PACKET PROCESSORS AND PACKET FILTER PROCESSES, CIRCUITS, DEVICES, AND SYSTEMS

• US 20070110053A1
• Filed: 05/31/2006
• Published: 05/17/2007
• Est. Priority Date: 06/14/2005
• Status: Active Grant

• Current Assignee: Texas Instruments, Inc.
• Original Assignee: Texas Instruments, Inc.
• Inventors: Soni, Maneesh, McKinney, Thomas, Doma, Jagdish, Mundra, Amritpal
• Granted Patent: US 8,631,483 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: G06F 9/3001 Arithmetic instructions
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y10T 29/49002 Electrical device making

Abstract

A packet filter (2500) for incoming communications packets includes extractor circuitry (2510) operable to extract data from a packet, and packet processor circuitry (2520) operable to concurrently mask (3010) the packet data from the extractor circuitry (2510), perform an arithmetic/logic operation (3020) on the packet to supply a packet drop signal (DROP), and perform a conditional limit operation and a conditional jump operation (3030).

Claims

1. A packet processor for incoming communications packets comprising:

extractor circuitry operable to extract data from a packet; and

processing circuitry operable to concurrently mask the packet data from the extractor circuitry, perform an arithmetic/logic operation on the packet to supply a packet drop signal, and perform a conditional limit operation and a conditional jump operation.

2. The packet processor claimed in claim 1 further comprising a rate limit counter wherein said processing circuitry for said conditional limit operation is responsive to a condition when the condition is true to adjust said rate limit counter by a predetermined amount.

3. The packet processor claimed in claim 2 wherein said processing circuitry for said conditional limit operation is further responsive to the condition when true, and said rate limit counter has reached an ending value, to drop the packet.

4. The packet processor claimed in claim 1 said processing circuitry is operable to perform a second arithmetic/logic operation in parallel with said arithmetic/logic operation on the packet, and the processing circuitry for the conditional limit operation is operable in response to both said arithmetic/logic operation and said second arithmetic/logic operation.

5. The packet processor claimed in claim 1 wherein said extractor circuitry is operable to subject a packet to a test and skip the packet depending on a result of the test.

6. A packet filtering system comprising:

a bus for receiving communications packets having headers;

a buffer coupled to said bus for holding at least part of a header of at least one of the communications packets;

a storage space having a first field for a rate limit value and a rate limit counter associated with said first field, the storage space having a second field for a rate limit clock pre-scaling value;

a packet filter having an input coupled to said bus, and an output coupled to control said buffer;

the packet filter coupled to said storage space and operable to subject the header to a test affected by said rate limit value and said rate limit clock pre-scaling value and interactive with said rate limit counter.

7. The packet filtering system claimed in claim 6 wherein said packet filter includes processing circuitry a conditional limit operation that is responsive to a condition when true, and said rate limit counter has reached an ending value, to drop the packet.

8. The packet filtering system claimed in claim 6 further comprising a second bus for receiving second communications packets, said packet filter having a second input coupled to said second bus and a second output to drop a packet among said second communications packets.

9. The packet filtering system claimed in claim 6 wherein the test includes a first analysis of contents of a single header of a single packet to detect pre-determined unwanted content in the header, and a rate-based second test of headers of plural packets, and the packet filter is operable to drop a packet if the packet header fails either of the first analysis or the second test.

10. The packet filtering system claimed in claim 6 wherein the test includes an analysis of a packet to determine whether the packet is from an acceptable source.

11. The packet filtering system claimed in claim 6 wherein the test includes an analysis of a packet to determine whether to drop a packet from an outgoing transmission from the system to a remote destination.

12. An integrated circuit for communications packets, comprising:

bus interface circuitry including a packet header-position determining circuit and a counter for counting bit-groups in a packet;

a packet buffer coupled to said bus interface circuitry; and

extraction logic coupled to said packet buffer, said header-position determining circuit, and said counter, the extraction logic having an offset input for an offset code, and the extraction logic operable as a function of a bit-group count from said counter, a header position from said header-position determining circuit, and an offset code from said offset input, for said extraction logic to produce an output representing at least one datum in the packet from said packet buffer.

13. The integrated circuit claimed in claim 12 further comprising a masking circuit operable to mask the output of said extraction logic.

14. A method for packet data extraction comprising:

monitoring a bus for a packet and holding bit-groups from the packet in a packet buffer;

determining a packet header-position of the packet;

counting bit-groups in the packet to determine a bit-group count at a reference location in a packet buffer; and

extracting at least one datum in the packet by accessing a position in said packet buffer as a function of

     1) a bit-group count from said counter,

     2) a header position determined from the packet, and

     3) an offset code.

15. A packet filter circuit for filtering incoming communications packets comprising:

an extractor circuit operable to extract at least one particular datum from a said packet; and

a programmable rule engine operable to subject the datum to a test and supply a signal to drop the packet if the packet fails the test.

16. The packet filter circuit claimed in claim 15 wherein said extractor circuit includes a plurality of protocol-specific circuits to detect respective beginning locations in the same packet of plural headers governed by different protocols.

17. The packet filter circuit claimed in claim 16 further comprising a plurality of registers and the plurality of protocol-specific circuits are coupled to supply said beginning locations to said plurality of registers as a packet is received.

18. The packet filter circuit claimed in claim 15 further comprising a packet buffer having locations for bit-groups accessible by said rule engine.

19. The packet filter circuit claimed in claim 18 further comprising at least one register, said extractor circuit supplying at least one header beginning location to said at least one register, and said rule engine responsive to an instruction having an instruction content to find the at least one particular location in said packet buffer and access said datum based on the instruction content and the header beginning location in said at least one register.

20. The packet filter circuit claimed in claim 15 wherein said rule engine is operable to stall when an instruction requests the datum but the datum is yet-to-arrive, and to execute the instruction when the datum has arrived.

21. The packet filter circuit claimed in claim 15 wherein said extractor circuit further includes 1) a packet bit-group counter operable to provide a count of how many bit-groups of a packet have arrived, 2) a packet buffer having bit-group locations, and 3) a data extraction logic circuit responsive to said packet bit-group counter and to said rule engine to access at least one particular bit-group location in said packet buffer and supply the datum from said particular bit-group to said rule engine.

22. The packet filter circuit claimed in claim 15 wherein said rule engine has multiple arithmetic/logic units (ALUs) each having a plurality of ALU inputs, and said rule engine having a decoder circuit responsive to a plurality of instruction formats and subfields to steer information responsive to one subfield into different ALU inputs depending on the instruction format.

23. A processor instruction having:

an operand field;

an arithmetic/logic field; and

a field selectively operable as a rate limit field, a jump field, and a save field.

24. The processor instruction claimed in claim 23 wherein said operand field has 1) a base register subfield that points to a location of a header location value and 2) an offset subfield representing an offset from the header location value.

25. The processor instruction claimed in claim 24 wherein said operand field further has 3) a mask subfield representing a mask for data at the offset.

26. The processor instruction claimed in claim 25 wherein said mask subfield represents a coded mask bits and said instruction further has 4) a second mask subfield representing immediate mask bits, and said coded mask bits and said immediate mask bits are concurrently-active representations.

27. A process for a host to control a packet filter having an event logger and packet filter registers, the host having a memory, the process comprising:

storing logging thresholds in at least one of the packet filter registers; and

loading at least one packet filter register to associate drop codes indicative of different tests on packets, with the logging thresholds.

28. The process claimed in claim 27 further comprising storing a packet rate limit value in a packet filter register.

29. The process claimed in claim 27 further comprising storing a rate limit clock pre-scaling value in a packet filter register.

30. The process claimed in claim 27 further comprising dynamically adjusting at least one value in a packet filter register pertaining to rate limit in response to packet drop information from the event logger.

31. The process claimed in claim 27 further comprising initializing a logging space in the memory and storing values for a log begin address, a log end address, and a log software pointer in packet filter register space.

32. The process claimed in claim 27 further comprising storing network source address values for use by the packet filter to determining which incoming packets to accept and drop.

33. A process of manufacturing a mobile phone with a flash memory coupled to a processor and for packet filtering, the process comprising programming the flash memory with code representing a method of operation by the processor to configure the packet filtering based on a packet rate limit value.

34. The process of manufacturing claimed in claim 33 further comprising programming a rate limit clock pre-scaling value into the flash.

35. The process of manufacturing claimed in claim 33 wherein the packet filtering has an event logger and the process of manufacturing further comprises programming the flash with further code representing an iterative adjustment of a value representing a packet rate limit in response to packet drop information from the event logger.

36. The process of manufacturing claimed in claim 33 for a host to control a packet filter having an event logger and packet filter registers, the process of manufacturing further comprises programming the flash memory with code representing initialization by storing logging thresholds in at least one of the packet filter registers, and loading at least one packet filter register to associate drop codes indicative of different tests on packets, with the logging thresholds.

37. The process of manufacturing claimed in claim 33 further comprising programming the flash memory with the code in encrypted, signed form.

38. A mobile phone comprising:

a wireless modem for receiving packets;

a storage space for holding information from received packets;

a processor coupled to said storage space, said processor operable to produce a voice communication from the information from received packets held in said storage space; and

packet processing circuitry fed by said wireless modem and operable to drop packets that fail predetermined tests and to couple information to said storage space from received packets that do not fail the predetermined tests.

39. The mobile phone claimed in claim 38 wherein said tests include a first test for a defective packet and a second test for an excessive packet rate.