FACL: A Flexible and High-Performance ACL engine on FPGA-based SmartNIC

Abstract

Access Control List (ACL) is an important network function in modern cloud and carrier networks. Nowadays, SmartNIC is becoming a promising location to perform network functions in the end-to-end transmission. However, previous ACL designs have difficulties to achieve high throughput and support various kinds of rulesets at the same time. FPGA-based SmartNIC brings a new opportunity due to its flexibility and parallelism. In this paper, we propose FACL, a flexible and high performance ACL engine with the decision tree approach on FPGA-based SmartNIC. With the tree decomposition and the Network-on-Chip (NOC) pipeline scheduling, it is feasible for FACL to support all kinds of rulesets, as long as there is sufficient memory space. A compiler for FACL is also proposed, which maps decision trees to SRAM memory to optimize the throughput of a ruleset. FACL is implemented on Xilinx U250, a typical FPGA SmartNIC. According to the evaluation, FACL achieves up to 250 Mpps throughput with about 150 ns latency, when dealing with various 100 K ACL rulesets. The utilization of LUT/Register is only 10%/3.8%. With further decision tree optimization and engine parallelism, FACL has the potential to achieve higher throughput and support larger rulesets.