SPRUI30H November 2015 – May 2024 DRA745 , DRA746 , DRA750 , DRA756
The rule engine is a micro-coded machine that is programmed by the host software. The rule engine is programmed to evaluate various expressions involving the header fields of different protocols that the incoming packet belongs to. These expressions are coded into the instructions that are stored in an internal RAM and are used to check whether a packet is mal-formed or is potentially a DoS attack packet. The rule engine executes the instructions for each incoming packet and makes a decision about accepting or rejecting the packet.
Since each packet can have multiple distinct protocol headers, the location of the headers can be different from packet to packet. The rule engine gets information about the location of the protocol headers from the packet header extractor. The packet header extractor can decode several different protocol types. The octet number at which a particular protocol header is stored is loaded into SPF Base Registers. An application may require SPF to filter packets based on protocols that are not decoded by the extractor. In such cases, SPF allows bypassing the header extractor and then the rule engine can be programmed to analyze packets and figure out the location of each header.
The Rule Engine instructions are programmed before the SPF module is enabled. The instructions cannot be overwritten while the rule engine is processing packets. To modify the contents of code RAM during operation, SPF must be disabled temporarily and then new instructions can be loaded.
Once SPF is enabled, the rule engine starts to fetch instructions one at a time. For each instruction, the operands are obtained from either the packet octets that are being received, from internal registers or from the immediate values inside the instruction itself. If the octet that is needed for execution has not yet been received, then the execution stalls until the required octet is received. In case the operand specified in the instruction refers to a packet octet that has already gone by and is not available in the packet buffer, then the execution stalls until the end of packet. An instruction is executed only when all the required operands are available. Based on the instruction execution results, the packet may immediately be dropped or the results of the evaluated expressions may be stored for future use. In addition, the current instruction can also cause the rule engine to skip a specified number of instructions (immediately following the current instruction) and resume from another location in the instruction RAM.
The rule engine operates on multiple operands and performs multiple tasks in each clock cycle. In each cycle, it can perform one arithmetic and/or logical operation on two pairs of operands. The operands are masked with a 32-bit mask that is generated from the information provided in the instruction. The mask allows for operations that involve variable sized operands. Each operation generates a 32-bit number and a flag bit. The 32-bit number is typically either the sum or the output of bit-wise logical operation. The flag is a single bit result of a comparison operation. The result of each operation can be saved in the internal registers if a specified condition is satisfied. Similarly, depending on the result of the operation, the rule engine can jump to another location in the instruction memory. The program can instruct the rule engine to either perform two save operations, two conditional jumps or one jump and one save. The conditions must be mutually exclusive to prevent unspecified operation. In addition to providing an alternate path for execution, the instruction can cause the rule engine to accept or reject the current packet and exit from the program until the next packet is received.
When the execution of an instruction does not result in a decision to accept or reject the packet, the rule engine progresses to the next instruction. Instructions are executed until a final decision is made. If a packet is aborted in the middle at the network interface, the rule engine aborts execution and clears all base registers, program counter, octet counter and packet buffer. It is then ready to process next packet.
From a hardware perspective, the rule engine contains a buffer to store packet octets, several internal registers for temporary storage, instruction decoding logic and control circuitry. A description of each of the hardware resources in the rule engine follows.