Abstract: A computer system that supports virtualization may maintain multiple address spaces. Each guest operating system employs guest virtual addresses (GVAs), which are translated to guest physical addresses (GPAs). A hypervisor, which manages one or more guest operating systems, translates GPAs to root physical addresses (RPAs). A merged translation lookaside buffer (MTLB) caches translations between the multiple addressing domains, enabling faster address translation and memory access. The MTLB can be logically addressable as multiple different caches, and can be reconfigured to allot different spaces to each logical cache.

Abstract: Embodiments of the apparatus for modifying packet headers relate to a use of bit vectors to allow expansion and collapse of protocol headers within packets for enabling flexible modification. A rewrite engine expands each protocol header into a generic format and applies various commands to modify the generalized protocol header. The rewrite engine maintains a bit vector for the generalized protocol header with each bit in the bit vector representing a byte of the generalized protocol header. A bit marked as 0 in the bit vector corresponds to an invalid byte, while a bit marked as 1 in the bit vector corresponds to a valid byte. The rewrite engine uses the bit vector to remove all the invalid bytes after all commands have been operated on the generalized protocol header to thereby form a new protocol header.

Abstract: Embodiments of the apparatus of identifying internal destinations of network packets relate to a network chip that allows flexibility in handling packets. The handling of packets can be a function of what the packet contents are or where the packets are from. The handling of packets can also be a function of both what the packet contents are and where the packets are from. In some embodiments, where the packets are from refers to unique port numbers of chip ports that the packets arrived at. The packets can be distributed for processing within the network chip.

Abstract: Embodiments of the present invention relate to multiple parallel lookups using a pool of shared memories by proper configuration of interconnection networks. The number of shared memories reserved for each lookup is reconfigurable based on the memory capacity needed by that lookup. The shared memories are grouped into homogeneous tiles. Each lookup is allocated a set of tiles based on the memory capacity needed by that lookup. The tiles allocated for each lookup do not overlap with other lookups such that all lookups can be performed in parallel without collision. Each lookup is reconfigurable to be either hash-based or direct-access. The interconnection networks are programmed based on how the tiles are allocated for each lookup.

Abstract: A network processor includes a cache and a several groups of processors for accessing the cache. A memory interconnect provides for connecting the processors to the cache via a plurality of memory buses. A number of trace buffers are also connected to the bus and operate to store information regarding commands and data transmitted across the bus. The trace buffers share a common address space, thereby enabling access to the trace buffers as a single entity.

Abstract: A packet processing system having a control path memory of a control path subsystem and a datapath memory of a datapath subsystem. The datapath subsystem stores packet data of incoming packets and the control path subsystem performs matches of a subset of packet data, or a hash of the packet data, against the contents of a the control path memory in order to process the packets. The packet processing system enabling a portion of the datapath memory to be used by the control subsystem if needed or a portion of the control path memory to be used by the datapath subsystem if needed.

Abstract: A packet processor provides for rule matching of packets in a network architecture. The packet processor includes a lookup cluster complex having a number of lookup engines and respective on-chip memory units. The on-chip memory stores rules for matching against packet data. Each of the lookup engines receives a key request associated with a packet and determines a subset of the rules to match against the packet data. A work product may be migrated between lookup engines to complete the rule matching process. As a result of the rule matching, the lookup engine returns a response message indicating whether a match is found.

Abstract: A controller includes first and second functional units, first and second clock-signal sources that provide corresponding first and second clock signals that drive the first and second functional units respectively. The second clock-signal generates its second clock-signal based on the first clock-signal. The clock-retardation unit dynamically causes the second clock-signal to have a target time-domain offset relative to the first clock-signal.

Abstract: An apparatus for controlling memory includes a memory controller, and a data interface that interfaces with and is in data communication with data lines, each having inherent skew. Each data line carries a data signal. The data lines connect the memory controller to the memory. The apparatus also includes data de-skewers, each associated with a corresponding data line, a strobe interface that interfaces with a strobe line that connects the memory controller to the memory and that applies a timing signal to the strobe line, and a strobe de-skewer connected to the strobe line. Each data de-skewer operates in read or write mode. A particular data line's data de-skewer applies a compensation skew to a data signal carried by that line.

Abstract: A parser engine programming tool configured to receive an input file representing a directly connected cyclical graph or tree of decision points for parsing a range of incoming packet headers, automatically generate all possible paths within the graph and thereby the associated possible headers, and convert the determined paths/headers into a proper format for programming memory of a parser engine to parse the determined headers (represented by the paths).

Abstract: A packet processing system having each of a plurality of hierarchical clients and a packet memory arbiter serially communicatively coupled together via a plurality of primary interfaces thereby forming a unidirectional client chain. This chain is then able to be utilized by all of the hierarchical clients to write the packet data to or read the packet data from the packet memory.

Abstract: A method, and corresponding apparatus and system are provided for optimizing matching at least one regular expression pattern in an input stream by walking at least one finite automaton in a speculative manner. The speculative manner may include iteratively walking at least two nodes of a given finite automaton, of the at least one finite automaton, in parallel, with a segment, at a current offset within a payload, of a packet in the input stream, based on positively matching the segment at a given node of the at least two nodes walked in parallel, the current offset being updated to a next offset per iteration.

Abstract: An apparatus for data processing includes first and second functional units driven by corresponding first and second clock-signal sources, and a clock-retardation unit. The clock-retardation unit is configured to cause the second clock-signal to sustain a temporal offset that causes an offset between the first and second clock-signals to step toward a target time-domain offset between the first and second clock-signals.

Abstract: Authenticated hardware and authenticated software are cryptographically associated using symmetric and asymmetric cryptography. Cryptographically binding the hardware and software ensures that original equipment manufacturer (OEM) hardware will only run OEM software. Cryptographically binding the hardware and software protects the OEM binary code so it will only run on the OEM hardware and cannot be replicated or altered to operate on unauthorized hardware. In one embodiment, critical security information associated with the equipment is loaded from a memory at startup time. The critical security information is stored in the memory, in encrypted form, using a unique secret value. The secret value is used to retrieve a chip encryption key and one or more image authentication keys that can be used to associate program code with an original equipment manufacturer. These keys are used to authenticate the program code.

Abstract: In one embodiment, a system includes a packet reception unit. The packet reception unit is configured to receive a packet, create a header indicating scheduling of the packet in a plurality of cores and concatenate the header and the packet. The header is based on the content of the packet. In one embodiment, a system includes a transmit silo configured to store a multiple fragments of a packet, the fragments having been sent to a destination and the transmit silo having not received an acknowledgement of receipt of the fragments from the destination. The system further includes a restriction verifier coupled with the transmit silo. The restriction verifier is configured to receive the fragments and determine whether the fragments can be sent and stored in the transmit silo.

Abstract: A packet classification system, methods, and corresponding apparatus are provided for enabling packet classification. A processor of a security appliance coupled to a network uses a classifier table having a plurality of rules, the plurality of rules having at least one field, to build a decision tree structure including a plurality of nodes, the plurality of nodes including a subset of the plurality of rules. The plurality of nodes may be stride nodes, mask nodes, or a combination thereof. A mask node may remove restrictions of stride nodes, such as markers and consumption of contiguous bits. As long as a bit of a field is a non-consumed bit, the bit may be used for cutting a field in a mask node. An advantage of a mask node is that the mask node may consume fewer resources (e.g., memory) than a stride node.

Abstract: In one embodiment, a method includes encoding a key matching rule having at least one dimension by storing in a memory (i) a header of the key matching rule that has at least one header field, and (ii) at least one rule value field of the key matching rule corresponding to one of the dimensions.

Abstract: In an example embodiment, a circuit includes an oscillator providing a set of clock phase signals. A main edge rate controller (ERC) coupled to the oscillator is configured to adjust an edge rate of each clock phase signal of the set of clock phase signals. An interpolator coupled to the main ERC is configured to interpolate the adjusted set of clock phase signals to provide at least one desired phase output signal. An edge rate controller calibrator comprises a ring oscillator including at least three ERCs connected in a loop, a counter configured to count a number of cycles of the ring oscillator over a given period, and a finite state machine (FSM) configured to compare the counter count to a given value corresponding to an operating frequency of the circuit and to adjust operation of the circuit based on the comparison.

Abstract: One aspect of the present invention discloses a network system capable of transmitting and processing audio video (“A/V”) data with enhanced quality of service (“QoS”). The network system includes a transmitter, a transmission channel, an adjustable decoder buffer, and a decoder. The transmitter contains an encoder able to encode A/V data in accordance with encoding bit rate recommendation from SQoS and packets loss notifications. The transmission channel, in one example, transmits A/V data from the transmitter or the receiver. The adjustable decoder buffer, in one aspect, is able to change its storage capacity or buffering size in response to the adaptive latency estimate. Upon fetching at least a portion of the A/V data from the adjustable decoder buffer, SQoS updates the adaptive latency estimate based on the quality of the decoded A/V data.

Abstract: One aspect of the present invention discloses a network system capable of transmitting and processing audio video (“A/V”) data with enhanced quality of service (“QoS”). The network system includes a transmitter, a transmission channel, an adjustable decoder buffer, and a decoder. The transmitter contains an encoder able to encode A/V data in accordance with encoding bit rate recommendation from SQoS and packets loss notifications. The transmission channel, in one example, transmits A/V data from the transmitter or the receiver. The adjustable decoder buffer, in one aspect, is able to change its storage capacity or buffering size in response to the adaptive latency estimate. Upon fetching at least a portion of the A/V data from the adjustable decoder buffer, SQoS updates the adaptive latency estimate based on the quality of the decoded A/V data.