Abstract: An architecture for a high performance IPSEC accelerator. The architecture includes components for scanning fields of packets, programming an IPSEC services device according to the scanned fields, and modifying the scanned packet with an output from the IPSEC security services device. Preferably, the architecture is implemented in hardware, and attached to a host machine. Hardware devices, fast in comparison to software processing and network speeds, allows the computationally intensive IPSEC processes to be completed in real-time and reduce or eliminate bottlenecks in the path of a packet being sent or received to/from a network.

Abstract: An architecture, method, and apparatus for managing a data buffer (Data Buffer Management DBM). A data buffer within the DBM is an unified linear memory space, and is divided into numbered physical pages with a predetermined page size. A memory map translates logical address spaces for storing/reading DBM transferred data to the physical address spaces. Each packet to be written into DBM is assigned a frame number or frame handler; thereafter, that frame number will be passed by the original owner (a device attached to the data buffer) to different processes for reading out and/or modifying the associated packet or packet data. Frame number assignment is done prior to actual data transfer by request of the data owner. The frame number request is done prior to moving data from the owner's local memory into the DBM's data buffer. Frame number is allocated dynamically by the DBM.

Abstract: A device for translating medium access control (MAC) dependent descriptors for a high performance network interface card. Specifically, one embodiment of the present invention includes a circuit for translating a medium access control descriptor from a first format into a second format. The circuit includes a translator circuit coupled to receive a descriptor which corresponds to data stored within a memory. Specifically, the translator circuit translates the descriptor from a first descriptor format into a second descriptor format. Furthermore, the circuit includes a medium access control (MAC) circuit coupled to the translator circuit to receive the descriptor in the second descriptor format. More specifically, the medium access control circuit uses the descriptor in the second descriptor format to retrieve the data from the memory.

Abstract: A method and system for priority arbitration in a computer environment having a shared resource capable of servicing a plurality of devices. In one embodiment, the present invention assigns an initial priority order to the plurality of devices such that those devices have priorities which are distinct. The present invention then identifies those of the plurality of devices which have issued service requests to the shared resource in a first clock cycle as requesting devices. Provided that there are more than one requesting device in the first clock cycle, the present invention selects one of the requesting devices to be serviced by the shared resource in a second clock cycle following the first clock cycle, where the selected device has the highest of the priorities among the requesting devices based on the initial priority order. The present invention also reassigns the priorities among the plurality of devices such that the selected device is assigned the lowest one of the priorities.

Abstract: A device and method for filtering addresses being transported through a high performance network, and rendering forwarding decisions for data frames corresponding to the address. Such data frames might correspond to multicast addresses wherein filtering is needed to prevent undesired data frames from being uploaded and processed by a receiving machine. The incoming address is hashed into an index for retrieving values from a table with a frame status. If the frame is valid, the same index is used to retrieve a table entry having address and address status information. If multiple data frames have been hashed into the same index, then further filtering is performed by the host machine or a processing device. Otherwise, the incoming address is compared with the address in the table entry. If a match occurs then the data frame is uploaded, and if no match then the frame is discarded. Frame status indicators in a bit register are used to direct actions performed on the frame.