Method and apparatus for processing network frames in a network processor by embedding network control information such as routing and filtering information in each received frame

[0002] 1. Technical Field

[0003] The present invention relates in general to computer networks, and in particular, to a network processor for managing network traffic that uses an internal frame format containing layer specific control information.

[0004] 2. Description of the Related Art

[0005] Computer networks have evolved to a point where switch routers are insufficient to handle complex network routing and filtering requirements. Network processors, such as the International Business Machines (IBM) Network Processor (NP) have been developed to fill this need. Utilizing a connection similar to that of a network switch, an NP provides a level of control and flexibility that surpasses that of the network switch. Parallel lookup operations can be performed on a frame, complex modifications can be performed on packets, and policies can be managed at complex levels. Multiple processors are used to achieve a very high frame processing throughput.

[0006] Instructions for managing frame routing in an NP, known as “picocode,” reside in memory but are directly used by the hardware to efficiently process frames according to a fixed set of rules. The rules are entered by administration software and compiled into picocode that drives the logical engines for controlling frame routing, frame filtering and Quality of Service (QoS) requests.

[0007] The NP also provides media interfaces for connecting standard network interfaces and routing media interface frames between ports and between the media interfaces and a switch fabric. Frames received by the network processor may be of varying types. The network processor forwards L2, L3 and L4 frames. These labels are according to the Open Systems Interconnect Reference Model, developed by the International Standards Organization (ISO), wherein L2 refers to a data link layer such as Ethernet, L3 is the network layer such as Internet Protocol (IP), and L4 to a transport layer such as User Datagram Protcol (UDP) or Transmission Control Protocol (TCP).

[0008] The present disclosure provides an improved method for processing frames by embedding layer-specific control information within frames routed within the NP, so that processing may be simplified, producing a resulting increase in performance.

[0009] The objective of processing frames by embedding layer-specific control information within frames routed within a NP is achieved in a method and system for processing frames in an NP. The NP receives a frame at an input, determines a layer type of the frame and embeds appropriate control information within a modified frame. The frame is then routed to an appropriate layer processing component within the network processing system. The frames may be discarded by a layer based on filtering criteria. Layers may also be bypassed if a layer determines that one or more layer processors will not be performing processing on the frame.

[0010] All objects, features, and advantages of the present invention will become apparent in the following detailed written description.

[0011] The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself however, as well as a preferred mode of use, further objects and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:

[0012] FIG. 1 is a block diagram of a network processor managed network subsystem in accordance with an embodiment of the present invention;

[0013] FIG. 2 is a simplified block diagram depicting frame flow within a network processor in accordance with an embodiment of the present invention;

[0014] FIG. 3 is a detailed block diagram depicting a network processor in accordance with an embodiment of the present invention;

[0015] FIG. 4 is a pictorial diagram depicting dataflow within a network processing subsystem in accordance with an embodiment of the present invention;

[0016] FIG. 5 is a pictorial diagram depicting a modified frame in accordance with an embodiment of the invention; and

[0017] FIG. 6 is flowchart depicting a method for processing frames within a network processor managed network subsystem, in accordance with an embodiment of the present invention.

[0018] With reference to the figures, and in particular to FIG. 1, a network processing system in accordance with an embodiment of the present invention is depicted. A packet routing switch 12 is coupled to a group of network processors (NPs) 14A-14C. Each of NPs 14A-14C provides a media interface for connecting to networks having various protocols, such as 10 base-T or 100 base-T ethernet connections 16A-16E or other types of communication interfaces that are known in the art. Thus, NP 14A may route frames received at any of the media interfaces to port 0 on packet routing switch 12, and may perform address translations, respond to Quality-of-Service (QoS) requests, block packets, or perform any complex routing or frame processing function on the incoming frames. NP 14A via an Egress interface also receives frames from port 0 on packet routing switch 12 and may perform similar complex operations to route frames to the media interfaces. Control memory 15 provides storage for control software that drives the routing functionality and frame processing, and specifically the software managed tree (SMT) dynamic classifier of the present invention. A Lookup ZBT SRAM 17 provides fast access memory for storing the fixed match tree (FMT) hardware assisted matching of the present invention. A Control point (CP) central processing unit 11 provides management of network processor operations and downloading of applications, classifier trees and other data.

[0019] Referring now to FIG. 2, a simplified block diagram of NP 14A is shown. An Ingress Enqueue/Dequeue/Scheduling logic (EDS) 27 manages frame buffering and control for frames routed to a switch fabric 22. Frames are received from the media interface connections by ingress physical MAC (Medium Access Control) multiplexer (PMM) 28, and are translated and processed by protocol processors 25. An ingress switch interface 23, provides a connection to switch fabric 22 and may connect to another NP or packet routing switch 12 (From FIG. 1). An egress switch interface 24 receives frame data from switch fabric 22 and the frame data is stored in an egress data storage 31. Protocol processors then can perform layer specific processing to process the frames and route them through an egress PMM 29. It is the method of processing frames through ingress PMM 28 and egress PMM 29 which the present invention concerns. Typically, frame processing has been performed by a separate processor for each layer. Bridges (providing L3 230, processing) and routers (providing L2 processing) are separate devices. The classifiers perform L4 processing, adding a third layer to the model. By using a special format for frames within the network processor, the picocode can quickly determine what type of frame is stored on a queue and perform the appropriate bridging or routing functions, including multicast transmission.

[0020] Referring now to FIG. 3, a network processor unit 40 in accordance with a preferred embodiment of the invention is depicted. Memories 43 for storing frame data, classifier trees and applications data and instructions are coupled to the NP by control store arbiter 42, allowing core processing units 46 to share access to external and internal memory. Each core processing unit 46 contains dyadic protocol processing units (DPPU) 44A-44B and a tree search engine 45. Tree search engine 45 performs L4 processing on frames entering the network processor, if L4 processing is required. An instruction memory 47 is coupled to the core processing unit 46 for storing the picocode that drives the tree search engines 45 (TSEs). Power PC® core 41, provides management of the network processor unit 40.

[0021] Software managed tree data and fixed match tree data may be downloaded into memories 43 provide control for TSEs 45 once a leaf in the tree is matched, it is loaded into internal registers in the network processor unit 40. The trees used with TSEs are referred to as static or dynamic trees. Dynamic trees are so called because they may be updated incrementally and quickly to produce. changes in the processing of frames. Static trees are not incrementally upgraded and require a reload of the tree each time the tree is modified. Static trees are useful for providing more complex matching such as applying a leaf to a range of IP addresses. Hardware classifier 48 pre-processes received frames to prepare for matching.

[0022] Referring now to FIG. 4, an illustration of frame processing flow in NP 14A is depicted. A VLAN processing block 50 receives frames incoming from ingress PMM 28 and classifies them according to a configured or learned VLAN policy. An input media control filter 51 receives frames from the VLAN processing block 50 and applies policy filters on incoming frames according to a filter look-up and discards or allows frames that match the filters attributes. A destination-address lookup 52 receives frames from the media control filter 51 and determines if the L2 frame has a registered L3 address or has a multicast characteristic having an L3 registration, and if it does, the frame is passed to a layer 3 ingress processor 53. The layer 3 ingress processor 53 has a routing table that also contains a special identifier that can determine if L4 processing is required. If L4 processing is required based on an entry found in the routing table, the frame is routed to a layer 4 processing block 54. If destination-address lookup 52 did not find a registration for the frame MAC address, then if the L2 address is known (i.e. a bridging address for which the NP has a connection) then the L2 frame is routed to the output media control filter 55. The output control filter 55 may be located on the ingress NP as shown in FIG. 4, or located on the egress NP.

[0023] Those skilled in the art will recognize that this is an implementation choice based on the policy attributes being global or NP specific for output filters. The output media control filter 55 applies policy filters on outgoing frames according to a filter look-up and discards or allows frames that match the filters attributes. Frames that are allowed to pass the output media control filter attributes are routed to a L2 learning component 61. The L2 learning component 61 verifies that the source address of the frame is known. If the source address of the frame is not known the address is learned. The L2 learning component 61 then routes the frame to the filter mask builder where the list of target output ports is built for this frame. The filter mask builder 62 routes the frame to the L2 output interface 67. The L2 output interface forwards the frame from each interface specified by the output of the filter mask builder 62 with the appropriate VLAN description obtained from the VLAN control block 68. If the L2 frame is a multicast frame or has an unknown address, it is routed to the multicast processor 60.

[0024] Frame output from layer 3 ingress 53 and layer 4 processing 54 are routed to the multicast processor 60 if they have a multicast characteristic. Otherwise they are routed to the appropriate egress processors L4 egress 63 or L3 egress 64, depending on the frame type. If the multicast table reference shows a multicast destination on a local address (a VLAN served by L2 out 67), then an L2 output frame is passed to L2 learning component 61. The multicast processor is capable of handling multicast frames that are of types L2, L3 or L4. Unicast frames are passed from L3 egress 64 to an encapsulation processor 65 which builds the media frames and passes them to filter mask builder 62 for output through the L2 out 67 processing block.

[0025] The above-described flow model is made possible by the encapsulation of layer type information and other information for routing the frame in a modified packet format. For example, bytes may be added in a specific location in the modified frame to specify the layer type and other information needed to properly route the frame, such as a bridge address for L2 frames.

[0026] Referring now to FIG. 5, a modified frame is depicted in accordance with an embodiment of the invention. Header 80 is prefixed to frame data 81 in order to provide quick look up of frame charateristics, including layer type information. Frame type info 82 indicates whether the frame is multicast or unicast and provides the appropriate identifiers. Call point 83 indicates the application entry for processing the particular frame, including an associated target NP. Call point data 84 is information associated with the frame that the application procedure requires. Tag 85 may contain address information such as the source NP port and the source NP identifier. This modified frame format allows the various layer processors to operate on the frame header in order to accomplish routing and filtering.

[0027] Referring now to FIG. 6, a method for processing frames in accordance with a preferred embodiment of the invention is depicted in a flowchart. A frame is received at the input an input of the NP (step 70) and a modified frame is created that contains layer information 71. If one or more layers may be bypassed (decision 72) then the frame is routed to the first non-bypassed layer (step 74), otherwise the frame is routed to the layer processor matching the frame layer (step 73).

[0028] While the invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.