Abstract: Some embodiments of the invention provide a data-plane forwarding circuit (data plane) that can be configured to identify large data message flows that it processes for forwarding in a network. In this document, large data message flows are referred to as heavy hitter flows. To perform its forwarding operations, the data plane includes several data message processing stages that are configured to process the data tuples associated with the data messages received by the data plane. In some embodiments, parts of the data plane message-processing stages are also configured to implement a heavy hitter detection (HHD) circuit. The operations of the data plane's message processing stages are configured by a control plane of the data plane's forwarding element in some embodiments.

Abstract: A forwarding element includes data plane forwarding circuitry for forwarding data messages received by the forwarding element to other network elements in a network. The data-plane forwarding circuitry includes several snapshot-match circuitry units. Each snapshot-match circuitry unit compares a set of header fields of incoming data messages with a corresponding matching data. The data-plane forwarding circuitry also includes several snapshot-capture circuitry units. Each snapshot-capture circuitry units stores a set of header fields of data messages that matches a corresponding matching data.

Abstract: Some embodiments provide a method for an ingress packet processing pipeline of a network forwarding integrated circuit (IC). The ingress packet processing pipeline is for receiving packets from a port of the network forwarding IC and processing the packets to assign different packets to different queues of a traffic management unit of the network forwarding IC. The method receives state data from the traffic management unit. The method stores the state data in a stateful table. The method assigns a particular packet to a particular queue based on the state data received from the traffic management unit and stored in the stateful table.

Abstract: Some embodiments of the invention provide a network forwarding element that can be dynamically reconfigured to adjust its data message processing to stay within a desired operating temperature or power consumption range. In some embodiments, the network forwarding element includes (1) a data-plane forwarding circuit (“data plane”) to process data tuples associated with data messages received by the IC, and (2) a control-plane circuit (“control plane”) for configuring the data plane forwarding circuit. The data plane includes several data processing stages to process the data tuples. The data plane also includes an idle-signal injecting circuit that receives from the control plane configuration data that the control plane generates based on the IC's temperature. Based on the received configuration data, the idle-signal injecting circuit generates idle control signals for the data processing stages.

Abstract: A method of detecting error in a data plane of a packet forwarding element that includes a plurality of physical ternary content-addressable memories (TCAMs) is provided. The method configures a first set of physical TCAMs into a first logical TCAM. The method configures a second set of physical TCAMs into a second logical TCAM. The second logical TCAM includes the same number of physical TCAMs as the first logical TCAM. The method programs the first and second logical TCAMs to store a same set of data. The method requests a search for a particular content from the first and second logical TCAMs. The method generates an error signal when the first and second logical TCAMs do not produce a same search results.

Abstract: Some embodiments provide a method for a traffic management circuit of a data plane forwarding circuit. The traffic management circuit receives data messages from a set of ingress pipelines and provides the data messages to a set of egress pipelines. The method identifies a flow control event. The method provides metadata regarding the flow control event to a message generation circuit of the data plane forwarding circuit via a bus between the traffic management circuit and the message generation circuit.

Abstract: Some embodiments provide a data-plane forwarding circuit that can be configured to learn about a new message flow and to maintain metadata about the new message flow without first having a control plane first configure the data plane to maintain metadata about the flow. To perform its forwarding operations, the data plane includes several data message processing stages that are configured to process the data tuples associated with the data messages received by the data plane. In some embodiments, parts of the data plane message-processing stages are also configured to operate as a flow-tracking circuit that includes (1) a flow-identifying circuit to identify message flows received by the data plane, and (2) a first set of storages to store metadata about the identified flows.

Abstract: Some embodiments of the invention provide a forwarding element that has one or more data plane, message-processing pipelines with key-value processing circuits. The forwarding element's data plane key-value circuits allow the forwarding element to perform key-value services that would otherwise have to be performed by data compute nodes connected by the network fabric that includes the forwarding element. In some embodiments, the key-value (KV) services of the forwarding element and other similar forwarding elements supplement the key-value services of a distributed set of key-value servers by caching a subset of the most commonly used key-value pairs in the forwarding elements that connect the set of key-value servers with their client applications.

Abstract: Some embodiments provide a method for a hardware forwarding element that includes multiple queues. The method receives a packet at a multi-stage processing pipeline of the hardware forwarding element. The method determines, at one of the stages of the processing pipeline, to modify a setting of a particular one of the queues. The method stores an identifier for the particular queue and instructions to modify the queue setting with data passed through the processing pipeline for the packet. The stored information is subsequently used by the hardware forwarding element to modify the queue setting.

Abstract: In a method for allocating physical queues of a network forwarding element, a request is received at the network forwarding element, the network forwarding element including a plurality of physical queues, where each physical queue of the plurality of physical queues has a fixed bandwidth, the request identifying an allocation of a plurality of virtual queues at the network forwarding element. Based at least in part on the request, a configuration of the plurality of physical queues to the plurality of virtual queues is determined. The plurality of physical queues is configured according to the configuration, wherein the configuring includes allocating at least two physical queues to a virtual queue.

Abstract: Some embodiments provide a method for a forwarding element (FE) operating in a network of FEs. The method receives a data message with an access control list (ACL) rule and a first digest for the ACL rule appended to the data message. The ACL rule specifies that the packet is allowed to be sent through the network. The method verifies the ACL rule by computing a second digest from the ACL rule using a secret key and comparing the first digest to the second digest. The method determines whether the packet matches the ACL rule by comparing values in headers of the data message to values specified in the ACL rule. The method only forwards the data message if the ACL rule is verified and the packet matches the ACL rule.

Abstract: Some embodiments provide a method for a packet processing pipeline of a network forwarding integrated circuit. The method stores two copies of a stateful table used by the packet processing pipeline. The stateful table is modified according to data processed by the packet processing pipeline. Upon receiving data to write to the stateful table, the method generates (i) a first copy of the received data along with an indicator for a first one of the copies of the stateful table and (ii) a second copy of the received data along with an indicator for a second one of the copies of the stateful table. The method sends the first copy of the received data into the packet processing pipeline before sending the second copy of the received data into the packet processing pipeline.

Abstract: A synchronous packet-processing pipeline whose data paths are populated with data-plane stateful processing units (DSPUs) is provided. A DSPU is a programmable processor whose operations are synchronous with the dataflow of the packet-processing pipeline. A DSPU performs every computation with fixed latency. Each DSPU is capable of maintaining a set of states and perform its computations based on its maintained set of states. The programming of a DSPU determines how and when the DSPU updates one of its maintained states. Such programming may configure the DSPU to update the state based on its received packet data, or to change the state regardless of the received packet data.

Abstract: A method of configuring a forwarding element that includes several data plane message processing stages. The method stores a set of action codes in an instruction memory in the data plane of the forwarding element. Each action code identifies an operation to perform on a field of a message received at the data plane. The method determines action codes required to process each field of the message in each message processing stage. The method configures a data-plane processing unit of the forwarding element to concurrently perform a group of the action codes in the same data plane processing stage when (i) the action codes are the same and (ii) operate on the same field of the message.

Abstract: A method of forwarding packets by a physical network switch is provided. The method assigns egress ports that connect the network switch to each particular next hop to a weighted-cost multipathing (WCMP) group associated with the particular next hop. The method assigns weights to each egress port in each WCMP group according to the capacity of each path that connects the egress port to the next hop associated with the WCMP group and normalizes the weights over a range of values. For each packet received at the network switch, the method identifies the WCMP group associated with a next hop destination of the packet. The method calculates a hash value of a set of fields in the packet header and uses the hash value to perform a range lookup in the identified WCMP group to select an egress port for forwarding the packet to the next hop.

Abstract: Some embodiments provide a method for a hardware forwarding element. Based on a set of characteristics of a packet, the method determines to copy a packet to a particular temporary storage of a set of temporary storages of the hardware forwarding element. Based on a property of the particular temporary storage, the method stores only a particular portion of the packet in the particular temporary storage. A same size portion of each packet copied to the particular temporary storage is stored in the particular temporary storage.

Abstract: Some embodiments provide a method for configuring unit memories (e.g., unit static random access memories (SRAMs) and ternary content addressable memories (TCAMs) of a network forwarding IC to implement a set of longest prefix matching (LPM) tables. Two different methods of providing a longest prefix match (LPM) operation that minimize the use of ternary content addressable memory (TCAM) are presented. Each method takes advantage of the use of match-action stages and the programmability of the unit memories. An algorithmic LPM embodiment is presented which uses a TCAM index with pointers to SRAM partitions that store subtrees of a routing tree (routing trie structure) and performs subtree rearrangements in the partitions upon the addition of certain routing entries. A chained LPM embodiment, allocates separate exact-match tables for a set of address prefix lengths in, for example, SRAMS, as well as a set of non-exact match tables in, for example, TCAMs.

Abstract: Some embodiments provide a method for a match-action stage of a packet processing pipeline. The method receives a set of data containers storing input packet data values for a particular packet. The set of data containers includes multiple subsets of data containers. The method performs a set of match operations using a first subset of the set of data containers. The method uses a set of arithmetic logic units (ALUs) to generate output packet data values to store in a second subset of the set of data containers. Output packet data values for a third subset of the data containers are generated without the set of ALUs.

Abstract: Some embodiments provide a network forwarding element with a data-plane forwarding circuit that has a parameter collecting circuit to store and distribute parameter values computed by several machines in a network. In some embodiments, the machines perform distributed computing operations, and the parameter values that compute are parameter values associated with the distributed computing operations. The parameter collecting circuit of the data-plane forwarding circuit (data plane) in some embodiments (1) stores a set of parameter values computed and sent by a first set of machines, and (2) distributes the collected parameter values to a second set of machines once it has collected the set of parameter values from all the machines in the first set. The first and second sets of machines are the same set of machines in some embodiments, while they are different sets of machines (e.g., one set has at least one machine that is not in the other set) in other embodiments.

Abstract: Some embodiments provide a method for a particular FE in a network of FEs. The method receives a data message at a first port of the FE. The data message includes a header that specifies an egress port for each FE along a path from a source of the data message to a destination of the data message and an ingress port for at least each FE along the path that the data message has previously traversed. The method determines that the particular egress port specified for the FE is a second port that is not operational. The method generates a path failure message specifying that the second port is not operational and including a header that uses the egress ports and ingress ports in the data message. The method sends the path failure message out of the first port for delivery to the source of the data message.