Direct access to low-latency memory

A content aware application processing system is provided for allowing directed access to data stored in a non-cache memory thereby bypassing cache coherent memory. The processor includes a system interface to cache coherent memory and a low latency memory interface to a non-cache coherent memory. The system interface directs memory access for ordinary load/store instructions executed by the processor to the cache coherent memory. The low latency memory interface directs memory access for non-ordinary load/store instructions executed by the processor to the non-cache memory, thereby bypassing the cache coherent memory. The non-ordinary load/store instruction can be a coprocessor instruction. The memory can be a low-latency type memory. The processor can include a plurality of processor cores.

BACKGROUND OF THE INVENTION

The Open Systems Interconnection (OSI) Reference Model defines seven network protocol layers (L1-L7) used to communicate over a transmission medium. The upper layers (L4-L7) represent end-to-end communications and the lower layers (L1-L3) represent local communications.

Networking application aware systems need to process, filter and switch a range of L3 to L7 network protocol layers, for example, L7 network protocol layers such as, HyperText Transfer Protocol (HTTP) and Simple Mail Transfer Protocol (SMTP), and L4 network protocol layers such as Transmission Control Protocol (TCP). In addition to processing the network protocol layers, the networking application aware systems need to simultaneously secure these protocols with access and content based security through L4-L7 network protocol layers including Firewall, Virtual Private Network (VPN), Secure Sockets Layer (SSL), Intrusion Detection System (IDS), Internet Protocol Security (IPSec), Anti-Virus (AV) and Anti-Spam functionality at wire-speed.

Network processors are available for high-throughput L2 and L3 network protocol processing, that is, performing packet processing to forward packets at wire-speed. Typically, a general purpose processor is used to process L4-L7 network protocols that require more intelligent processing. For example, the Transmission Control Protocol (TCP)—an L4 network protocol requires several compute intensive tasks including computing a checksum over the entire payload in the packet, management of TCP segment buffers, and maintaining multiple timers at all times on a per connection basis. Although a general purpose processor can perform the compute intensive tasks, it does not provide sufficient performance to process the data so that it can be forwarded at wire-speed.

Furthermore, content aware applications that examine the content of packets require searching for expressions, which contain both fixed strings and character classes repeated a variable number of times, in a data stream. Several search algorithms are used to perform this task in software. One such algorithm is the Deterministic Finite Automata (DFA). There are limitations when using the DFA search algorithm, such as, exponential growth of graph size and false matches in a data stream with repeated patterns.

Due to these limitations, content processing applications require a significant amount of post processing of the results generated by pattern search. Post processing requires qualifying the matched pattern with other connection state information such as type of connection, and certain values in a protocol header included in the packet. It also requires certain other types of compute intensive qualifications, for example, a pattern match is valid only if it is within a certain position range within data stream, or if it is followed by another pattern and within certain range from the previous pattern or after/at a specific offset from the previous pattern. For example, regular expression matching combines different operators and single characters allowing complex expressions to be constructed.

SUMMARY OF THE INVENTION

The present invention is directed to increasing the speed at which a processor can perform content processing applications. The processor includes a system interface to cache coherent memory and a low latency memory interface to a non-cache coherent memory. The system interface directs memory access for ordinary load/store instructions executed by the processor to the cache coherent memory. The low latency memory interface directs memory access for non-ordinary load/store instructions executed by the processor to the non-cache memory, thereby bypassing the cache coherent memory. The non-ordinary load/store instruction can be a coprocessor instruction. The memory can be a low-latency type memory. The processor can include a plurality of processor cores.

In one embodiment, the low latency interface can be a bus coupling the processor to the non-cached memory, the coupling allowing direct access between the processor and the non-cached memory. In another embodiment, data can be stored in a deterministic finite automata (DFA) graph in the memory for performing the content aware application processing.

In another embodiment, the processor can include a plurality of registers for moving the data between the processor core and the memory. The plurality of registers can be located within the processor. The plurality of registers located within the processor can be separate from a main register file located within the processor.

In another embodiment, the low-latency memory can be selected from a group consisting of dynamic random access memory (DRAM), reduced latency dynamic random access memory (RLDRAM), static random access memory (SRAM), and fast cycle random access memory (FCRAM), wherein the processor accesses the RLDRAM with less than or equal to 30 nanosecond latency.

A network services processor integrates network, security and content processing according to the principles of the present invention. The network services processor includes built-in hardware acceleration for content and security processing, along with on-chip co-processor modules for Internet Services acceleration.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1Ais a block diagram of a security appliance100including a network services processor110according to the principals of the present invention. The security appliance100is a standalone system that can switch packets received at one Ethernet port (Gig E) to another Ethernet port (Gig E) and perform a plurality of security functions on received packets prior to forwarding the packets. For example, the security appliance100can be used to perform security processing on packets received on a Wide Area Network prior to forwarding the processed packets to a Local Area Network.

The network services processor110includes hardware packet processing, buffering, work scheduling, ordering, synchronization, and cache coherence support to accelerate all packet processing tasks. The network services processor110processes Open System Interconnection network L2-L7 layer protocols encapsulated in received packets.

The network services processor110receives packets from the Ethernet ports (Gig E) through physical interfaces PHY104a,104b, performs L7-L2 network protocol processing on the received packets and forwards processed packets through the physical interfaces104a,104bor through a PCI bus106. The network protocol processing can include processing of network security protocols such as Firewall, Application Firewall, Virtual Private Network (VPN) including IP Security (IPSEC) and/or Secure Sockets Layer (SSL), Intrusion detection System (IDS) and Anti-virus (AV).

A Dynamic Random Access Memory (DRAM) controller in the network services processor110controls access to an external DRAM108that is coupled to the network services processor110. The DRAM108is external to the network services processor110. The DRAM108stores data packets received from the PHYs interfaces104a,104bor the Peripheral Component Interconnect Extended (PCI-X) interface106for processing by the network services processor110.

A low-latency memory controller in the network services processor110controls low-latency memory (LLM)118. The LLM118can be used for Internet Services and Security applications allowing fast lookups, including regular expression matching that may be required for Intrusion Detection System (IDS) or Anti Virus (AV) applications.

Regular expressions are a common way to express string matching patterns. The atomic elements of a regular expression are the single characters to be matched. These are combined with meta-character operators that allow a user to express concatenation, alternation, Kleene-star, etc. Concatenation is used to create multiple character matching patterns from a single charters (or sub-strings) while alternation (|) is used to create patterns that can match any of two or more sub-strings. Kleene-star (*) allows a pattern to match zero (0) or more occurrences of the pattern in a string. Combining different operators and single characters allows complex expressions to be constructed. For example, the expression (th(is|at)*) will match th, this, that, thisis, thisat, thatis, thatat, etc.

FIG. 1Bis a block diagram of the network services processor110shown inFIG. 1A. The network services processor110delivers high application performance using at least one processor core120as described in conjunction withFIG. 1A.

A packet is received for processing by any one of the GMX/SPX units122a,122bthrough an SPI-4.2 or RGM II interface. A packet can also be received by a PCI interface124. The GMX/SPX unit (122a,122b) performs pre-processing of the received packet by checking various fields in the L2 network protocol header included in the received packet and then forwards the packet to a packet input unit126.

The packet input unit126performs further pre-processing of network protocol headers (L3 and L4) included in the received packet. The pre-processing includes checksum checks for Transmission Control Protocol (TCP)/User Datagram Protocol (UDP) (L3 network protocols).

A Free Pool Allocator (FPA)128maintains pools of pointers to free memory in level 2 cache memory130and DRAM108. The input packet processing unit126uses one of the pools of pointers to store received packet data in level 2 cache memory130or DRAM108and another pool of pointers to allocate work queue entries for the processor cores120.

The packet input unit126then writes packet data into buffers in Level 2 cache130or DRAM108in a format that is convenient to higher-layer software executed in at least one processor core120for further processing of higher level network protocols.

The network services processor110also includes application specific co-processors that offload the processor cores120so that the network services processor achieves high-throughput. The compression/decompression co-processor132is dedicated to performing compression and decompression of received packets. In one embodiment, a deterministic finite automata (DFA) module (not shown) may include dedicated DFA engines to accelerate pattern and signature match necessary for anti-virus (AV), Intrusion Detection Systems (IDS) and other content processing applications at up to 4 Gbps.

An I/O Interface (IOI)136manages the overall protocol and arbitration and provides coherent I/O partitioning. The IOI136includes an I/O Bridge (IOB)138and a Fetch and Add Unit (FAU)140. Registers in the FAU140are used to maintain lengths of the output queues that are used for forwarding processed packets through the packet output unit126. The IOB138includes buffer queues for storing information to be transferred between an I/O Bus142, a coherent memory bus144, the packet input unit126and the packet output unit146.

A Packet order/work (POW) module148queues and schedules work for the processor cores120. Work is queued by adding a work queue entry to a queue. For example, a work queue entry is added by the packet input unit126for each packet arrival. A timer unit150is used to schedule work for the processor cores.

Processor cores120request work from the POW module148. The POW module148selects (i.e. schedules) work for a processor core120and returns a pointer to the work queue entry that describes the work to the processor core120.

The processor core120includes instruction cache152, level 1 (L1) data cache154and crypto acceleration156. In one embodiment, the network services processor100(FIG. 1A) includes sixteen superscalar RISC (Reduced Instruction Set Computer)-type processor cores120. In one embodiment, each superscalar RISC-type processor core120is an extension of the MIPS64 version 2 processor core.

Level 2 (L2) cache memory130and DRAM108is shared by all of the processor cores120and I/O co-processor devices. Each processor core120is coupled to the Level 2 cache memory130by the coherent memory bus144. The coherent memory bus144is a communication channel for all memory and I/O transactions between the processor cores100, the IOI136and the L2 cache memory130and a L2 cache memory controller131. In one embodiment, the coherent memory bus144is scalable to16processor cores120, supports fully coherent L1 data caches154with write through, is highly buffered and can prioritize I/O.

The L2 cache memory controller131maintains memory reference coherence. It returns the latest copy of a block for every fill request, whether the block is stored in L2 cache memory130, in DRAM108or is in-flight. It also stores a duplicate copy of the tags for the data cache154in each processor core120. It compares the addresses of cache block store requests against the data cache tags, and invalidates (both copies) a data cache tag for a processor core120whenever a store instruction is from another processor core or from an I/O component via the IOI136.

A DRAM controller133supports up to 16 Mbytes of DRAM. The DRAM controller133supports a 64-bit or 128-bit interface to DRAM108. The DRAM controller133supports DDR-I (Double Data Rate) and DDR-II protocols.

After the packet has been processed by the processor cores120, the packet output unit (PKO)146reads the packet data from memory, performs L4 network protocol post-processing (e.g., generates a TCP/UDP checksum), forwards the packet through the GMX/SPC unit122a,122band frees the L2 cache130/DRAM108used by the packet.

A low-latency memory controller160manages in-flight transactions (loads/stores) to/from the LLM118. The low-latency memory (LLM)118is shared by all of the processor cores120. The LLM118can be dynamic random access memory-(DRAM), reduced latency dynamic random access memory (RLDRAM), synchronous random access memory (SRAM), fast cycle random access memory (FCRAM) or any other type of low-latency memory known in the art. The RLDRAM provides 30 nanosecond memory latency or better; that is, the time taken to satisfy a memory request initiated by the processor120. Each processor core120is directly coupled to the LLM controller160by a low-latency memory bus158. The low-latency memory bus158is a communication channel for content aware application processing between the processor cores120and the LLM controller160. The LLM controller160is coupled between the processor cores120and the LLM118for controlling access to the LLM118.

Content aware application processing utilizes patterns/expressions (data) stored in the LLM118. The patterns/expressions may be in the form of a deterministic finite automata (DFA). The DFA is a state machine. The input to the DFA state machine is a string of (8-bit) bytes (i.e. the alphabet for the DFA is a byte.). Each input byte causes the state machine to transition from one state to the next. The states and the transition function can be represented by a graph200as illustrated inFIG. 2A, where each graph node (210a. . .210c) is a state and different graph arcs (220a. . .220d) represent state transitions for different input bytes. The states may contain certain characters related to the state, such as “A . . . Z, a . . . z, 0 . . . 9,” etc. The current state of the state machine is a node identifier that selects a particular graph node. For instance, assume that the input contains the text “Richard”. From the initial State1(210a), the DFA moves to State2(210b) where the “R” is read. For the next five characters, “i”, “c”, “h”, “a”, “r”, “d”, the DFA continues to loop (220b) to State2.

FIG. 3is a block diagram of a Reduced Instruction Set Computing (RISC) processor120according to the principles of the present invention. The processor120includes an Integer Execution Unit302, an Instruction Dispatch Unit304, an Instruction Fetch Unit306, a Memory Management Unit (MMU)308, a System Interface310, a Low-Latency Interface350, a Load/Store unit314, a Write Buffer316, and Security Accelerators156. The processor core120also includes an EJTAG Interface330allowing debug operations to be performed. The system interface310controls access to external memory, that is, memory external to the processor120such as, external (L2) cache memory130or primary/main memory108.

The Integer Execution unit302includes a multiply unit326, at least one register file (main register file)328, and two holding registers330a,330b. The holding registers330a,330bare used to store data to be written to the LLM118and data that has been read from the LLM118using LLM load/store instructions according to the principles of the present invention. The holding registers330a,330bimprove the efficiency of the instruction pipeline by allowing two outstanding loads prior to stalling the pipeline. Although two holding registers are shown, one or multiple holding registers may be used. The multiply unit326has a 64-bit register-direct multiply. The Instruction fetch unit306includes instruction cache (ICache)152. The load/store unit314includes a data cache154. In one embodiment, the instruction cache152is 32K bytes, the data cache154is 8K bytes and the write buffer316is 2K bytes. The Memory Management Unit308includes a Translation Lookaside Buffer (TLB)340.

In one embodiment, the processor120includes a crypto acceleration module (security accelerators)156that include cryptography acceleration for Triple Data Encryption standard (3DES), Advanced Encryption Standard (AES), Secure Hash Algorithm (SHA-1), Message Digest Algorithm #5 (MD5). The crypto acceleration module156communicates by moves to and from the main register file328in the Execution unit302. RSA and the Diffie-Hellman (DH) algorithm are performed in the multiplier unit326.

FIG. 4illustrates a LLM load/store instruction format410that a core120uses to reference the LLM118. These load/store instructions differ from the ordinary load store instructions in a typical general purpose instruction set that load/store data between the main register file328and the cache coherent memory system that includes L1 data cache154, L2 cache memory130, and DRAM108(FIG. 3). In contrast, these new instructions initiate either 64-bit or 36-bit loads/stores directly from/to LLC118(FIG. 3) to a core120. These instructions allow data to be retrieved/stored in LLM memory118faster than through the cache coherent memory system. This path provided through the LLM load/store instructions to low latency memory118improves the performance of applications that do not require caching, such as regular expression matching. These load/store instructions are “DMTC2” (double move to co-processor 2) and “DMFC2” (double move from co-processor 2).

Referring toFIG. 4, the COP2 field412indicates that the instruction is a co-processor instruction (i.e., not a general purpose instruction). The DMT/DMF field414stores the operation code (i.e., indicates the instruction type). The instruction type DMT indicates that data is being moved from low latency memory118to a holding register (330a,330b). The instruction type DMF indicates that data is being moved from a holding register (330a,330b) to a register in the main register file load. In one embodiment, the low latency memory118is 36-bits wide and each DMT/DMF instruction allows 36-bits to be moved. The rt field416identifies a register in the main register file. The impl field418in conjunction with the operation code identifies the type of coprocessor move instruction and identifies the holding register330a,330b.

To load (DMF) the contents of a holding register to a register in the main register file338, the rt field identifies the register in the register file to which the data stored in the holding register is stored. For example:GPR[rt]=LLM_DATA0<63:0>, whereLMM_DATA0is holding register330a; andGPR is the general purpose register.

For a write (DMT) instruction, the rt field (416) identifies the register in the register file that stores the address of location in low latency memory118. For example:LLM_DATA0<63:0>=llmemory[rt], whereLLM_DATA0is holding register330a; andllmemory is low latency memory.

For example the following low latency memory load instruction (DMTC2) can be used to load the holding register330awith contents of a low-latency memory location instruction, such as:DMTC2, $5, 0×0400DMT is the instruction type, i.e. load holding register with data from low latency memory (414);C2 (COP2) indicates a coprocessor instruction (412);Register #5 in the main register file328(FIG. 3) holds the low-latency memory address location; and0×0400 identifies the holding register330(FIG. 3) (418) (This value is constant and can be a different value in another embodiment).

Similarly, a low latency memory store instruction can be used to move data from the holding register330(FIG. 3) into the main register file328(FIG. 3). For example, the following low latency memory store instruction can be used:DMFC2, $6, 0×0402DMF is the instruction type, i.e. store contents of holding register in register $6 in the main register file328(414);C2 (COP2) indicates a coprocessor instruction (412);Register #6 in the main register file328is the destination register (rt) (416); and0×0402 identifies the holding register330(FIG. 3) (418) (This value is constant and can be a different value in another embodiment).
The instruction format shown above is by way of example and it should be understood by one skilled in the art the instruction format can be any format which allows non-ordinary loads/store instructions.

FIG. 5shows an example of the use of a non-ordinary load instruction to load data into a register in the register file from an LLM memory location according to the present invention. To load the contents of the LLM address location into register 6 ($6) in the main register file328using a non-ordinary load instruction, the following instruction sequence is used:DMTC2 $5, C1 (C1 is a constant value, such as 0×0400);DMFC2 $6, C2 (C2 is a constant value, such as 0×0402).

The address (location) in low latency memory118from which to load data is first stored in register 5 ($5) in the main register file328. The “DMTC2 $5, 0×0400” instruction reads the data from the location in LLM118identified by the address stored in register 5 into holding register330a. Then, the “DMFC2 $6, 0×0402” instruction loads the data stored in holding register330ainto $6 in the main register file328. These instructions effectively bypass all caches using the LLM Bus158.

Holding register330bcan be used instead of holding register330aby changing the values of C1, C2. For example, C1=0×0408 can be changed to C2=0×040a.