Computer system and network interface with hardware based packet filtering and classification
View Patent ↗A data processing system adapted for high-speed network communications, a method for managing a network interface and a network interface for such system, are provided, in to which processing of packets received over the network is achieved by embedded logic at the network interface level. Incoming packets on the network interface are parsed and classified as they are stored in a buffer memory. Functional logic coupled to the buffer memory on the network interface is enabled to access any data field within a packet in a single cycle, using pointers and packet classification information produced by the parsing and classifying step. Results of operations on the data fields in the packets are available before the packets are transferred out of the buffer memory. A data processing system, a method for management of a network interface and a network interface are also provided by the present invention that include an embedded firewall at the network interface level of the system, which protects against inside and outside attacks on the security of data processing system. Furthermore, a data processing system, a method for management of a network interface and a network interface are a provided by the present invention that support class of service management for packets incoming from the network, by applying priority rules at the network interface level of the system.
1. A method of managing a network-to-computer interface, the method comprising:
storing a packet in transit between a host memory and a network medium in a buffer memory;
identifying, by input registers, a start of each of a plurality of data fields in the packet;
parsing, by a packet parser, the packet to generate information that allows the start of each of the plurality of data fields of the packet to be identified in the buffer memory that stores the packet;
based on outputs of the input registers and the packet parser, generating a plurality of pointers pointing to locations in the buffer memory storing data of the plurality of data fields of the packet; and
using the plurality of pointers pointing to the locations in the buffer memory to retrieve data from the plurality of data fields of the packet prior to transferring the packet out of the buffer memory.
2. The method of claim 1 wherein parsing the packet comprises determining and storing a classifier for the packet.
3. The method of claim 1 , wherein generating the plurality of pointers pointing to the locations in the buffer memory storing data of the plurality of data fields of the packet comprises using a data field in the packet having a pre-specified location in the packet to compute a given pointer of the plurality of pointers, wherein the given pointer points to a data field having a variable location in the packet.
4. The method of claim 1 wherein the plurality of data fields of the packet are variable length bit-strings.
5. The method of claim 1 , wherein generating the plurality of pointers pointing to the locations in the buffer memory comprises generating a pointer pointing to a start of the packet.
6. The method of claim 1 , wherein generating the plurality of pointers pointing to the locations in the buffer memory storing data of the plurality of data fields of the packet comprises generating a pointer pointing to an Internet Protocol header of the packet.
7. The method of claim 1 , wherein generating the plurality of pointers pointing to the locations in the buffer memory storing data of the plurality of data fields of the packet comprises generating a pointer pointing to a Transmission Control Protocol header of the packet.
8. The method of claim 1 , wherein generating the plurality of pointers pointing to the locations in the buffer memory storing data of the plurality of data fields of the packet comprises generating a pointer pointing to a data payload portion of the packet.
9. The method of claim 1 , wherein storing the packet in the buffer memory and generating the plurality of pointers pointing to the locations in the buffer memory storing the plurality of data fields of the packet occur contemporaneously.
10. The method of claim 1 , wherein using the plurality of pointers pointing to the locations in the buffer memory storing data of the plurality of data fields of the packet to retrieve data from the plurality of data fields of the packet comprises using the plurality of pointers in combination with one or more offset parameters to retrieve the data from the plurality of data fields of the packet stored in the buffer memory.
11. The method of claim 1 wherein the packet is in transit from the host memory to the network medium.
12. The method of claim 1 wherein the packet is in transit from the network medium to the host memory.
13. A system for interfacing a computer to a network, the system comprising:
a packet data buffer to store a packet in transit between a host memory and a network medium;
input registers to identify a start of each of a plurality of data fields in the packet;
a packet parser to parse the packet to generate information that allows the start of each of the plurality of data fields of the packet to be identified in the packet data buffer that stores the packet;
a packet index queue to receive outputs from the input registers and the packet parser and generate a plurality of pointers pointing to locations in the packet data buffer storing data of the plurality of data fields of the packet; and
a packet index fetch engine to retrieve data from the plurality of data fields of the packet prior to transferring the packet out of the packet data buffer by using the plurality of pointers pointing to the locations in the packet data buffer storing the data of the plurality of data fields of the packet.
14. The system of claim 13 wherein the packet parser determines and stores a classifier for the packet.
15. The system of claim 13 wherein to generate the plurality of pointers pointing to the locations in the packet data buffer storing data the plurality of data fields of the packet, the packet index queue is to use a data field in the packet having a pre-specified location in the packet to compute a given pointer of the plurality of pointers, wherein the given pointer points to a data field having a variable location in the packet.
16. The system of claim 13 wherein the plurality of data fields of the packet are variable length bit-strings.
17. The system of claim 13 , wherein the plurality of pointers comprises a pointer pointing to a location in the packet data buffer storing a start of the packet.
18. The system of claim 13 , wherein the plurality of pointers comprises a pointer pointing to a location in the packet data buffer storing data of an Internet Protocol header of the packet.
19. The system of claim 13 , wherein the plurality of pointers comprises a pointer pointing to a location in the packet data buffer storing data of an Transmission Control Protocol header of the packet.
20. The system of claim 13 , wherein the plurality of pointers comprises a pointer pointing to a location in the packet data buffer storing data of a data payload portion of the packet.
21. The system of claim 13 wherein the packet parser generates the plurality of pointers contemporaneously with the packet being stored into the packet data buffer.
22. The system of claim 13 , wherein to use the plurality of pointers pointing to the locations in the packet data buffer storing the plurality of data fields of the packet to retrieve data from the plurality of data fields of the packet, the packet index fetch engine is to use the plurality of pointers in combination with one or more offset parameters to retrieve data from the plurality of data fields of the packet stored in the packet data buffer.
23. The system of claim 13 wherein the packet is in transit from the host memory to the network medium.
24. The system of claim 13 wherein the packet is in transit from the network medium to the host memory.
25. The system of claim 13 wherein the packet data buffer comprises:
a transmit packet buffer to store packets in transit from the host memory to the network medium; and
a receive packet buffer to store packets in transit from the network medium to the host memory.
26. A non-transitory computer readable medium storing instructions that when executed by a processor cause the processor to:
store a packet in transit between a host memory and a network medium in a buffer memory;
identify a start of each of a plurality of data fields in the packet;
parse the packet to generate information that allows the start of each of the plurality of data fields of the packet to be identified in the buffer memory that stores the packet;
generate a plurality of pointers pointing to locations in the buffer memory storing data of the plurality of data fields of the packet; and
use the plurality of pointers pointing to the locations in the buffer memory to retrieve data from the plurality of data fields of the packet prior to transferring the packet out of the buffer memory.