Method and apparatus for performing network processing functions

• US 20040114589A1
• Filed: 12/13/2002
• Published: 06/17/2004
• Est. Priority Date: 12/13/2002
• Status: Active Grant

• Current Assignee: NVIDIA Corporation
• Original Assignee: NVIDIA Corporation
• Inventors: Sidenblad, Paul J., Hicok, Gary D., Alfieri, Robert A., Parris, Mark A.
• Granted Patent: US 7,397,797 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/611 for multicast or broadcast systems for broadcast or conference H04L12/18; arrangements for broadcast or distribution combined with broadcast H04H20/00; arrangements for broadcast applications with a direct linkage to broadcast information or to broadcast space-time H04H60/00; selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS], H04W4/06
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 69/12 Protocol engines
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/166 IP fragmentation; TCP segmentation
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A novel network architecture that integrates the functions of an internet protocol (IP) router into a network processing unit (NPU) that resides in a host computer'"'"'s chipset such that the host computer'"'"'s resources are perceived as separate network appliances. The NPU appears logically separate from the host computer even though, in one embodiment, it is sharing the same chip.

Claims

32. Method for performing network processing, said method comprising the steps of:

a) providing a media access controller interface (MI) subunit for communicating with at least one media access controller (MAC) to serve as an input and output point for traversal of packets;

b) providing a host media access controller (HM) subunit for communicating with said media access controller interface (MI) subunit;

c) providing a sequence processor (SP) subunit for communicating with said media access controller interface (MI) subunit; and

d) providing an address translation (AT) subunit for communicating with said sequence processor subunit, wherein said plurality of subunits effect both router packet processing and host packet processing.

1. A network processing apparatus, said apparatus comprising:

a media access controller interface (MI) subunit for communicating with at least one media access controller (MAC) to serve as an input and output point for traversal of packets;

a host media access controller (HM) subunit for communicating with said media access controller interface (MI) subunit;

a sequence processor (SP) subunit for communicating with said media access controller interface (MI) subunit; and

an address translation (AT) subunit for communicating with said sequence processor subunit, wherein said plurality of subunits effect both router packet processing and host packet processing.

2. The apparatus of claim 1, wherein said router packet processing includes input and output network address translation (NAT).

3. The apparatus of claim 1, wherein said router packet processing includes packet routing.

4. The apparatus of claim 1, wherein said router packet processing includes bridging.

5. The apparatus of claim 1, wherein said router packet processing includes packet multicasting.

6. The apparatus of claim 1, wherein said router packet processing includes firewalling.

7. The apparatus of claim 1, wherein said router packet processing and host packet processing include packet decapsulation and encapsulation.

8. The apparatus of claim 1, wherein said router packet processing and host packet processing include packet decryption and encryption.

9. The apparatus of claim 1, wherein said router packet processing and host packet processing include packet decompression and compression.

10. The apparatus of claim 1, wherein said router packet processing and host packet processing include validation.

11. The apparatus of claim 1, wherein said router packet processing and host packet processing include fragmentation.

12. The apparatus of claim 1, wherein said router packet processing and host packet processing include checksum.

13. The apparatus of claim 1, wherein said at least one media access controller (MAC) is a media independent interface MAC (miiMAC).

14. The apparatus of claim 1, wherein said at least one media access controller (MAC) is a dspMAC.

15. The apparatus of claim 1, wherein said at least one media access controller (MAC) is a wiMAC.

16. The apparatus of claim 1, wherein said plurality of subunits communicates with each other via two point-to-point buses.

17. The apparatus of claim 1, further comprises a front end subunit and a shared cache, wherein said front end subunit manages said shared cache among at least two of said subunits.

18. The apparatus of claim 17, wherein said front end subunit breaks said shared cache into a plurality of banks to achieve load-balancing among said at least two of said subunits.

19. The apparatus of claim 17, wherein said front end subunit manages direct memory access between said shared cache and a system memory.

20. The apparatus of claim 17, wherein said front end subunit employs a round-robin scheduling method in managing said shared cache.

21. The apparatus of claim 1, wherein said at least one media access controller (MAC) forwards packets to said media access controller interface (MI) subunit via a first asynchronous interface.

22. The apparatus of claim 21, wherein said at least one media access controller (MAC) communicates with said media access controller interface (MI) subunit via a second sideband interface for communicating control messages.

23. The apparatus of claim 1, wherein said media access controller interface (MI) employs an input first-in-first-out (fifo) buffer for each of said at least one media access controller (MAC).

24. The apparatus of claim 23, wherein said input first-in-first-out (fifo) buffer is implemented partly in cache and partly in memory.

25. The apparatus of claim 1, wherein said media access controller interface (MI) employs at least one output first-in-first-out (fifo) buffer for each of said at least one media access controller (MAC).

26. The apparatus of claim 25, wherein said at least one output first-in-first-out (fifo) buffer is implemented partly in cache and partly in memory.

27. The apparatus of claim 25, wherein said at least one output first-in-first-out (fifo) buffer comprises four buffers for each of said at least one media access controller (MAC).

28. The apparatus of claim 1, wherein said host media access controller (HM) subunit employs a plurality of push buffers for communicating with said media access controller interface (MI) subunit.

29. The apparatus of claim 28, wherein said plurality of push buffers are used to configure the network processing apparatus.

30. The apparatus of claim 1, wherein said sequence processor (SP) subunit comprises a receive pipeline and a transmit pipeline.

31. The apparatus of claim 30, wherein said receive pipeline and said transmit pipeline share a common operation pipeline.

33. The method of claim 32, wherein said router packet processing includes input and output network address translation (NAT).

34. The method of claim 32, wherein said router packet processing includes packet routing.

35. The method of claim 32, wherein said router packet processing includes bridging.

36. The method of claim 32, wherein said router packet processing includes packet multicasting.

37. The method of claim 32, wherein said router packet processing includes firewalling.

38. The method of claim 32, wherein said router packet processing and host packet processing include packet decapsulation and encapsulation.

39. The method of claim 32, wherein said router packet processing and host packet processing include packet decryption and encryption.

40. The method of claim 32, wherein said router packet processing and host packet processing include packet decompression and compression.

41. The method of claim 32, wherein said router packet processing and host packet processing include validation.

42. The method of claim 32, wherein said router packet processing and host packet processing include fragmentation.

43. The method of claim 32, wherein said router packet processing and host packet processing include checksum.

44. The method of claim 32, wherein said at least one media access controller (MAC) is a media independent interface MAC (miiMAC).

45. The method of claim 32, wherein said at least one media access controller (MAC) is a dspMAC.

46. The method of claim 32, wherein said at least one media access controller (MAC) is a wiMAC.

47. The method of claim 32, wherein said plurality of subunits communicate with each other via two point-to-point buses.

48. The method of claim 32, further comprises the step of:

(e) providing a front end subunit and a shared cache, wherein said front end subunit manages said shared cache among at least two of said subunits.

49. The method of claim 48, wherein said front end subunit breaks said shared cache into a plurality of banks to achieve load-balancing among said at least two of said subunits.

50. The method of claim 48, wherein said front end subunit manages direct memory access between said shared cache and a system memory.

51. The method of claim 48, wherein said front end subunit employs a round-robin scheduling method in managing said shared cache.

52. The method of claim 32, wherein said at least one media access controller (MAC) forwards packets to said media access controller interface (MI) subunit via a first asynchronous interface.

53. The method of claim 52, wherein said at least one media access controller (MAC) communicates with said media access controller interface (MI) subunit via a second sideband interface for communicating control messages.

54. The method of claim 32, wherein said media access controller interface (MI) subunit employs an input first-in-first-out (fifo) buffer for each of said at least one media access controller (MAC).

55. The method of claim 54, wherein said input first-in-first-out (fifo) buffer is implemented partly in cache and partly in memory.

56. The method of claim 32, wherein said media access controller interface (MI) employs at least one output first-in-first-out (fifo) buffer for each of said at least one media access controller (MAC).

57. The method of claim 56, wherein said at least one output first-in-first-out (fifo) buffer is implemented partly in cache and partly in memory.

58. The method of claim 56, wherein said at least one output first-in-first-out (fifo) buffer comprises four buffers for each of said at least one media access controller (MAC).

59. The method of claim 32, wherein said sequence processor (SP) subunit comprises a receive pipeline and a transmit pipeline.

60. The method of claim 59, wherein said receive pipeline and said transmit pipeline share a common operation pipeline.

57-1. The method of claim 32, wherein said host media access controller (HM) subunit employs a plurality of push buffers for communicating with said media access controller interface (MI) subunit.

58-2. The method of claim 57, wherein said plurality of push buffers are used to configure the network processing apparatus.

61. A network processing apparatus, said apparatus comprising:

media access controller interface (MI) subunit means for communicating with at least one media access controller (MAC) to serve as an input and output point for traversal of packets;

host media access controller (HM) subunit means for communicating with said media access controller interface (MI) subunit means;

sequence processor (SP) subunit means for communicating with said media access controller interface (MI) subunit means; and

address translation (AT) subunit means for communicating with said sequence processor subunit means, wherein said plurality of subunit means effect both router packet processing and host packet processing.

62. The apparatus of claim 61, wherein said plurality of subunit means communicates with each other via two point-to-point buses.

63. The apparatus of claim 61, further comprises:

a front end subunit means and a shared cache, wherein said front end subunit means manages said shared cache among at least two of said subunit means.

64. The apparatus of claim 61, wherein said at least one media access controller (MAC) forwards packets to said media access controller interface (MI) subunit means via a first asynchronous interface and, wherein said at least one media access controller (MAC) communicates with said media access controller interface (MI) subunit means via a second sideband interface for communicating control messages.

65. The apparatus of claim 61, wherein said media access controller interface (MI) subunit means employs an input first-in-first-out (fifo) buffer for each of said at least one media access controller (MAC) and, wherein said input first-in-first-out (fifo) buffer is implemented partly in cache and partly in memory.

66. The apparatus of claim 61, wherein said media access controller interface (MI) subunit means employs at least one output first-in-first-out (fifo) buffer for each of said at least one media access controller (MAC) and, wherein said at least one output first-in-first-out (fifo) buffer is implemented partly in cache and partly in memory.

67. The apparatus of claim 61, wherein said host media access controller (HM) subunit means employs a plurality of push buffers for communicating with said media access controller interface (MI) subunit means.

68. The apparatus of claim 61, wherein said sequence processor (SP) subunit means comprises a receive pipeline and a transmit pipeline, wherein said receive pipeline and said transmit pipeline share a common operation pipeline.

69. A computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform the steps comprising of:

a) providing a media access controller interface (MI) subunit for communicating with at least one media access controller (MAC) to serve as an input and output point for traversal of packets;

b) providing a host media access controller (HM) subunit for communicating with said media access controller interface (MI) subunit;

c) providing a sequence processor (SP) subunit for communicating with said media access controller interface (MI) subunit; and

d) providing an address translation (AT) subunit for communicating with said sequence processor subunit, wherein said plurality of subunits effect both router packet processing and host packet processing.

70. The computer-readable medium of claim 69, further comprises the step of:

(e) providing a front end subunit and a shared cache, wherein said front end subunit manages said shared cache among at least two of said subunits.

71. A sequence processing apparatus, said apparatus comprising:

an authentication module for performing authentication on a packet;

a decryption module for receiving a portion of said authenticated packet to begin decrypting said portion of said authenticated packet prior to said authentication process being completed for the entire packet; and

a checksum module for receiving a portion of said decrypted packet to start checksum on said portion of said decrypted packet prior to said decryption process being completed for the entire packet.

72. The apparatus of claim 71, further comprising:

a decapsulation module for decapsulating said packet prior to said authentication process.

73. The apparatus of claim 71, further comprising:

a decompression module for decompressing said decrypted packet prior to said checksum process.

74. The apparatus of claim 71, further comprising:

a recirculation buffer as a storage for holding said portion of said authenticated packet, said portion of said decrypted packet or said portion of said checksumed packet only if a next module is unable to receive said associated portion of a packet.

75. The apparatus of claim 71, wherein said checksum module checksums said packet as an internetworking transmission protocol packet, wherein said checksum module determines a padding length in said packet, and then subtracts said padding length from said checksuming step.

76. The apparatus of claim 75, wherein said internetworking transmission protocol packet is a Transmission Control Protocol (TCP) packet.

77. The apparatus of claim 75, wherein said internetworking transmission protocol packet is a User Datagram Protocol (UDP) packet.

78. The apparatus of claim 71, wherein said functions performed by said modules are configurable.

79. The apparatus of claim 78, wherein said functions performed by said modules can be configured to operate before or after an address translation process.

80. A sequence processing apparatus, said apparatus comprising:

authentication means for performing authentication on a packet;

decryption means for receiving a portion of said authenticated packet to begin decrypting said portion of said authenticated packet prior to said authentication process being completed for the entire packet; and

checksum means for receiving a portion of said decrypted packet to start checksum on said portion of said decrypted packet prior to said decryption process being completed for the entire packet.

81. The apparatus of claim 80, further comprising:

decapsulation means for decapsulating said packet prior to said authentication process.

82. The apparatus of claim 80, further comprising:

decompression means for decompressing said decrypted packet prior to said checksum process.

83. The apparatus of claim 80, further comprising:

recirculation buffer means for holding said portion of said authenticated packet, said portion of said decrypted packet or said portion of said checksumed packet only if a next module is unable to receive said associated portion of a packet.

84. The apparatus of claim 80, wherein said functions performed by said means can be configured to operate before or after an address translation process.

85. A method for sequence processing, said method comprising the steps of:

a) providing an authentication module for performing authentication on a packet;

b) providing a decryption module for receiving a portion of said authenticated packet to begin decrypting said portion of said authenticated packet prior to said authentication process being completed for the entire packet; and

c) providing a checksum module for receiving a portion of said decrypted packet to start checksum on said portion of said decrypted packet prior to said decryption process being completed for the entire packet.

86. The method of claim 85, further comprising the step of:

d) providing a decapsulation module for decapsulating said packet prior to said authentication process.

87. The method of claim 85, further comprising the step of:

d) providing a decompression module for decompressing said decrypted packet prior to said checksum process.

88. The method of claim 85, further comprising the step of:

d) providing a recirculation buffer as a storage for holding said portion of said authenticated packet, said portion of said decrypted packet or said portion of said checksumed packet only if a next module is unable to receive said associated portion of a packet.

89. The method of claim 85, wherein said checksum module checksums said packet as an internetworking transmission protocol packet, wherein said checksum module determines a padding length in said packet, and then subtracts said padding length from said checksuming step.

90. The method of claim 85, wherein said functions performed by said modules can be configured to operate before or after an address translation process.

91. A computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform the steps comprising of:

a) providing an authentication module for performing authentication on a packet;

b) providing a decryption module for receiving a portion of said authenticated packet to begin decrypting said portion of said authenticated packet prior to said authentication process being completed for the entire packet; and

c) providing a checksum module for receiving a portion of said decrypted packet to start checksum on said portion of said decrypted packet prior to said decryption process being completed for the entire packet.

92. Method for providing a sequence processing unit, said method comprising the steps of:

a) providing a checksum module for performing checksum on a packet;

b) passing a portion of said checksumed packet to an encryption module to begin encrypting said portion of said checksumed packet prior to said checksum process being completed for the entire packet; and

c) passing a portion of said encrypted packet to an authentication module to start authenticating said portion of said encrypted packet prior to said encryption process being completed for the entire packet.

93. The method of claim 92, further comprising the step of:

d) providing an encapsulation module to encapsulate said packet after said authentication step c).

94. The method of claim 92, further comprising the step of:

b′

) providing a compression module to compress said checksumed packet prior to said encryption step b).

95. The method of claim 92, further comprising the step of:

d) providing a recirculation buffer as a storage for holding said portion of said authenticated packet, said portion of said encrypted packet or said portion of said checksumed packet only if a next module is unable to receive said associated portion of a packet.

96. The method of claim 92, wherein said functions performed by said modules are configurable.

97. The method of claim 96, wherein said functions performed by said modules can be configured to operate before or after an address translation process.

98. A sequence processing apparatus, said apparatus comprising:

a checksum module for performing checksum on a packet;

an encryption module for receiving a portion of said checksumed packet to begin encrypting said portion of said checksumed packet prior to said checksum process being completed for the entire packet; and

an authentication module for receiving a portion of said encrypted packet to start authenticating said portion of said encrypted packet prior to said encryption process being completed for the entire packet.

99. The apparatus of claim 98, further comprising:

an encapsulation module for encapsulating said packet after said authentication process.

100. The apparatus of claim 98, further comprising:

a compression module for compressing said checksumed packet prior to said encryption process.

101. The apparatus of claim 98, further comprising:

a recirculation buffer for holding said portion of said authenticated packet, said portion of said encrypted packet or said portion of said checksumed packet only if a next module is unable to receive said associated portion of a packet.

102. The apparatus of claim 98, wherein said functions performed by said modules can be configured to operate before or after an address translation process.

103. A sequence processing apparatus, said apparatus comprising:

checksum means for performing checksum on a packet;

encryption means for receiving a portion of said checksumed packet to begin encrypting said portion of said checksumed packet prior to said checksum process being completed for the entire packet; and

authentication means for receiving a portion of said encrypted packet to start authenticating said portion of said encrypted packet prior to said encryption process being completed for the entire packet.

104. The apparatus of claim 103, further comprising:

encapsulation means for encapsulating said packet after said authentication process.

105. The apparatus of claim 103, further comprising:

compression means for compressing said checksumed packet prior to said encryption process.

106. The apparatus of claim 103, further comprising:

recirculation buffer means for holding said portion of said authenticated packet, said portion of said encrypted packet or said portion of said checksumed packet only if a next module is unable to receive said associated portion of a packet.

107. The apparatus of claim 103, wherein said functions performed by said means can be configured to operate before or after an address translation process.

108. A computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform the steps comprising of:

a) providing a checksum module for performing checksum on a packet;

b) passing a portion of said checksumed packet to an encryption module to begin encrypting said portion of said checksumed packet prior to said checksum process being completed for the entire packet; and

c) passing a portion of said encrypted packet to an authentication module to start authenticating said portion of said encrypted packet prior to said encryption process being completed for the entire packet.

109. Method for providing a sequence processing subunit that is disposed with a network processing unit, said method comprising the steps of:

a) providing a random number generator that generates a plurality of entropy bits that reflect a current condition within the network processing unit; and

b) providing an authentication module for mixing said entropy bits and then employing said mixed entropy bits in a network security method to provide network security.

110. The method of claim 109, wherein said network security method is MD5.

111. The method of claim 109, wherein said network security method is Secure Hash Algorithm (SHA-1).

112. A sequence processing apparatus that is disposed with a network processing unit, said apparatus comprising:

random number generator means for generating a plurality of entropy bits that reflect a current condition within the network processing unit; and

authentication means for mixing said entropy bits and then employing said mixed entropy bits in a network security method to provide network security.

113. The apparatus of claim 112, wherein said network security method is MD5.

114. The apparatus of claim 112, wherein said network security method is Secure Hash Algorithm (SHA-1).