide a network processing unit (NPU) in the network interface device, which includes multiple CPUs specialized for packet processing and/or manipulation operations.

Reference is made to FIG. 4, which illustrates an example of a network interface device (400) comprising an array (410) of central processing units (CPUs), for example, CPUs (420). The CPUs are configured to perform functions such as filtering data packets transmitted to and received from a network. Each CPU in the array (410) of CPUs may be an NPU. Although not shown in FIG. 4, the CPUs may additionally or alternatively be configured to perform operations such as load balancing on data packets received from a host for transmission over a network. These CPUs are specialized for such packet processing/manipulation operations. The CPUs execute an instruction set that is optimized for such packet processing/manipulation operations.

The network interface device (400) additionally includes memory (not shown) that is shared between the array of CPUs (410) and accessible to the array of CPUs (410).

The network interface device (400) includes a network medium access control (MAC) layer (430) for interfacing the network interface device (400) with a network. The MAC layer (430) is configured to receive data packets from a network and transmit data packets through the network.

Operations on packets received at the network interface device (400) are parallelized via the CPU. As illustrated, when a data flow is received at the MAC layer (430), it is passed to the spreading function (440), which extracts data packets from the flow and distributes them across multiple CPUs within the NPU (410), such that the CPUs perform processing, for example, filtering, of these data packets. The spreading function (440) may parse the received data packets to identify the data flow to which the received data packets belong. The spreading function (440) generates, for each packet, an indication of the position of each packet in the data flow to which it belongs. The indication may be, for example, a tag. The spreading function (440) adds each indication to the associated metadata of each packet. The associated metadata for each data packet may be appended to the data packet. The relevant metadata may be transmitted to the spreading function unit (440) as side-band control information. The indication is added depending on the flow to which the data packet belongs, and as a result, the order of the data packets for any particular flow may be reconstructed.

After programming by the multiple CPUs (410), the data packets are then passed to a reordering function (450) that reorders the packets of the data flow into their correct order before forwarding the packets of the data flow to the host interface layer (460). The reordering function (450) may reorder the data packets within the flow by comparing markings (e.g., tags) within the data packets of the flow to reconstruct the order of the data packets. The reordered data packets are then passed through the host interface (460) to the host system (220).

Although FIG. 4 illustrates an array of CPUs (410) that operates only on data packets received from a network, similar principles (including spreading and reordering) may also be performed on data packets received from a host for transmission over a network, with the array of CPUs (410) performing functions (e.g., load balancing) on these data packets received from the host.

The program executed by the CPU may be a compiled or transcoded version of the program to be executed on the host CPU in the example described above with respect to FIG. 3. In other words, the set of instructions to be executed on the host CPU to perform an operation is converted for execution on each CPU in the array of special CPUs within the network interface (400).

To achieve parallelism across CPUs, multiple instances of a program are compiled and executed in parallel on multiple CPUs. Each instance of the program may be responsible for processing a different set of data packets received from a network interface device. However, each individual data packet is processed by a single CPU when providing the program's functionality in relation to that data packet. The overall effect of parallel program execution may be the same as executing a single program (e.g., program (330)) on a host CPU.

One specialized CPU can process data packets at a rate of approximately 50 million packets per second. This rate may be lower than that of the host CPU. Therefore, parallelization may be used to achieve the same performance as would be achieved by running an equivalent program on the host CPU. To achieve parallelization, data packets are distributed across the CPUs and then reordered after processing by the CPUs. The requirement to process data packets of each flow sequentially, along with the reordering step (450), may introduce bottlenecks, increase memory resource overhead, and limit the available throughput of the device. This requirement and the reordering step (450) may also increase jitter on the device, as processing throughput may vary depending on the content of the network traffic and the degree of parallelism available.

One advantage of using such specialized CPUs may be shorter compilation times. For example, it may be possible to compile a filtering application to run on such a CPU in less than a second.

As this approach scales to higher link speeds, the use of arrays of CPUs may become problematic. Host network interfaces may be required to reach terabit/s speeds in the near future. Scaling such arrays of CPUs (410) to these higher speeds could pose a challenge due to the amount of power required.

Another proposal is to include a field programmable gate array (FPGA) within the network interface device and use the FPGA to perform operations on data packets received from the network.

Reference is made to FIG. 5, which illustrates an example of use of an FPGA (510) having an FPGA application (515) for performing an operation on a data packet received at the network interface device (500) in a network interface device (500). Elements identical to those in FIG. 4 are referenced using the same reference numerals.

Although FIG. 5 illustrates an FPGA application (515) that operates only on data packets received from a network, such an FPGA application (515) may also be used to perform functions (e.g., load balancing and/or firewall functions) on these data packets received from a host for transmission over the network or for retransmission to another network interface on the host or system.

The FPGA application (515) may be provided by compiling a program written in a common system level language such as C or C++ or Scala to run on the FPGA (510).

The FPGA (510) may have network interface functionality and FPGA functionality. The FPGA functionality may provide an FPGA application (515) that may be programmed into the FPGA (510) according to the needs of the network interface device user. The FPGA application (515) may, for example, provide filtering of messages on the receive path from the network (230) to the host. The FPGA application (515) may also provide a firewall.

The FPGA (510) may be programmable to provide an FPGA application (515). Some of the network interface device functionality may be implemented as "hard" logic within the FPGA (510). For example, the hard logic may be application specific integrated circuit (ASIC) gates. The FPGA application (515) may also be implemented as "soft" logic. The soft logic may be provided by programming an FPGA lookup table (LUT). The hard logic may be clocked at a higher rate compared to the soft logic.

The network interface device (500) includes a host interface (505) configured to transmit and receive data with a host. The network interface device (520) includes a network media access control (MAC) interface (520) configured to transmit and receive data with a network.

When a data packet is received from the network at the MAC interface (520), the data packet is passed to an FPGA application (515) that is configured to perform functions, such as filtering, with respect to the data packet. The data packet (if it passes any filtering) is then passed to the host interface (505), from where it is passed to the host. Alternatively, the data packet FPGA application (515) may decide to drop or retransmit the data packet.

One problem with this approach of using FPGAs to perform functions related to data packets is the relatively long compile times required. FPGAs consist of numerous logic elements (e.g., logic cells) that individually represent primitive logic operations such as AND, OR, NOT, etc. These logic elements are arranged in a matrix using programmable interconnects. To provide functionality, these logic cells may need to work together to implement circuit definitions and synchronous clock timing constraints. Placing each logic cell and routing between them can be algorithmically challenging. Compile times can be less than 10 minutes for FPGAs with lower utilization levels. However, as FPGA devices become more widely utilized across various applications, the place-and-route challenge can increase, resulting in an increase in the time required to compile a given function onto the FPGA. Consequently, adding additional logic to an FPGA that already has most of its routing resources consumed can take hours of compile time.

One approach is to design hardware using specific processing primitives, such as parse, match, and action primitives. These can be used to construct a processing pipeline in which every packet passes through each of three processes. First, packets are parsed to construct a metadata representation of the protocol header. Second, packets are flexibly matched against rules maintained in a table. Finally, when a match is found, the packet is acted upon based on the entry from the table selected in the match action.

The P4 programming language (or a similar language) may be used to implement functionality using the parse/match/action model. The P4 programming language is target-independent, meaning that programs written in P4 can be compiled to run on different types of hardware, such as CPUs, FPGAs, ASICs, NPUs, and so on. Each different type of target has its own compiler that maps the P4 source code to the appropriate target switch model.

P4 can also be used to provide a programming model that allows high-level programs to express packet processing operations within a packet processing pipeline. This approach works well for operations that naturally express themselves in a declarative style. In the P4 language, programmers express parsing, matching, and action stages as operations to be performed on received data packets. These operations are then grouped together for efficient execution by dedicated hardware. However, this declarative style may not be suitable for expressing imperative programs, such as eBPF programs.

On network interface devices, a sequence of eBPF programs may be required to execute serially. In this case, a chain of eBPF programs is created, each calling another. Each program can modify state, and the output is as if the entire chain of programs were executed serially. It may be difficult for a compiler to collect all the parsing, matching, and action steps. However, even if a chain of eBPF programs is already installed, it may be necessary to install, remove, or modify the chain, which presents additional challenges.

To provide an example of such a program requiring repeated execution, reference is made to FIG. 10, which illustrates an example of a sequence of programs (e ₁ , e ₂ , e ₃ ) configured to process a data packet. For example, each of the programs may be an eBPF program. Each of the programs is configured to parse a received data packet, perform a lookup against a table (1010) to determine an action for a matching entry in the table (1010), and then perform an action with respect to the data packet. The action may include modifying the packet. Each of the eBPF programs may also perform the action depending on local and shared state. The data packet (P ₀ ) is initially processed by the eBPF program (e ₁ ) before being passed to, and modified by, the next program (e ₂ ) in the pipeline. The output of the sequence of programs is the output of the final program in the pipeline, i.e., e ₃ .

Combining the individual effects of n such programs into a single P4 program can be complex for a compiler. Additionally, certain programming models (e.g., XDP) may require programs to be dynamically inserted and removed quickly at arbitrary points in the program sequence in response to changing circumstances.

According to some embodiments of the application, a network interface device is provided comprising a plurality of processing units. Each processing unit is configured to perform at least one predefined operation in hardware. Each processing unit includes memory that stores its own local state. Each processing unit includes digital circuitry that modifies this state. The digital circuitry may be an application-specific integrated circuit. Each processing unit is configured to execute a program including configurable parameters to perform each of a plurality of operations. Each processing unit may be an atom. An atom is defined by specific programming and routing of a predefined template. This defines its specific operational behavior and logical location in the flow provided by the plurality of connected processing units. When the term "atomic unit" is used herein, this may be understood to refer to a data processing unit configured to perform its operation in a single step. In other words, an atomic unit performs its operation as an atomic unit operation.

A minimal unit may be thought of as a collection of hardware structures that can be configured to repeatedly perform one of various types of computations, taking one or more inputs and producing one or more outputs.

The minimum unit is provided by the hardware. The minimum unit can also be configured by the compiler. The minimum unit can also be configured to perform a calculation.

During compilation, at least some of the plurality of processing units are arranged to perform operations such that a function is performed in relation to a data packet received at the network interface device by at least some of the plurality of processing units. Each of the at least some of the plurality of processing units is configured to perform at least one predefined operation of its own to perform the function in relation to the data packet. In other words, the operation that the connected processing unit is configured to perform is performed in relation to the received data packet. The operations are performed sequentially by at least some of the plurality of processing units. Collectively, the performance of each of the plurality of operations provides a function, for example, filtering, in relation to the received packet.

By arranging each of the minimal units to execute at least one predefined operation for performing a function, the compilation time may be reduced compared to the FPGA application example described above in connection with FIG. 5. Moreover, by performing the function using a processing unit specifically dedicated to performing a specific operation in hardware, the speed at which the function can be performed may be improved, as compared to using a CPU executing software in a network interface device to perform the function for each data packet, as discussed above in connection with FIG. 4.

Reference is made to FIG. 6, which illustrates an example of a network interface device (600) according to an embodiment of the present application. The network interface device includes a hardware module (610) configured to perform processing of data packets received at an interface of the network interface device (600). While FIG. 6 illustrates the hardware module (610) performing a function (e.g., filtering) on data packets on a receive path, the hardware module (610) may also be used to perform a function (e.g., load balancing or firewall) on data packets on a transmit path received from a host.

The network interface device (600) includes a host interface (620) for transmitting and receiving data packets with a host and a network MAC interface (630) for transmitting and receiving data packets with a network.

The network interface device (600) includes a hardware module (610) comprising a plurality of processing units (640a, 640b, 640c, 640d). Each of the processing units may be a minimum unit processing unit. The term minimum unit is used in the description to refer to a processing unit. Each of the processing units is configured to perform at least one operation in hardware. Each of the processing units includes a digital circuit (645) configured to perform at least one operation. The digital circuit (645) may be an application-specific integrated circuit. Each of the processing units additionally includes a memory (650) that stores state information. The digital circuit (645) updates the state information when executing each of the plurality of operations. In addition to the local memory, each of the processing units may have access to a shared memory (660) that may also store state information accessible to each of the plurality of processing units.

State information within the shared memory (660) and/or state information within the memory (650) of the processing units may include at least one of the following: metadata passed between processing units, temporary variables, contents of data packets, contents of one or more shared maps.

In summary, a plurality of processing units may provide a function to be performed in relation to data packets received at the network interface device (600). The compiler outputs instructions for configuring the hardware module (610) to perform the function in relation to the incoming data packets by arranging at least some of the plurality of processing units to perform at least one predefined operation, respectively, in relation to each incoming data packet. This may be achieved by chaining (i.e., connecting) at least some of the processing units (640a, 640b, 640c, 640d) together such that each of the connected processing units performs at least one operation, respectively, in relation to each incoming data packet. Each of the processing units performs at least one of its operations in a specific order to perform the function. The order may be such that two or more of the processing units are executed in parallel, i.e., simultaneously. For example, one processing unit may read from a data packet during a time period (defined by a periodic signal (e.g., a clock signal) of the hardware module (610)) during which a second processing unit also reads from a different location within the same data packet.

In some embodiments, a data packet passes through each stage represented by a processing unit in a sequence. In this case, each processing unit completes its processing before passing the data packet to the next processing unit for processing.

In the example illustrated in FIG. 6, processing units (640a, 640b, and 640d) are linked together at compile time, so that each of them performs at least one operation, for example, filtering, in relation to a received data packet. Processing units (640a, 640b, and 640d) form a pipeline for processing data packets. A data packet may move along this pipeline in stages each having the same time period. The time period may be defined by a period signal or bit. The time period may also be defined by a clock signal. Multiple periods of the clock may define one time period for each stage of the pipeline. A data packet moves along one stage of the pipeline at the end of each occurrence of a repeating time period. The time period may be a fixed interval. Alternatively, each time period for a stage in the pipeline may require a variable amount of time. When a previous processing stage has completed its operation, a signal indicating the next stage in the pipeline may be generated, which may take a variable amount of time. A stall can be introduced at any stage in the pipeline by delaying the signal for a predetermined amount of time.

Each of the processing units (640a, 640b, 640d) may be configured to access shared memory (660) as part of at least one of their respective operations. Each of the processing units (640a, 640b, 640d) may be configured to transfer metadata between themselves as part of at least one of their respective operations. Each of the processing units (640a, 640b, 640d) may be configured to access data packets received from a network as part of at least one of their respective operations.

In this example, the processing unit (640c) is omitted from the pipeline, as it is not used to perform processing of received data packets to provide functionality.

Data packets received at the network MAC layer (630) may be passed to a hardware module (610) for processing. Although not illustrated in FIG. 6 , the processing performed by the hardware module (610) may be part of a larger processing pipeline that provides additional functionality related to the data packets beyond the functionality provided by the hardware module (610). This is exemplified in connection with FIG. 14 and will be described in more detail below.

The first processing unit (640a) is configured to perform at least one first operation with respect to the data packet. The at least one first operation may include at least one of the following: reading from the data packet, reading and writing shared state in the memory (660), and/or performing a lookup on a table to determine an action. The first processing unit (640a) is then configured to generate a result from its at least one operation. The result may be in the form of metadata. The result may include a modification to the data packet. The result may include a modification to the shared state in the memory (660). The second processing unit (640b) is configured to perform its at least one operation with respect to the first data packet based on a result from the operation executed by the first processing unit (640a). The second processing unit (640b) generates a result from its at least one operation and passes the result to a third processing unit (640d) that is configured to perform its at least one operation with respect to the first data packet. The first processing unit (640a), the second processing unit (640b), and the third processing unit (640d) are configured together to provide functions in relation to the data packet. The data packet may then be transmitted to the host interface (620), from where it is transmitted to the host system.

Thus, it can be seen that the connected processing units form a pipeline for processing data packets received from the network interface device. This pipeline may provide processing of eBPF programs. The pipeline may also provide processing of multiple eBPF programs. The pipeline may also provide processing of multiple modules that are executed sequentially.

Connecting processing units together in a hardware module (610) may also be accomplished by programming the routing functions of a pre-synthesized interconnection fabric of the hardware module (610). This interconnection fabric provides connections between the various processing units of the hardware module (610). The interconnection fabric is programmed according to a topology supported by the fabric. Possible exemplary topologies are discussed below with reference to FIG. 15 .

The hardware module (610) supports at least one bus interface. The at least one bus interface receives data packets from the hardware module (610) (e.g., from a host or a network). The at least one bus interface outputs data packets from the hardware module (610) (e.g., to a host or a network). The at least one bus interface receives control messages from the hardware module (610). The control messages may be for configuring the hardware module (610).

The example illustrated in FIG. 6 has the advantage of reduced compilation time relative to the FPGA application (515) illustrated in FIG. 5. For example, the hardware module (610) of FIG. 6 may require less than 10 seconds to compile a filtering function. The example illustrated in FIG. 6 has the advantage of improved processing speed relative to the example of the array of CPUs illustrated in FIG. 4.

An application may be compiled for execution on such a hardware module (610) by mapping a general program (or multiple programs) to a pre-synthesized data path. The compiler constructs the data path by linking an arbitrary number of processing stage instances, each instance constructed from one of the pre-synthesized processing stage minimum units.

Each minimal unit is built from a circuit. Each circuit may be defined using RTL (register transfer language) or a high-level language. Each circuit is synthesized using a compiler or tool chain. The minimal unit may be synthesized as hard logic and thus available as a hard (ASIC) resource in the hardware module of the network interface device. The minimal unit may also be synthesized as soft logic. The minimal unit of soft logic may have constraints that allocate and maintain the placement and routing information of the synthesized logic on the physical device. The minimal unit may be designed using configurable parameters that specify the behavior of the minimal unit. Each parameter may be a variable, or even a sequence of operations (a microprogram), that may specify at least one operation to be performed by a processing unit during a clock cycle of the processing pipeline. The logic implementing the minimal unit may be clocked synchronously or asynchronously.

The processing pipeline of the minimal unit itself can be configured to operate in response to periodic signals. In this case, each metadata and data packet moves through a stage along the pipeline in response to each occurrence of the signal. The processing pipeline can also operate asynchronously. In this case, backpressure at a higher level of the pipeline will cause each downstream stage to begin processing only when data from the upstream stage is available to it.

When compiling a function to be executed by multiple such minimal units, a sequence of computer code instructions is broken down into multiple operations, each of which is mapped to a single minimal unit. Each operation may represent a single line of instructions decomposed in the computer code instruction. Each operation is assigned to one of the minimal units to be executed by that minimal unit. There may be one minimal unit per expression in the computer code instruction. Each minimal unit is associated with a type of operation and is selected to execute at least one operation in the computer code instruction based on its associated type of operation. For example, a minimal unit may be preconfigured to perform a load operation from a data packet. Accordingly, such a minimal unit is designated to execute an instruction representing a load operation from a data packet in the computer code.

In computer code instructions, one minimal unit may be selected per line. Therefore, when implementing a function in a hardware module containing such a minimal unit, there may be 100 such minimal units, each performing its own operation to perform the function in relation to that data packet.

Each minimal unit may be configured according to one of a set of processing stage templates that determine the type of operation associated with it. The compilation process is configured to generate instructions for controlling each minimal unit, based on its associated type, to perform at least one specific operation. For example, if a minimal unit is pre-configured to perform a packet access operation, the compilation process may assign an operation to the minimal unit for loading certain information (e.g., the packet's source ID) from a packet header. The compilation process is configured to transmit instructions to a hardware module, where the minimal units are configured to perform the operation assigned to them by the compilation process.

Processing stage templates that specify the behavior of the smallest unit are logic stage templates (e.g., providing registers, scratch pad memory, and stack as well as branch-spanning operations), packet access state templates (e.g., providing packet data loads and/or packet data stores), and map access stage templates (e.g., map lookup algorithms, map table sizes).

The packet access stage may include at least one of the following: reading a sequence of bytes from a data packet; replacing one sequence of bytes in the data packet with a different sequence of bytes; inserting a byte into the data packet; and deleting a byte from the data packet.

The map access stage can be used to access different types of maps (e.g., lookup tables), including direct indexed arrays and associative arrays. The map access stage may include at least one of the following: reading a value from a location; writing a value to a location; or replacing a value at a location in the map with a different value. The map access stage may also include a comparison operation in which a value is read from a location in the map and compared to the different value. If the value read from the location is less than the different value, then a first action (e.g., doing nothing, swapping the value at that location with the different value, or adding the values together) may be performed. Otherwise, a second action (e.g., doing nothing, swapping the values, or adding the values) may be performed. In either case, the value read from the location may be provided to the next processing stage.

Each map access stage may be implemented in a stateful processing unit. Reference is made to FIG. 17, which illustrates an example of a circuit (1700) that may be included in a minimal unit configured to perform processing of the map access stage. The circuit (1700) may include a hash function (1710) configured to perform a hash of an input value used as an input to a lookup table. The circuit (1700) includes a memory (1720) configured to store a state related to the operation of the minimal unit. The circuit (1700) includes an arithmetic logic unit (1730) configured to perform an operation.

A logic stage may perform a calculation on a value provided by a previous stage. The processing unit configured to implement the logic stage may be a stateless processing unit. Each stateless processing unit may perform simple arithmetic operations. Each processing unit may, for example, perform 8-bit operations.

Each logic stage may be implemented in a stateless processing unit. Reference is made to FIG. 18, which illustrates an example of a circuit (1800) that may be included in a minimal unit configured to perform processing of the logic stages. The circuit (1800) includes an array of arithmetic logic units (ALUs) and multiplexers. The ALUs and multiplexers are arranged in a hierarchy, where the output of one layer of processing by the ALUs is used by the multiplexers to provide input to the next layer of ALUs.

A pipeline of stages implemented in a hardware module may include a first packet access stage (pkt0), a subsequent first logic stage (logic0), a subsequent first map access stage (map0), a subsequent second logic stage (logic1), a subsequent second packet access stage (pkt1), and so on. Thus, it may take the following form:

Pkt0 -> logic0 -> map0 -> logic1 -> pkt1

In some examples, stage (pkt0) extracts the necessary information from the packet. Stage (pkt0) passes this information to stage (logic0). Stage (logic0) determines whether the packet is a valid IP packet. In some cases, logic0 forms a map request and sends it to map0, which executes a map operation. Stage (map0) may also perform updates to a lookup table. Stage (logic1) then collects the results from the map operation and determines whether to drop the packet as a result.

In some cases, the map request is disabled to cover cases where a map operation should not be performed on this packet. When a map operation is not performed, logic0 indicates to logic1 whether the packet should be dropped or not, depending on whether the packet is a valid IP packet or not. In some examples, the lookup table contains 256 entries, where each entry is an 8-bit value.

This example only includes five stages. However, as noted, more stages may be used. Furthermore, not all operations need to be executed sequentially; however, several operations involving the same data packet may be executed concurrently by different processing units.

The hardware module (610) illustrated in FIG. 6 exemplifies a single pipeline, which is a minimal unit for performing a function in relation to a data packet. However, the hardware module (610) may also include multiple pipelines for processing data packets. Each of the multiple pipelines may perform a different function in relation to the data packets. The hardware module (610) is configured to interconnect a first set of minimal units of the hardware module (610) to form a first data processing pipeline. The hardware module (610) is also configured to interconnect a second set of minimal units of the hardware module (610) to form a second data processing pipeline.

To compile a function to be implemented in a hardware module comprising multiple processing units, a series of steps may be executed starting from a sequence of computer code. A compiler, which may be running on a processor on a host device or on a network interface device, has access to the decomposed sequence of computer code.

First, the compiler is configured to divide a sequence of computer code instructions into distinct stages. Each stage may include an operation according to one of the processing stage templates described above. For example, one stage may provide for reading from a data packet. Another stage may provide for updating map data. Another stage may make a pass-drop decision. The compiler assigns each of the multiple operations represented by the code to one of the multiple stages.

Second, the compiler is configured to assign each processing stage, determined from the code, to be performed by a different processing unit. This means that at least one operation of each processing stage is executed by a different processing stage. The compiler's output can then be used to cause the processing unit to perform the operations of each stage in a specific order to perform the function.

The output of the compiler includes generated instructions that are used to cause the processing units of the hardware modules to execute the operations associated with each processing stage.

The compiler's output may also be used to generate logic in the hardware module that responds to control messages for configuring the hardware module (610). Such control messages are described in more detail below with reference to FIG. 14.

The compilation process for compiling a function to be executed on the network interface device (600) may be performed in response to a determination that the process providing the function is safe for execution in the kernel of the host device. The determination of the safety of the program may be performed by an appropriate verifier, as described above with respect to FIG. 3. Once the process is determined to be safe for execution in the kernel, the process may be compiled for execution on the network interface device.

Reference is made to FIG. 15, which illustrates a representation of at least some of a plurality of processing units, each of which performs at least one operation to perform a function in relation to a data packet. Such a representation may be generated by a compiler or may be used to configure a hardware module to perform the function. The representation indicates the order in which the operations may be executed and how some of the processing units perform their operations in parallel.

The representation (1500) is in the form of a table with rows and columns. Some entries in the table represent the smallest units configured to perform their respective operations, for example, the smallest unit (1510a). The row to which a processing unit belongs represents the timing of the operations performed by the processing unit in relation to a specific data packet. Each row may correspond to a single time period represented by one or more cycles of a clock signal. Processing units belonging to the same row perform their operations in parallel.

Input to the logic stage is provided in row 0, and computation flows forward toward subsequent rows. By default, the smallest unit receives results from processing by the smallest unit in the same column as itself but in the previous row. For example, the smallest unit (1510b) receives results from processing by the smallest unit (1510a) and performs its own processing based on these results.

When using local routing resources, the minimum unit may also access output from a minimum unit in a previous row whose column number differs by no more than two. For example, the minimum unit (1510d) may receive results from processing performed by the minimum unit (1510c).

When using global routing resources, the minimum unit can also access output from the minimum units in the previous two rows and any column. This can be accomplished using global routing resources. For example, the minimum unit (1510f) may receive results from processing performed by the minimum unit (1510e).

These constraints on routing between atomic units are provided as examples; other constraints may apply. Applying more restrictive constraints may facilitate the routing of information between atomic units. Applying less restrictive constraints may facilitate scheduling. If the number of atomic units of a given type (e.g., map, logic, or packet access) is exhausted or routing between atomic units is impossible, compilation of the function into the hardware module will fail.

Specific constraints are determined by the topology supported by the interconnection fabric supported by the hardware modules. The interconnection fabric is programmed to cause the smallest units of hardware modules to execute their operations in a specific order and to provide data to each other within the constraints. Figure 15 illustrates one specific example of how the interconnection fabric may be programmed.

A place-and-route algorithm is used during the synthesis of an FPGA application (515) onto an FPGA (as exemplified in FIG. 5). However, in this case, the solution space is limited, and therefore, the algorithm has a short bounded execution time.

There is a trade-off between processing speed or efficiency and compilation time. According to embodiments of the present application, it may be desirable to initially compile and execute a program on at least one processing unit (which may be a minimal unit or a CPU, as described above in connection with FIG. 6 ) for providing a function in relation to a received data packet. The at least one processing unit may then execute and perform the function in relation to the received data packet during a first period of time. During operation of the network interface device, a second at least one processing unit (which may be an FPGA application or template type processing unit, as described above in connection with FIG. 6 ) may be configured to perform the function in relation to the data packet. The function may then be migrated from the first at least one processing unit to the second at least one processing unit, such that the second at least one processing unit performs the function for subsequent received data packets in the network interface device. Thus, the slower compilation time of the second at least one processing unit does not prevent the network interface device from performing the function with respect to the data packet before the function is compiled for the second at least one processing unit, because the first at least one processing unit may be compiled faster and may be used to perform the function with respect to the data packet while the function is being compiled for the second at least one processing unit. Since the second at least one processing unit typically has a faster processing time, moving the compilation time to the second at least one processing unit allows for faster processing of the data packet received at the network interface device.

According to an embodiment of the present application, the compilation process may be configured to execute on at least one processor of a data processing system, wherein the at least one processor is configured to transmit instructions to at least one first processing unit and at least one second processing unit to perform at least one function in relation to a data packet at an appropriate time. The at least one processor may comprise a host CPU. The at least one processor may comprise a control processor on a network interface device. The at least one processor may comprise a combination of one or more processors on a host system and one or more processors on a network interface device.

Accordingly, at least one processor is configured to perform a first compilation process to compile a function to be performed by a first at least one processing unit of the network interface device. The at least one processing unit is further configured to perform a second compilation process to compile a function to be performed by a second at least one processing unit of the network interface device. Prior to completion of the second compilation process, the at least one processing unit instructs the first at least one processing unit to perform a function in relation to a data packet received from the network. Subsequently, following completion of the second compilation process, the at least one processing unit instructs the second at least one processing unit to begin performing the function in relation to the data packet received from the network.

Performing these steps enables the network interface device to perform the function using the first at least one processing unit (which may have a shorter compilation time but may also have slower and/or less efficient processing) while waiting for the second compilation process to complete. Once the second compilation process is complete, the network interface device may then perform the function using the second at least one processing unit (which may have a longer compilation time but may also have faster and/or more efficient processing), in addition to or instead of the first at least one processing unit.

Reference is made to FIG. 7, which illustrates an exemplary network interface device (700) according to an embodiment of the present application. The same reference elements as those depicted in the previous drawings are indicated using the same reference numbers.

The network interface device includes at least one first processing unit (710). The at least one first processing unit (710) may include a hardware module (610) as illustrated in FIG. 6, which includes a plurality of processing units. The at least one first processing unit (710) may include one or more CPUs, as illustrated in FIG. 4.

During a first time period, the function is compiled to be executed on the first at least one processing unit (710) such that the function is performed by the first at least one processing unit (710) in relation to a data packet received from the network. The first at least one processing unit (710) is instructed by the at least one processor to perform the function in relation to the data packet received from the network prior to completion of a second compilation process for the second at least one processing unit.

The network interface device comprises at least one second processing unit (720). The at least one second processing unit (720) may comprise an FPGA having an FPGA application (as illustrated in FIG. 5) or may comprise a hardware module (610) as illustrated in FIG. 6 comprising a plurality of processing units.

During the first time period, a second compilation process is executed to compile the function for execution on the second at least one processing unit. That is, the network interface device is configured to compile the FPGA application (515) on the fly.

Subsequent to the first time period (i.e., subsequent to completion of the second compilation process), the second at least one processing unit (720) is configured to begin performing a function related to a data packet received from the network.

Following the first time period, the first at least one processing unit (710) may stop performing a function related to the data packet received from the network. In some embodiments, the first at least one processing unit (710) may partially stop performing a function related to the data packet. For example, if the first at least one processing unit includes multiple CPUs, following the first time period, one or more of the CPUs may stop performing processing related to the data packet received from the network, while the remaining CPUs of the multiple CPUs continue to perform processing.

The first at least one processing unit (710) may be configured to perform a function related to the data packets of the first data flow. Upon completion of the second compilation process, the second at least one processing unit (720) may begin performing a function related to the data packets of the first data flow. Upon completion of the second compilation process, the first at least one processing unit may stop performing a function related to the data packets of the first data flow.

Different combinations of the first at least one processing unit and the second at least one processing unit are also possible. For example, in some embodiments, the first at least one processing unit (710) comprises multiple CPUs (as illustrated in FIG. 4 ), while the second at least one processing unit (720) comprises a hardware module comprising multiple processing units (as illustrated in FIG. 6 ). In some embodiments, the first at least one processing unit (710) comprises multiple CPUs (as illustrated in FIG. 4 ), while the second at least one processing unit (720) comprises an FPGA (as illustrated in FIG. 5 ). In some embodiments, the first at least one processing unit (710) comprises a hardware module comprising multiple processing units (as illustrated in FIG. 6 ), while the second at least one processing unit (720) comprises an FPGA (as illustrated in FIG. 5 ).

Reference is made to FIG. 11, which illustrates how a plurality of connected processing units (640a, 640b, 640d) may perform at least one of their respective operations with respect to a data packet. Each of the processing units is configured to perform at least one of its respective operations with respect to a received data packet.

At least one operation of each processing unit may represent a logic stage in a function (e.g., a function of an eBPF program). At least one operation of each processing unit may be expressed by an instruction executed by the processing unit. The instruction may determine the behavior of the atomic unit.

Figure 11 illustrates how a packet (P ₀ ) progresses through the processing stages implemented by each processing unit.

Each processing unit performs processing on the packet in a specific order specified by the compiler. The order may be such that some of the processing units are configured to perform their processing in parallel. This processing may include accessing at least a portion of the packet maintained in memory. Additionally or alternatively, this processing may include performing a lookup on a lookup table to determine the action to be performed on the packet. Additionally or alternatively, this processing may include modifying state (1110).

The processing units exchange metadata (M ₀ , M ₁ M ₂ , M ₃ ) with each other. The first processing unit (640a) is configured to perform at least one predefined operation of each of itself and generate metadata (M ₁ ) in response. The first processing unit (640a) is configured to transfer the metadata (M ₁ ) to the second processing unit (640b).

At least some of the processing units perform at least one operation of each of them depending on at least one of the following: the contents of the data packet, its own stored state, global shared state, and metadata associated with the data packet (e.g., M ₀ , M ₁ , M ₂ , M ₃ ). Some of the processing units may be stateless.

Each of the processing units may perform its associated type of operation on the data packet (P ₀ ) during at least one clock cycle. In some embodiments, each of the processing units may perform its associated type of operation during a single clock cycle. Each of the processing units may be individually clocked to perform their operations. This clocking may be in addition to the clocking of the processing pipeline of the processing unit.

Looking into the operation of the second processing unit (640b) in more detail, the second processing unit (640b) is configured to be connected to a first processing unit (640a) configured to perform at least one first predefined operation in relation to a first data packet. The second processing unit (640b) is configured to receive, from a first additional processing unit, a result of the first at least one predefined operation. The second processing unit (640b) is configured to perform at least one second predefined operation depending on the result of the first at least one predefined operation. The second processing unit (640b) is configured to be connected to a third processing unit (640d) configured to perform at least one third predefined operation in relation to the first data packet. The second processing unit (640b) is configured to transmit the result of the second at least one predefined operation to the third processing unit (640d) for processing in the third at least one predefined operation.

The processing unit may operate similarly to provide functionality in relation to each of the multiple data packets.

Embodiments of the present application are such that multiple packets may be pipelined simultaneously, if functionality permits.

Reference is made to FIG. 12, which illustrates pipelining of data packets. As illustrated, different packets may be processed concurrently by different processing units. A first processing unit (640a) is executing at least one of its respective operations at a first time (t ₀ ) in relation to a third data packet (P ₂ ). A second processing unit (640b) is executing at least one of its respective operations at a first time (t ₀ ) in relation to a second data packet (P ₁ ). A third processing unit (640d) is executing at least one of its respective operations at a first time (t ₀ ) in relation to a first data packet (P ₀ ).

After each of the at least one operation is executed by each of the processing units, each of the packets moves along one stage in the sequence. For example, at a subsequent second time (t ₁ ), the first processing unit (640a) is executing its respective at least one operation at the first time (t ₀ ) in relation to the fourth data packet (P ₃ ). The second processing unit (640b) is executing its respective at least one operation at the first time (t ₀ ) in relation to the third data packet (P 2 ) _{. The third processing unit (640d) is executing its respective at least one operation at the first time (t 0 )} in relation to the first data packet (P ₁ ).

It should be recognized that in some embodiments, there may be multiple packets present at a given stage.

In some embodiments, packets may move from one stage to the next, but not necessarily in a locked state.

As long as there are no pipeline hazards, such pipelines operating at a fixed clock may have a constant bandwidth. This may reduce jitter in the system.

To avoid hazards when executing instructions (e.g., conflicts when accessing shared state), each of the processing units may be configured to execute a no-action (no-action) instruction (i.e., the processing unit stalls) when necessary.

In some embodiments, operations (e.g., simple arithmetic, increments, additions/subtractions of constant values, shifts, additions/subtractions of values from data packets or from metadata) require one clock cycle to be executed by a processing unit. This may mean that a value in shared state needed by one processing unit has not yet been updated by another processing unit. Thus, out-of-date values in shared state (1110) may be read by the processing unit that needs them. Therefore, risks may arise when reading and writing values to shared state. On the other hand, operations on intermediate values may be passed through as metadata without risk.

An example of a risk in reading and writing to shared state (1110) that may be prevented can be given in the context of an incremental operation. Such an incremental operation may be an operation that increments a packet counter in the shared state (1110). In one implementation of the incremental operation, during a first time slot of the pipeline, the second processing unit (640b) is configured to read the value of the counter from the shared state (1110) and provide the output of this read operation (e.g., as metadata (M ₂ )) to a third processing unit (640d). The third processing unit (640d) is configured to receive the value of the counter from the second processing unit (640b). During the second time slot, the third processing unit (640d) increments this value and writes the newly incremented value to the shared state (1110).

A problem may arise when performing such an incremental operation, that is, if during the second time slot the second processing unit (640b) attempts to access the counter stored in the shared state (1110), the second processing unit (640b) may read the previous value of the counter before the counter value in the shared state (1110) is updated by the third processing unit (640d).

Therefore, to address this issue, the second processing unit (640b) may stall during the second time slot (via execution by the second processing unit (640b) of a no-action instruction or a pipeline bubble). A stall may be understood as a delay in the execution of the next instruction. This delay may be implemented by executing the "no-action" instruction instead of the next instruction. The second processing unit (640b) then reads the counter value from the shared state (1110) during the subsequent third time slot. During the third time slot, the counter in the shared state (1110) has been updated, and thus, it is guaranteed that the second processing unit (640b) reads the updated value.

In some embodiments, each minimal unit is configured to read from a state, update the state, and write the updated state during a single pipeline time slot. In this case, the stalling of processing units described above may not be used. However, stalling processing units may reduce the required memory interface cost.

In some embodiments, to avoid hazards, processing units in a pipeline may wait until other processing units in the pipeline have completed their processing before performing their own operations.

As mentioned, the compiler builds the data path by linking an arbitrary number of processing stage instances, each of which is built from one of a predefined number (three in the given example) of pre-synthesized processing stage templates. The processing stage templates are logic stage templates (e.g., providing arithmetic operations across registers, scratch pad memory, and metadata), packet access state templates (e.g., providing packet data loads and/or packet data stores), and map access stage templates (e.g., providing map lookup algorithms, map table sizes).

Each processing stage instance may be implemented by a single one of the processing units, i.e., each processing stage includes at least one operation each executed by the processing unit.

Figure 13 illustrates an example of how processing stages may be linked together in a pipeline (1300) to process a received data packet. As illustrated in Figure 13, a first data packet is received and stored in a FIFO (1305). One or more calling arguments are received by a first logic stage (1310). The calling arguments may include a program selector that identifies a function to be executed on the received data packet. The calling arguments may also include an indication of the packet length of the received data packet. The first logic stage (1310) is configured to process the calling arguments and provide output to the first packet access stage (1315).

The first packet access stage (1315) loads data from the first packet from the network tap (1320). The first packet access stage (1315) may also write data to the first packet based on the output of the first logic stage (1310). The first packet access stage (1315) may also write data to the front of the first data packet. The first packet access stage (1315) may also overwrite data within the data packet.

The loaded data and any other metadata and/or arguments are then provided to a second logic stage (1325), which performs processing with respect to the first data packet and provides output arguments to a first map access stage (1330). The first map access stage (1330) uses the output from the second logic stage (1325) to perform a lookup on a lookup table to determine an action to be performed with respect to the first data packet. The output is then passed to a third logic stage (1335), which processes the output and passes the result to the second packet access stage (1340).

The second packet access stage (1340) may read data from the first data packet and/or write data to the first data packet based on the output of the third logic stage (1335). The result of the second packet access stage (1340) is then passed to the fourth logic stage (1345), which is configured to perform processing with respect to the input it receives.

The pipeline may include a plurality of packet access stages, logic stages, and map access stages. The final logic stage (1350) may be configured to output a return argument. The return argument may include a pointer identifying the start of a data packet. The return argument may include an indication of an action to be performed with respect to the data packet. The indication of the action may indicate whether the packet should be dropped or not. The indication of the action may indicate whether the packet should be forwarded to the host system or not. The network interface device may include at least one processing unit configured to drop each data packet in response to an indication that the packet should be dropped.

The pipeline (1300) may additionally include one or more bypass FIFOs (l355a, l355b, l355c). The bypass FIFOs may be used to pass processing data, for example, data from a first data packet around the map access stage and/or the packet access stage. In some embodiments, the map access stage and/or the packet access stage do not require data from the first data packet to perform at least one of their respective operations. The map access stage and/or the packet access stage may perform at least one of their respective operations depending on input arguments.

Reference is made to FIG. 8, which illustrates a method (800) performed by a network interface device (600, 700) according to an embodiment of the present application.

In S810, a hardware module of a network interface device is arranged to perform a function. The hardware module includes a plurality of processing units, each of which is configured to perform a type of operation in hardware with respect to a data packet. S810 includes arranging at least some of the plurality of processing units to perform their respective predefined types of operations in a specific order to provide a function with respect to each received data packet. Arranging the hardware modules in this manner includes connecting at least some of the plurality of processing units such that the received data packet undergoes processing by each of the plurality of operations of at least some of the plurality of processing units. The connecting may be achieved by configuring routing hardware of the hardware module to route data packets and associated metadata between the processing units.

In S820, a first data packet is received from a network on a first interface of a network interface device.

In S830, the first data packet is processed by each of at least some processing units connected during the compilation process of S810. Each of at least some processing units performs a type of operation pre-configured to be performed in relation to at least one data packet. Therefore, the function is performed in relation to the first data packet.

In S840, the processed first data packet is then transmitted to its destination. This may also include transmitting the data packet to the host. This may also include transmitting the data packet over a network.

Reference is made to FIG. 9, which illustrates a method (900) that may be performed in a network interface device (700) according to an embodiment of the present application.

In S910, at least one first processing unit (i.e., the first circuit unit) of the network interface device is configured to receive and process a data packet received via a network. This processing includes performing a function with respect to the data packet. The processing is performed during a first time period.

In S920, a second compilation process is performed during a first time period to compile a function for execution on a second at least one processing unit (i.e., a second circuit unit).

At S930, it is determined whether the second compilation process is completed or not. If not, the process returns to S910 and S920, where at least one first processing unit continues processing data packets received from the network, and the second compilation process continues.

At S940, in response to determining that the second compilation is complete, the first at least one processing unit stops performing a function related to the received data packet. In some embodiments, the first at least one processing unit may stop performing the function only with respect to a given data flow. The second at least one processing unit may then perform the function (at S950) instead with respect to their given data flow.

In S950, when the second compilation process is completed, the second at least one processing unit is configured to start performing a function related to a data packet received from the network.

Reference is made to FIG. 16, which illustrates a method (1600) according to an embodiment of the present application. The method (1600) may be performed in a network interface device or a host device.

In S1610, a compilation process is performed to compile a function to be performed by at least one first processing unit.

In S1620, a compilation process is performed to compile a function to be performed by at least one second processing unit. This process includes assigning to each of the plurality of processing units of the at least one second processing unit at least one operation to be performed, wherein the at least one operation is associated with a stage of the plurality of stages for processing a data packet to provide the first function. Each of the plurality of processing units is configured to perform a type of processing, and the assignment is performed based on a determination that the processing unit is configured to perform a type of processing appropriate for performing each of the at least one operation. In other words, the processing units are selected according to their templates.

At 1630, prior to completion of the compilation process of S1620, a command is transmitted to cause at least one first processing unit to perform a function. This command may be transmitted prior to the start of the compilation process of S1620.

At S1640, following completion of the compilation process at S1620, a command is transmitted to the second circuit unit to cause the second circuit unit to perform a function related to the data packet. This command may include a compiled command generated at S1620.

The functionality according to embodiments of the present application may be provided as a pluggable component of a processing slice in a network interface. Reference is made to FIG. 14, which illustrates an example of how a slice (1425) may be used in a network interface device (600). The slice (1425) may also be referred to as a processing pipeline.

The network interface device (600) includes a transmit queue (1405) for receiving and storing data packets from a host to be processed by the slice (1425) and then transmitted over a network. The network interface device (600) includes a receive queue (1410) for storing data packets received from a network (1410) to be processed by the slice (1425) and then transmitted to the host. The network interface device (600) includes a receive queue (1415) for storing data packets received from a network that have been processed by the slice (1425) and are intended for transmission to the host. The network interface device (600) includes a transmit queue for storing data packets received from a host that have been processed by the slice (1425) and are intended for transmission to the network.

A slice (1425) of a network interface device (600) includes a plurality of processing functions for processing data packets on a receive path and a transmit path. The slice (1425) may include a protocol stack configured to perform protocol processing of data packets on the receive path and the transmit path. In some embodiments, the network interface device (600) may have a plurality of slices. At least one of the plurality of slices may be configured to process a receive data packet received from a network. At least one of the plurality of slices may be configured to process a transmit data packet for transmission over the network. The slices may be implemented by a hardware processing device, such as at least one FPGA and/or at least one ASIC.

Accelerator components (l430a, l430b, l430c, l430d) may be inserted at different stages of a slice as illustrated. Each accelerator component provides a function in relation to data packets passing through the slice. The accelerator components may be inserted or removed on the fly, i.e., during operation of the network interface device. Therefore, the accelerator components are pluggable components. The accelerator components are logical regions allocated for the slice (1425). Each of them supports a streaming packet interface that allows packets passing through the slice to be streamed into and out of the component.

For example, one type of accelerator component may be configured to provide encryption of data packets along a receive or transmit path. Another type of accelerator component may be configured to provide decryption of data packets along a receive or transmit path.

The functionality discussed above, which is provided by executing operations performed by a plurality of connected processing units (as discussed above with reference to FIG. 6), may also be provided by an accelerator component. Similarly, functionality provided by an array of network processing CPUs (as discussed above with reference to FIG. 4) and/or an FPGA application (as discussed above with reference to FIG. 5) may also be provided by an accelerator component.

As described, during operation of the network interface device, processing performed by at least one first processing unit (e.g., a plurality of connected processing units) may be migrated from at least one second processing unit. To implement this migration, a component for processing by the at least one first processing unit among the components of the slice (1425) may be replaced by a component for processing by the at least one second processing unit.

The network interface device may include a control processor configured to insert and remove components from a slice (1425). During the first time period discussed above, a component for performing a function by a first at least one processing unit may be present in the slice (1425). The control processor may be configured, subsequent to the first time period: to remove a pluggable component providing a function by the first at least one processing unit from the slice (1425) and to insert a pluggable component providing a function by the second at least one processing unit into the slice (1425).

In addition to or instead of inserting and removing components from a slice, the control processor may load programs into the component and issue control-plane commands to control the flow of frames to the component. In this case, the component may be enabled or disabled without being inserted or removed from the pipeline.

In some embodiments, control plane or configuration information is conveyed via the data path, rather than requiring a separate control bus. In some embodiments, requests to update the configuration of data path components are encoded as messages conveyed via the same bus as network packets. Thus, the data path may convey two types of packets: network packets and control packets.

Control packets are formed by the control processor and injected into the slice (1425) using the same mechanism used to transmit or receive data packets using the slice (1425). This same mechanism may be a transmit queue or a receive queue. Control packets may be distinguished from network packets in any suitable manner. In some embodiments, different types of packets may be distinguished by a bit or bits within a metadata word.

In some embodiments, a control packet includes a routing field in its metadata word that determines the path that the control packet takes through the slice (1425). The control packet may carry a sequence of control commands. Each control command may target one or more components of the slice (1425). Each data path component is identified by a component ID field. Each control command encodes a request for each identified component. The request may be to make a change to the configuration of the component. The request may control whether the component is enabled or disabled, i.e., whether the component performs its function with respect to data packets passing through the slice or not.

Accordingly, in some embodiments, the control processor of the network interface device (600) is configured to transmit a message to cause one of the components of the slice to begin performing a function associated with a data packet received at the network interface device. This message is a control plane message transmitted through the pluggable component and causes an atomic switch over of a frame to the component to perform the function. This component is then executed for all received data packets passing through the slice until the slice is switched out. The control processor is configured to transmit a message to another of the components of the slice to cause that component to stop performing a function associated with a data packet received at the network interface device (600).

Sockets may be present at various points along the ingress and egress data paths to switch components into and out of data slices (1425). The control processor may also connect additional logic into and out of slices (1425). This additional logic may take the form of a FIFO placed between components.

The control processor may transmit control plane messages to configured components of the slice (1425) via the slice (1425). The configuration may determine the functions performed by the components of the slice (1425). For example, a control message transmitted via the slice (1425) may cause a hardware module to be configured to perform a function in relation to a data packet. Such a control message may cause a minimum unit of the hardware module to be interconnected into a pipeline of the hardware module to provide a given function. Such a control message may cause individual minimum units of the hardware module to select an operation to be performed by the individually selected minimum unit. Since each minimum unit is pre-configured to perform a type of operation, the selection of an operation for each minimum unit is made depending on the type of operation that each minimum unit is pre-configured to perform.

Now, several additional embodiments will be described with reference to FIGS. 19 to 21. In these embodiments, a packet processing program or feedforward pipeline is executed in an FPGA. A method for causing a subunit of an FPGA to implement a packet processing program or feedforward pipeline will be described. The packet processing program or feedforward pipeline may be an eBPF program, a P4 program, or any other suitable program.

This FPGA may be provided in a network interface device. In some embodiments, the packet processing program is deployed or executed only after the network interface device is installed in association with its host.

A packet processing program or feedforward pipeline may also implement a loop-free logic flow.

In some embodiments, a program may be written in a less privileged domain, such as a user-level domain, or in an unprivileged domain. The program may also run on a privileged domain, such as the kernel, or on a more privileged domain. The hardware executing the program may require that it not contain any loops.

In the following embodiments, reference is made to examples of eBPF programs. However, it should be recognized that other embodiments may be used with any other suitable program.

It should be recognized that one or more of the following embodiments may be used in conjunction with one or more of the previous embodiments.

Some embodiments may be provided in the context of an FPGA, an ASIC, or any other suitable hardware device. Some embodiments utilize subunits of an FPGA, an ASIC, or the like. The following examples are described with reference to an FPGA. It should be appreciated that similar processes may be performed using an ASIC or any other suitable hardware device.

A subunit may be a minimal unit. Some examples of minimal units have been previously described. It should be recognized that any of the previously described examples of minimal units may alternatively or additionally be used as a subunit. Alternatively or additionally, these subunits may be referred to as "slices" or configurable logic blocks.

Each of these subunits may be configured to execute a single instruction or multiple related instructions. In the latter case, the related instructions may provide a single output (which may be defined by one or more bits).

A subunit can be considered a computational unit. The subunits may be arranged in a pipeline where packets are processed sequentially. In some embodiments, the subunits may be dynamically assigned to execute individual instructions (or instructions) in the program.

In some embodiments, a subunit may be all or part of a unit used to define a block of an FPGA, for example. In some FPGAs, a block of an FPGA is referred to as a slice. In some embodiments, a subunit or minimum unit is considered to be identical to a slice.

By mapping each minimal unit or subunit to a separate block or slice of the FPGA, improved resource utilization may be achieved compared to the approach of mapping RTL minimal units to FPGA resources. This latter approach may result in each RTL minimal unit requiring a relatively large number of individual blocks or slices of the FPGA.

In some embodiments, compilation may be performed at the smallest level. This may have the advantage of pipelined processing. Packets may be processed sequentially. The compilation process may also be performed relatively quickly.

In some embodiments, arithmetic operations may require one slice per byte. Logical operations may require half a slice per byte. Shift operations may require a set of slices, depending on the width of the shift operation. Compare operations may require one slice per byte. Select operations may require half a slice per byte.

As part of the compilation process, placement and routing are performed. Placement is the assignment of a specific physical subunit to execute a specific instruction or instructions. Routing ensures that the output or outputs of a specific subunit are routed to the correct destination, which may be another subunit or subunits, for example.

Placement and routing may use a process that begins at one end of the pipeline and assigns operations to specific subunits. In some embodiments, the most important operations may be placed before less important operations. In some embodiments, routing may be assigned simultaneously with the placement of specific operations. In some embodiments, routes may be selected from a limited set of pre-computed routes. This will be described in detail later.

In some embodiments, if the root cannot be allocated, the operation will be retained for later.

In some embodiments, the precomputed route may be a byte-wide route. However, this is merely an example, and in other embodiments, routes of different widths may be defined. In some embodiments, multiple routes of different sizes may be provided.

In some embodiments, routing may be limited to routing between adjacent subunits.

In some embodiments, the subunits may be physically arranged in a regular structure on the FPGA.

In some embodiments, rules may be established regarding how subunits may communicate to facilitate routing. For example, a subunit may only provide output to subunits next to it, above it, or below it.

Alternatively or additionally, for routing purposes, a limit may be placed on how far away the next subunit is. For example, a subunit may only output data to adjacent subunits or to subunits within a defined distance (e.g., only one intervening subunit exists).

Reference is made to FIG. 19, which illustrates a method of some embodiments.

In some embodiments, an FPGA may have one or more "static" regions and one or more "dynamic" regions. The static regions provide a standard configuration, while the dynamic regions may provide functionality based on end-user requests. The static regions may be defined, for example, prior to the end-user receiving the network interface device, for example, prior to the network interface device being installed relative to the host. For example, the static regions may be configured to enable the network interface device to provide certain functionality. The static regions may be provided with pre-computed routes between atomic units. As discussed in more detail later, routing between one or more static regions may occur through one or more dynamic regions. The dynamic regions may be configured by the end-user based on their requests when the network interface device is deployed relative to the host. The dynamic regions may be configured to perform different functions for the end-user over time.

In step (S1), a first compilation process is performed to provide a first bit file, referred to as a main bit file (50) and a tool checkpoint (52). This is a bit file for at least a portion of the static region in some embodiments. The bit file, when downloaded to the FPGA, will cause the FPGA to function as specified in the program from which the bit file was compiled. In some embodiments, the program used in the first compilation process may be any one or more programs, or may be a test program specifically designed to support routing decisions within a portion of the FPGA. In some embodiments, a series of simple programs may alternatively or additionally be used.

A program may have reconfigurable partitions that can be modified or used by the compiler. The program may also be modified to make the compiler's task easier by moving the network outside the reconfigurable partitions.

Step (S1) may be performed in a design tool. For example, the Vivado tool may be used with Xilinx FPGAs. A checkpoint file may be provided by the design tool. A checkpoint file represents a snapshot of the design at the point where the bit file is generated. The checkpoint file may include one or more synthesized netlists, design constraints, placement information, and routing information.

In step (S2), the bit file is analyzed while considering the checkpoint file to provide a bit file description (54). The analysis may include one or more of detecting resources, generating a route, checking timing, generating one or more partial bit files, and generating a bit file description.

The analysis may be configured to extract routing information from the bit file. The analysis may also be configured to determine along which wire or route a signal was propagated.

The analysis phase may be performed, at least partially, within a synthesis or design tool. In some embodiments, Vivado's scripting tools may be used. The scripting tool may be TCL (tool command language). TCL can be used to add to or modify Vivado's capabilities. Vivado's functions can also be invoked and controlled via TCL scripts.

A bit file description (54) defines how a given portion of an FPGA can be used. For example, a bit file description may indicate which minimum units can be routed to which other minimum units and one or more routes that enable routing between those minimum units. For example, for each minimum unit, a bit file description may indicate where inputs to that minimum unit can come from and where outputs from that minimum unit can be routed along with one or more routes for data output. A bit file description is independent of any program.

A bit file description may include one or more of: root information, an indication of which pairs of roots collide, and a description of how to create a bit file from the minimum required configuration.

A bit file description may provide a set of roots between a set of atomic units, but before any particular instruction is executed by a given atomic unit.

A bit file description may be for a portion of an FPGA. A bit file description may be for a dynamic portion of an FPGA. A bit file description may include which routes are available and/or which routes are not available. For example, a bit file may indicate which routes are available for a dynamic portion of an FPGA, taking into account any routing across the dynamic portion of the FPGA that is required by the static portion(s) of the FPGA.

It should be recognized that in some embodiments, the bit file description may be obtained in any suitable manner. For example, the bit file description may be provided by an FPGA or ASIC supplier.

In some embodiments, the bit file description may be provided by the design tool. In these embodiments, the analysis step may be omitted. The design tool may output the bit file description. The bit file description may be for the static portion of the FPGA, including any necessary routing across the dynamic portion of the FPGA.

It should be noted that any other suitable technique could be used to generate the bit file description. In the example described above, the tool used to design the FPGA was used to provide the analysis used to generate the bit file.

It should be recognized that in other embodiments, different tools may be used. In some embodiments, the tools may be product-specific or product-specific. For example, an FPGA supplier may provide relevant tools for managing its FPGA.

In other embodiments, general scripting tools may be used.

In some embodiments, different tools or techniques may be used to determine the partial bit files. For example, the main bit file may be analyzed to determine which features correspond to which features. This may require the creation of multiple partial bit files.

It should be noted that step (S3) is performed when the network interface device is installed in relation to the host and is executed on the physical FPGA device. Steps (S1 and S2) may also be performed as part of a design synthesis process to generate a bit file image implementing the network interface device. In some embodiments, steps (S1) and/or (S2) are used to characterize the behavior of the FPGA. Once the FPGA is characterized, the bit file description is stored in memory for all physical network interface devices that will operate in a given defined manner.

In step (S3), compilation is performed using the bit file description and the eBPF program. The output of the compilation is a partial bit file for the eBPF program. The compilation will add the root to the partial bit file and the programming to be performed by each slice among the slices.

It should be noted that the bit file description may be provided by the deployed system. The bit file description may be stored in memory. The bit file description may be stored on the FPGA, on the network interface device, or on the host device. In some embodiments, the bit file description is stored in flash memory connected to the FPGA on the network interface device, or the like. The flash memory may also contain the main bit file.

The eBPF program may be stored together with or separately from the bit file description. The eBPF program may be stored on the FPGA, on the network interface device, or on the host. In the case of eBPF, the program may be transferred from a user mode program to the kernel, both of which run on the host. The kernel will transfer the program to a device driver, which will then transfer it to a compiler running on either the host or the network interface device. In some embodiments, the eBPF program may be stored on the network interface device so that it can be executed before the host OS boots.

The compiler may be provided on the network interface device, the FPGA, or any other suitable location on the host. By way of example only, the compiler may run on the CPU on the network interface device.

Now, the compiler flow will be described. The compiler's front end accepts an eBPF program. The eBPF program may be written in any suitable language. For example, it may be written in a C-like language. The compiler is configured in the front end to convert the program into an intermediate representation (IR). In some embodiments, the IR may be LLVM-IR or any other suitable IR.

In some embodiments, pointer analysis may be performed to generate packet/map access primitives.

It should be noted that in some embodiments, optimization of the IR may be performed by the compiler. This may be optional in some embodiments.

The compiler's high-level synthesis backend is configured to partition the program pipeline into stages, generate packet access tabs, and emit C code. In some embodiments, the HLS portion of the design tool and/or the design tool being used may be called to synthesize the output of the HLS phase.

The compiler backend for the FPGA's smallest unit divides the pipeline into stages and generates packet access tabs. An if-conversion may be performed to convert control dependencies into data dependencies. The design is placed and routed. A partial bit file for the eBPF program is generated.

As illustrated in FIG. 20A, where there is a routing conflict, a routing problem may arise. For example, slice A may communicate with slice C, and slice B may communicate with slice D. In the arrangement of FIG. 20A, a common routing portion (60) is allocated not only for communication between slices A and C, but also for communication between slices B and D. In some embodiments, such routing conflicts may be avoided. In this regard, reference is made to FIG. 20B. As can be seen, a separate route (62) is provided between slices A and C, compared to a route (64) between slices B and D.

In some embodiments, a bit file description may include multiple different routes for at least some pairs of subunits. The compilation process will check for routing conflicts, as illustrated in Figure 20a. In the event of a routing conflict, the compiler can resolve or prevent such conflicts by selecting an appropriate alternative route among the routes.

Figure 21 illustrates a partition (66) of an FPGA for executing an eBPF program. The partition interfaces with the static portion of the FPGA, for example, through a series of input flip-flops (68) and a series of output flip-flops. In some embodiments, there may be routing (70) throughout the design, as discussed above.

The compiler may need to handle routing across the FPGA region being configured by the compiler. The compiler needs to generate partial bit files that correspond to the reconfigurable partitions within the main bit file. If the main bit file is generated with reconfigurable partitions, the design tool will prevent the use of those resources within the reconfigurable partitions so that the logic resources can be used by the partial bit files. However, the design tool may not be able to prevent the use of routing resources within the reconfigurable partitions.

Consequently, the analysis tool will need to prevent the use of routing resources used by the design tool within the main bit file. The analysis tool may also need to ensure that its list of available routes in the bit file description does not include any routes that use resources already in use by the main bit file. Available routes may be defined in terms of route templates, which can be used in numerous locations within the FPGA, since FPGAs are highly regularized. Routing resources used by the main bit file break the regularity, meaning the analysis tool will prevent the use of these templates in locations where they would conflict with the main bit file. The analysis tool may need to generate new route templates that can be used in these locations and/or prevent certain route templates from being used in certain locations.

Now, some examples of the functionality provided by the compiler in converting some exemplary eBPF program fragments into instructions to be executed by the minimum unit will be described.

Some embodiments may use any suitable synthesis tool to generate the bit file description. By way of example only, some embodiments may use the Bluespec tool, which relies on a mode that uses atomic transactions for hardware.

In the first example, the eBPF program fragment has two instructions:

Command 1: r1 += r2

Command 2: r1 += r3

The first instruction adds the number in register 1 (r1) to the number in register 2 (r2) and places the result in r1. The second instruction adds r1 to r3 and places the result in r1. Both instructions in this example use 64-bit registers, but only the lowest 32 bits. The upper 32 bits of the result are filled with zeros.

The compiler will translate these into instructions that can be performed by the smallest unit. A 32-bit add instruction requires 32 lookup table (LUT) pairs, a 32-bit carry chain, and 32 flip-flops.

Each pair in the lookup table adds two bits to produce a two-bit result. The carry chain is a structure that allows a bit to be carried from one digit column to the next during addition, and allows a bit to be borrowed from the next column during subtraction.

32 flip-flops are storage elements that accept a value on one clock cycle and reconstruct it on the next clock cycle. They can also be used to limit the amount of work performed per clock cycle and to simplify timing analysis.

In some embodiments, an FPGA may include multiple slices. In some example slices, a carry chain propagates from the bottom of the slice (CIN) to the top of the slice (COUT), which is then connected to the CIN input of the next slice.

In the example where each slice has a 4-bit carry chain, eight slices are used to perform a 32-bit addition. In this embodiment, the minimum unit may be considered to be provided by a pair of slices. This is because in some embodiments, it may be convenient for the minimum unit to operate on an 8-bit value.

In the example where each slice has an 8-bit carry chain, four slices are used to perform a 32-bit addition. In this embodiment, the minimum unit may be considered as provided by the slice.

It should be recognized that this is merely an example, and that, as discussed earlier, the smallest unit may be defined in any suitable way.

In this example, the case where the FPGA has slices that support an 8-bit carry chain will now be used in the compilation of a fragment of the first exemplary eBPF program.

There are three 32-bit wide input values and one 32-bit wide output value. There may have been other, earlier instructions that generated these three input values. In the following, some arbitrary location of the slice (minimum unit) will be assumed.

The following numbering convention will be used. Slices (minimal units) are arranged in a regular arrangement of rows and columns. XnYm indicates the position of the minimum unit in the array. Xn indicates the column and Ym indicates the row. X6Y0 indicates that the slice is at column 6 and row 0. It should be recognized that any other suitable numbering scheme may be used in other embodiments.

Assume that the initial values are generated simultaneously at the following locations:

r1: slices X6Y0, X6Y1, X6Y2, and X6Y3

r2: Slice X6Y4, X6Y5, X6Y6, and X6Y7

r3: Slice X6Y8, X6Y9, X6Y10, and X6Y11

The result of the first instruction needs to be computed by four adjacent slices in the same column so that the carry chain is correctly connected upward. The compiler may choose to compute the result in slices X7Y0, X7Y1, X7Y2, and X7Y3. For this to work, the inputs need to be connected upward. There will be a connection from X6Y0 to X7Y0, another connection from X6Y1 to X7Y1, a connection from X6Y2 to X7Y2, and a connection from X6Y3 to X7Y3. There also needs to be a corresponding connection from X6Y4-X6Y7 to X7Y0-X7Y3.

These would be full-byte connections, meaning that each of the eight input bits is connected to the corresponding output bit. For example:

Output from slice X6Y0 flip-flip 0 is connected to input 0 of slice X7Y0 LUT 0.

The output of slice X6Y0 flip-flip 1 is connected to input 0 of slice X7Y0 LUT 1.

It'll be like that until next time

The output from slice X6Y0 flip-flip 7 is connected to input 0 of slice X7Y0 LUT 7.

During the first clock cycle, the r1 and r2 values of slices X6Y0-X6Y7 will be passed to the inputs of slices X7Y0-X7Y3, processed by the LUT and carry chain, and the results will be stored in the flip-flops of those slices X7Y0-X7Y3, ready to be used on the next cycle.

Go to instruction 2. The compiler needs to choose where to compute the result of instruction 2. It might choose slices X7Y4 through X7Y7. Again, there will be a full byte concatenation from the result of instruction 1 (X7Y0 through X7Y3) to the input to instruction 2 (X7Y4 through X7Y7).

The value of r3 is also needed. If r1, r2, and r3 were generated in cycle 0, then r1 + r2 will be generated in cycle 1. The value of r3 needs to be delayed by a clock cycle so that it is generated in cycle 1. The compiler may choose to generate r3 in cycle 1 using slices X7Y8 through X7Y11. Then, there will need to be a connection from the original slice that generated r3 in cycle 0 (X6Y8 through X6Y11) to a new slice that generates the same value in cycle 1 (X7Y8 through X7Y11). Having done that, there now needs to be a connection from those new slices to the slice for instruction 2. Thus, the output of slice X7Y8 is connected to the input of slice X7Y4, and so on.

Then, the FPGA bit file will contain the following features:

- Concatenate all bytes from X6Y0 to X7Y0 input 0 (initial r1 byte 0)

- Concatenate all bytes from X6Y1 to X7Y1 input 0 (initial r1 byte 1)

- Concatenate all bytes from X6Y2 to X7Y2 input 0 (initial r1 byte 2)

- Concatenate all bytes from X6Y3 to X7Y3 input 0 (initial r1 byte 3)

- Concatenate all bytes from X6Y4 to X7Y0 input 1 (initial r2 byte 0)

- Concatenate all bytes from X6Y5 to X7Y1 input 1 (initial r2 byte 1)

- Concatenate all bytes from X6Y6 to X7Y2 input 1 (initial r2 byte 2)

- Concatenate all bytes from X6Y7 to X7Y3 input 1 (initial r2 byte 3)

- Concatenate all bytes from X6Y8 to X7Y8 input 0 (initial r3 byte 0)

- Concatenate all bytes from X6Y9 to X7Y9 input 0 (initial r3 byte 1)

- Concatenate all bytes from X6Y10 to X7Y10 input 0 (initial r3 byte 2)

- Concatenate all bytes from X6Y11 to X7Y11 input 0 (initial r3 byte 3)

- Slice X7Y0 (instruction 1 byte 0) configured to add input 0 to input 1

- Slice X7Y1 (instruction 1 byte 1) configured to add input 0 to input 1

- Slice X7Y2 (instruction 1 byte 2) configured to add input 0 to input 1

- Slice X7Y3 (instruction 1 byte 3) configured to add input 0 to input 1

- Slice X7Y8 (r3 delay byte 0) configured to copy input 0 to output

- Slice X7Y9 (r3 delay byte 1) configured to copy input 0 to output

- Slice X7Y10 (r3 delay byte 2) configured to copy input 0 to output

- Slice X7Y11 (r3 delay byte 3) configured to copy input 0 to output

- Concatenate all bytes from X7Y0 to X7Y4 input 0 (command 1 byte 0)

- Concatenate all bytes from X7Y1 to X7Y5 input 0 (command 1 byte 1)

- Concatenate all bytes from X7Y2 to X7Y6 input 0 (command 1 byte 2)

- Concatenate all bytes from X7Y3 to X7Y7 input 0 (command 1 byte 3)

- Full byte concatenation from X7Y8 to X7Y4 input 1 (r3 delay byte 0)

- Full byte concatenation from X7Y9 to X7Y5 input 1 (r3 delay byte 1)

- Full byte concatenation from X7Y10 to X7Y6 input 1 (r3 delay byte 2)

- Full byte concatenation from X7Y11 to X7Y7 input 1 (r3 delay byte 3)

- Slice X7Y4 (instruction 2 byte 0) configured to add input 0 to input 1

- Slice X7Y5 (instruction 2 byte 1) configured to add input 0 to input 1

- Slice X7Y6 (instruction 2 byte 2) configured to add input 0 to input 1

- Slice X7Y7 (instruction 2 byte 3) configured to add input 0 to input 1

The compiler doesn't need to generate the upper 32 bits of the result of instruction 2 because they are known to be zero. It can simply note that fact and use zeros whenever they are used.

Now, a second example of compiling an eBPF fragment will be described.

Command 1: r1 & = 0xff

Command 2: r2 & = 0xff

Command 3: If r1 < r2, move to L1

Command 4: r1 = r2

Label L1.

The first instruction performs a bitwise AND of r1 with the constant 0xff and places the result in r1. A given bit in the result will be set to 1 if the corresponding bit was originally set to 1 in r1 and the corresponding bit is set to 1 in the constant. Otherwise, it will be set to zero. The constant 0xff causes bits 0 through 7 to be set and bits 8 through 63 to be cleared, so the result will be that bits 0 through 7 of r1 will remain unchanged, but bits 8 through 63 will be set to zero. This simplifies things for the compiler, since it understands that bits 8 through 63 are zero and there is no need to generate them. The second instruction does the same for r2.

Instruction 3 checks whether r1 is less than r2, and if so, jumps to label L1. This skips instruction 4, which simply copies the value from r2 to r1. This sequence of instructions finds the minimum of r1 byte 0 and r2 byte 0, and places the result in r1 byte 0.

The compiler may also use a technique known as "if conversion" to convert a conditional jump into a select instruction:

Command 1: r1 & = 0xff

Command 2: r2 & = 0xff

Command 5: c1 = (r1 < r2)

Command 6: r1 = c1 ? r1 : r2

Instruction 5 compares r1 to r2 and sets c1 to 1 if r1 is less than r2, otherwise it sets c1 to zero. Instruction 6 is a select instruction that copies r1 to r1 if c1 is set (which has no effect), otherwise it copies r2 to r1. If c1 is equal to 1, then instruction 3 will skip instruction 4, which means r1 will keep its value from instruction 1. In this case, the select instruction also leaves r1 unchanged. If c1 is equal to zero, then instruction 3 will not skip instruction 4, so r2 will be copied to r1 by instruction 4. Again, the select instruction will copy r2 to r1, so the new sequence has the same effect as the previous sequence.

Instruction 6 is not a valid eBPF instruction. However, while the compiler is running, the instruction is represented in LLVM-IR. Instruction 6 will be a valid instruction in LLVM-IR.

Now these instructions need to be allocated in minimal units. Assume that input r1 is available in slices X0Y0 to X0Y7 and r2 is available in slices X0Y8 to X0Y15. Instructions 1 and 2 cause the compiler to note that the upper 7 bytes of r1 and r2 are set to zero.

Next, the compiler may choose to compute the result of instruction 5 in slice X1Y0. This requires a full byte concatenation from the output of slice X0Y0 to input 0 of slice X1Y0, and a full byte concatenation from the output of slice X0Y8 to input 1 of slice X1Y0. The way the two values are compared is to see if the calculation overflows by subtracting one value from the other and then attempting to borrow from the next higher bit. The result of this comparison is then stored in flip-flop 7 of slice X1Y1.

As in the first example, r1 and r2 would need to be delayed by one cycle to provide their values at the correct time for instruction 6. The compiler could also use slices X1Y1 and X1Y2 for r1 and r2, respectively.

The select instruction requires three inputs: c1, r1, and r2. Note that r1 and r2 are 1 byte wide, but c1 is only 1 bit wide. Assume the compilation computes the result of the select instruction slice X2Y0. The selection is performed on a bit-by-bit basis, with each LUT in slice X2Y0 handling 1 bit:

If c1 is set, then bit 0 of the result is r1 bit 0 and r2 bit 0

other

If c1 is set, then bit 1 of the result is r1 bit 1 and r2 bit 1

other

...and it will continue like that until next time

If c1 is set, then bit 7 of the result is r1 bit 7 and r2 bit 7

other.

Each LUT may need to access a corresponding bit from r1 and a corresponding bit from r2, but all LUTs need to access c1. This means that c1 needs to be replicated across the bits of input 0 of the slice. Therefore, the connection to the input of instruction 6 would be:

Duplicate bit 7 of the output of slice X1Y0 to input 0 of slice X2Y0.

Concatenate all bytes from the output of slice X1Y1 to input 1 of slice X2Y0.

Concatenate all bytes from the output of slice X1Y2 to input 2 of slice X2Y0.

Another issue that needs to be addressed concerns shift instructions. Consider the following example:

A 16-bit left shift of 5 bits would require:

Set output bit 0 to zero

Set output bit 1 to zero

Set output bit 2 to zero

Set output bit 3 to zero

Set output bit 4 to zero

Copy input bit 0 to output bit 5

Copy input bit 1 to output bit 6

...

Copy input bit 10 to output bit 15

Note that the input and output here are connections. The input of the connection comes from the output of the first slice. The output of the connection goes to the input of the second slice.

This type of connection may not be possible within a slice, but rather through interconnections between slices. The compiler can assume that a 16-bit input value is generated by two adjacent slices within the same column, because it can verify that the value was generated there.

As an example, assume that the inputs are generated by slices X0Y4 and X0Y5 and the outputs go to slices X1Y4 and X1Y5. In that case, the following connections are required:

Slice X1Y4 bit 0 is known to be zero and is therefore not needed.

Slice X1Y4 bit 1 is known to be zero and therefore not needed.

Slice X1Y4 bit 2 is known to be zero and therefore not required.

Slice X1Y4 bit 3 is known to be zero and therefore not required.

Slice X1Y4 bit 4 is known to be zero and therefore not required.

Slice X1Y4 bit 5 is derived from slice X0Y4 bit 0

Slice X1Y4 bit 6 is derived from slice X0Y4 bit 1

Slice X1Y4 bit 7 is derived from slice X0Y4 bit 2

Slice X1Y5 bit 0 comes from slice X0Y4 bit 3

Slice X1Y5 bit 1 comes from slice X0Y4 bit 4

Slice X1Y5 bit 2 is derived from slice X0Y4 bit 5

Slice X1Y5 bit 3 is derived from slice X0Y4 bit 6

Slice X1Y5 bit 4 is derived from slice X0Y4 bit 7

Slice X1Y5 bit 5 is derived from slice X0Y5 bit 0

Slice X1Y5 bit 6 is derived from slice X0Y5 bit 1

Slice X1Y5 bit 7 is derived from slice X0Y5 bit 2

The eight connections to the inputs of slice X1Y5 can be considered as shifted connections or shifted roots. The same structure can be used for slice X1Y4, but with inputs from X1Y3 and X1Y4, since bits 5-7 match and the slice can ignore bits 0-4, so it does not matter which input is presented there.

It may be necessary to be able to shift by any amount between 1 and 7 bits. A concatenation that shifts by 0 or 8 bits is exactly equivalent to a full byte concatenation, since in that case each bit is concatenated to the corresponding bit in the other slice.

Shifting by a variable amount may be performed in two or three stages, depending on the width of the values being shifted. The stages are as follows:

Stage 1: Shift by 0, 1, 2, or 3.

Stage 2: Shift by 0, 4, 8, or 12.

Stage 3: Shift by 0, 16, 32, or 48 (32-bit or 64-bit only).

As another example, suppose there is an arithmetic right shift of a variable amount of bytes, the value to be shifted is produced by the slice X3Y2 and the shift amount is produced by X3Y3.

Arithmetic right shift requires a connection of the "arithmetic right shift" type. This type of connection takes the outputs of one slice and connects them to the inputs of another slice, but shifts them to the right by a constant amount in the process, duplicating the sign bit as needed.

For example, the "arithmetic right shift by 3" chain would be:

Output bit 0 comes from input bit 3

Output bit 1 comes from input bit 4

Output bit 2 comes from input bit 5

Output bit 3 comes from input bit 6

Output bit 4 comes from input bit 7

Output bit 5 is derived from input bit 7 (sign bit)

Output bit 6 is derived from input bit 7 (sign bit)

Output bit 7 is derived from input bit 7 (sign bit)

Stage 1 could also be computed on slice X4Y2, in which case it would require the following concatenation:

Total bytes from slice X3Y2 to slice X4Y2 input 0

Arithmetic right shift of 1 from slice X3Y2 to slice X4Y2 input 1

Arithmetic right shift by 2 from slice X3Y2 to slice X4Y2 input 2

Arithmetic right shift of 3 from slice X3Y2 to slice X4Y2 input 3

Duplicate slice X3Y3 bit 0 to slice X4Y2 input 4

Duplicate slice X3Y3 bit 1 to slice X4Y2 input 5

Next, slice X4Y2 is configured to select one of the first four inputs based on inputs 4 and 5 as follows:

Input 4 is 0 and input 5 is 0: Select input 0

Input 4 is 1 and input 5 is 0: Select input 1

Input 4 is 0 and input 5 is 1: Select input 2

Input 4 is 1 and input 5 is 1: Select input 3

The shift amount may also be copied from slice X3Y3 to slice X4Y3 to provide a delayed version.

Stage 2 could also be computed on slice X5Y2, in which case it would require the following concatenation:

Total bytes from slice X4Y2 to slice X5Y2 input 0

Arithmetic right shift of 4 from slice X4Y2 to slice X5Y2 input 1

Duplicate slice X4Y3 bit 2 to slice X5Y2 input 2

Next, slice X5Y2 will be configured to select input 0 or input 1 based on input 2 as follows:

Input 2 is 0: Select input 0

Input 2 is 1: Select input 1

The output of slice X5Y2 will be the result of a variable arithmetic shift right operation.

A bit file for a given minimum unit might look like this:

The smallest unit of identity information

A list of other minimal units that can receive input and available routes for that input for a given minimal unit.

A given minimal unit is a list of other minimal units that can provide output and available routes to that output.

It should be recognized that since FPGAs are regular structures, there may be a common template that can be used for multiple minimum units with modifications to the individual minimum units as needed.

As an example, a bit file description for slice X7Y1 might specify the following possible inputs and outputs:

Input from X6Y1 via root A or root B

Input from X6Y5 via root C or root D

Input from X7Y0 via root E or root F

Output to X8Y1 via root G or root H

Output to X7Y2 via root I or root J

Output to X7Y5 via root K or root L.

The compiler will use this bit file description to provide partial bit files for the input and output of slice X7Y1 for the first eBPF example described above.

Input from X6Y1 via root A

Input from X6Y5 via root C

Output to X7Y5 via root K or root L.

As an example, a bit file description for slice XnYm might specify the following possible inputs and outputs:

Input from Xn-1Ym via root A or root B

Input from Xn-1Ym+4 via root C or root D

Input from XnYm-1 via root E or root F

Output to Xn+1Ym via root G or root H

Output to XnYm+1 via root I or root J

Output to XnYm+4 via root K or root L.

This bit file description may be modified to remove one or more roots that are not available for use by the compiler, as described above. This may be because the roots are used by other atomic units or for routing through partitions.

It should be recognized that a compiler may be implemented by a computer program comprising computer-executable instructions that may be executed by one or more computer processors. The compiler may also be executed on hardware, such as at least one processor operating in conjunction with one or more memories.

While exemplary embodiments have been described above, it is noted that there are many variations and modifications that can be made to the disclosed solution without departing from the scope of the present invention.

Accordingly, embodiments may vary within the scope of the appended claims. In general, some embodiments may be implemented in hardware or special purpose circuitry, software, logic, or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor, or other computing device, although the embodiments are not limited to such devices.

Embodiments may be implemented by computer software stored in memory and executable by at least one data processor of the accompanying entity, or by hardware, or by a combination of software and hardware.

The software may be stored on physical media such as memory chips, or memory blocks implemented within a processor, magnetic media such as a hard disk or floppy disk, and optical media such as, for example, DVDs and their data variants, CDs.

The memory may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory.

The data processor may be of any type appropriate to the local technical environment and may include, but is not limited to, one or more of a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a gate level circuit, and a processor based on a multi-core processor architecture.

When read in conjunction with the accompanying drawings and the appended claims, various modifications and adaptations may become apparent to those skilled in the art in light of the foregoing description. However, all such and similar modifications of the present teachings will remain within the scope defined in the appended claims.

Claims (30)

As a network interface device for interfacing a host device to a network,
A first interface configured to receive a plurality of data packets;
A configurable hardware module, wherein the hardware module comprises a plurality of processing units, each processing unit being associated with a predefined type of operation executable in a single step, and wherein at least some of the plurality of processing units are associated with different predefined types of operations.
Includes,
The hardware module is configured to interconnect at least some of the plurality of processing units to provide a first data processing pipeline for processing at least one of the plurality of data packets to perform a first function on at least one of the plurality of data packets,
A network interface device, wherein at least two of the plurality of processing units within the first data processing pipeline are configured to perform their respective predefined types of operations in parallel. In the first paragraph,
At least two of the plurality of processing units described above are:
To perform its associated predefined type of operation within a predefined length of time defined by a clock signal; and
In response to the expiration of the above predefined length of time, transmit the result of each of the at least one operations to the next processing unit.
A network interface device that is configured. In claim 1 or 2,
A network interface device, wherein each of said plurality of processing units includes an application specific integrated circuit configured to perform at least one operation associated with each of said processing units. In claim 1 or 2,
At least one of the plurality of processing units includes a digital circuit and a memory that stores a state related to processing performed by the digital circuit,
A network interface device, wherein the digital circuit is configured to communicate with the memory and perform the predefined type of operation associated with each of the processing units. In claim 1 or 2,
Two or more of the above plurality of processing units include accessible memory,
The above memory is configured to store a state associated with the first data packet,
A network interface device, wherein during performance of the first function by the hardware module, two or more of the plurality of processing units are configured to access and modify the state. In paragraph 5,
A network interface device, wherein at least some of the plurality of processing units, a first processing unit, is configured to stall during access of the value of the state by a second processing unit of the plurality of processing units. In claim 1 or 2,
A network interface device, wherein one or more of the plurality of processing units are individually configurable to perform operations specific to each pipeline based on their associated predefined types of operations. In claim 1 or 2,
The hardware module is configured to receive a command and, in response to the command:
Interconnecting at least some of said plurality of processing units to provide a data processing pipeline for processing one or more of said plurality of data packets;
Causing one or more of the above plurality of processing units to perform an operation of its associated predefined type on one or more data packets;
Adding one or more of the above plurality of processing units to a data processing pipeline; and
Removing one or more of the plurality of processing units from the data processing pipeline;
A network interface device configured to perform at least one of the following: In claim 1 or 2,
The above predefined actions are:
Loading at least one value of the first data packet from memory;
storing at least one value of a data packet in memory; and
Performing a lookup against a lookup table to determine what action to perform on the data packet.
A network interface device comprising at least one of: In claim 1 or 2,
At least one of said plurality of processing units is configured to transmit at least one result of its associated at least one predefined operation to a subsequent processing unit in said first data processing pipeline,
A network interface device, wherein the above-described subsequent processing unit is configured to perform a next predefined action depending on the at least one result. In claim 1 or 2,
A network interface device, wherein each of the operations of the above different predefined types is defined by a different template. In claim 1 or 2,
The behavior of the above predefined types is:
Accessing data packets;
Accessing a lookup table stored within the memory of the above hardware module;
Performing logical operations on data loaded from data packets; and
Performing logical operations on data loaded from the above lookup table
A network interface device comprising at least one of: In claim 1 or 2,
The above hardware module includes routing hardware,
A network interface device, wherein the hardware module is configured to interconnect at least some of the plurality of processing units to provide the first data processing pipeline by configuring the routing hardware to route data packets among the plurality of processing units in a specific order defined by the first data processing pipeline. In claim 1 or 2,
A network interface device, wherein the hardware module is configured to interconnect at least some of the plurality of processing units to provide a second data processing pipeline for processing one or more of the plurality of data packets to perform a second function different from the first function. In claim 1 or 2,
A network interface device, wherein the hardware module is configured to interconnect at least some of the plurality of processing units to provide a second data processing pipeline after interconnecting at least some of the plurality of processing units to provide a first data processing pipeline. In claim 1 or 2,
A network interface device comprising additional circuitry separate from the hardware module and configured to perform the first function for one or more of the plurality of data packets. In Article 16,
The above additional circuit part:
field programmable gate array; and
Multiple central processing units
A network interface device comprising at least one of: In Article 16,
The above network interface device comprises at least one controller,
The additional circuit unit is configured to perform the first function on a data packet during a compilation process for the first function to be performed in the hardware module,
A network interface device, wherein said at least one controller is configured to control said hardware module to start performing said first function on a data packet in response to completion of said compilation process. In Article 18,
A network interface device, wherein said at least one controller is configured to control said additional circuitry to stop performing said first function for a data packet in response to a determination that said compilation process for said first function to be performed in said hardware module is complete. In Article 16,
The above network interface device comprises at least one controller,
The hardware module is configured to perform the first function on a data packet during a compilation process for the first function to be performed in the additional circuit unit,
A network interface device, wherein said at least one controller is configured to determine that said compilation process for said first function to be performed in said additional circuitry is complete, and in response to said determination, control said additional circuitry to start performing said first function for a data packet. In Article 20,
A network interface device, wherein said at least one controller is configured to control said hardware module to stop performing said first function for a data packet in response to a determination that said compilation process for said first function to be performed in said additional circuitry has been completed. In claim 1 or 2,
A network interface device comprising at least one controller configured to perform a compilation process to provide the first function to be performed in the hardware module. A data processing system comprising a network interface device according to claim 1 or claim 2, and a host device,
A data processing system comprising at least one controller configured to perform a compilation process to provide a first function to be performed in a hardware module. In Article 23,
At least one controller above:
the above network interface device; and
The above host device
A data processing system provided by one or more of: In Article 23,
A data processing system, wherein the compilation process is performed in response to a determination by at least one controller that the computer program expressing the first function is safe for execution in kernel mode of the host device. In Article 23,
wherein said at least one controller is configured to perform said compilation process by assigning each of said plurality of processing units to perform at least one operation from a plurality of operations expressed as a sequence of computer code instructions in a specific order in said first data processing pipeline;
A data processing system, wherein the plurality of operations provide the first function for at least one of the plurality of data packets. In Article 25,
At least one controller above:
Prior to completion of the above compilation process, transmitting a first command to cause an additional circuit of the network interface device to perform the first function on the data packet; and
Following completion of the above compilation process, transmit a second command to cause the hardware module to start performing the first function for the data packet.
A data processing system comprising: As a method for implementation in a network interface device,
In the first interface, a step of receiving a plurality of data packets; and
A step of configuring the hardware module to interconnect at least some of the plurality of processing units of the hardware module to provide a first data processing pipeline for processing one or more of the plurality of data packets to perform a first function on one or more of the plurality of data packets.
Includes,
Each processing unit is associated with a predefined type of operation that can be executed in a single step,
At least some of the above plurality of processing units are associated with operations of different predefined types,
A method for implementation in a network interface device, wherein at least two of the plurality of processing units within the first data processing pipeline are configured to perform their respective predefined types of operations in parallel. A non-transitory computer-readable medium comprising program instructions for causing a network interface device to perform a method,
The above method is:
In the first interface, a step of receiving a plurality of data packets; and
A step of configuring the hardware module to interconnect at least some of the plurality of processing units of the hardware module to provide a first data processing pipeline for processing one or more of the plurality of data packets to perform a first function on one or more of the plurality of data packets.
Includes,
Each processing unit is associated with a predefined type of operation that can be executed in a single step,
At least some of the above plurality of processing units are associated with operations of different predefined types,
A non-transitory computer-readable medium, wherein at least two of the plurality of processing units within the first data processing pipeline are configured to perform their respective predefined types of operations in parallel. delete