Operation of a dual instruction pipe virus co-processor
Circuits and methods are provided for detecting, identifying and/or removing undesired content. According to one embodiment, a method for performing content scanning of content objects is provided. A content object that is to be scanned is stored by a general purpose processor to a system memory of the general purpose processor. Content scanning parameters associated with the content object are set up by the general purpose processor. Instructions from a signature memory of a co-processor that is coupled to the general purpose processor are read by the co-processor based on the content scanning parameters. The instructions contain op-codes of a first instruction type and op-codes of a second instruction type. Those of the instructions containing op-codes of the first instruction type are assigned by the co-processor to a first instruction pipe of multiple instruction pipes of the co-processor for execution. An instruction of the assigned instructions containing op-codes of the first instruction type is executed by the first instruction pipe including accessing a portion of the content object from the system memory.
1. A method comprising:
storing, by a general purpose processor, a content object that is to be scanned for undesired content to a system memory of the general purpose processor;
setting up, by the general purpose processor, content scanning parameters associated with the content object;
reading, by a co-processor that is coupled to the general purpose processor via an interconnect bus, instructions from a signature memory of the co-processor based on the content scanning parameters, wherein the instructions contain op-codes of a first instruction type and op-codes of a second instruction type, wherein the op-codes of the first instruction type are associated with primitive instructions and wherein the op-codes of the second instruction type are associated with Content Pattern Recognition (CPR) instructions and wherein said reading comprises:
fetching, by a unified fetch and parse module of the co-processor, an instruction from an instruction cache when the instruction is available in the instruction cache; and
otherwise, when the instruction is not available in the instruction cache, then fetching by the unified fetch and parse module, the instruction from the signature memory;
assigning, by the co-processor, those of the instructions containing op-codes of the first instruction type to a first instruction pipe of a plurality of instruction pipes of the co-processor for execution;
assigning, by the co-processor, those of the instructions containing op-codes of the second instruction type to a second instruction pipe of the plurality of instruction pipes for execution; and
executing, by the first instruction pipe, an instruction of the assigned instructions containing op-codes of the first instruction type including accessing a portion of the content object from the system memory.
2. The method of claim 1 , further comprising:
determining, by the co-processor, a type of the content object; and
wherein said content scanning parameters include information regarding the type of the content object.
3. The method of claim 1 wherein the instructions contain intermixed op-codes of the first instruction type and the second instruction type and wherein the method further comprises determining if execution, by the second instruction pipe, of a particular instruction of the assigned instructions containing op-codes of the second instruction type is to be delayed to assure ordered execution of the intermixed op-codes.
4. The method of claim 3 , further comprising writing, by the first instruction pipe, a result of said executing to the system memory.
5. The method of claim 4 , further comprising performing a first write back to the system memory associated with a preceding instruction before performing a second write back to the system memory associated with a succeeding instruction.
6. The method of claim 5 , wherein the preceding instruction comprises one of the assigned instructions containing op-codes of the first instruction type and wherein the succeeding instruction comprises one of the assigned instructions containing op-codes of the second instruction type.
7. The method of claim 1 , wherein the content object is stored using a virtual address, wherein the system memory has stored therein paging data structures containing information for translating virtual addresses to physical addresses within a physical address space of the system memory and wherein the co-processor further caches a plurality of most recently used entries of the paging data structures within one or more translation lookaside buffers.
8. The method of claim 1 , wherein the undesired content comprises a known virus having a virus signature represented within the signature memory in a form of one or more op-codes of the first instruction type and one or more op-codes of the second instruction type.
9. The method of claim 8 , wherein the content scanning parameters include a file type indicative of a class of content with which the content object is associated and a pointer to the content object and wherein the file type is used to reduce a number of signatures in the signature memory that are applied to the content object.
10. The method of claim 8 , wherein the op-codes of the second instruction type include:
a compare text string op-code that matches a specified string;
a search text string op-code that searches for a first occurrence of a specified string;
a bitmask op-code that applies a specified bitmask to a specified byte;
a checksum op-code that calculates a checksum of a specified number of bytes and compares the calculated checksum to a specified checksum; and
a goto op-code that moves a signature pointer to a specified location within the signature memory.
11. A content scanning system comprising:
a general purpose processor configured to:
store a content object that is to be content scanned to a system memory of the general purpose processor; and
set up content scanning parameters associated with the content object;
and
a co-processor, coupled to the general purpose processor via an interconnect bus, wherein the co-processor is configured to:
read instructions from a signature memory of the co-processor based on the content scanning parameters, the instructions containing op-codes of a first instruction type and op-codes of a second instruction type, wherein the op-codes of the first instruction type are associated with primitive instructions and wherein the op-codes of the second instruction type are associated with Content Pattern Recognition (CPR) instructions by:
fetching, by a unified fetch and parse module of the co-processor, an instruction from an instruction cache when the instruction is available in the instruction cache; and
otherwise, when the instruction is not available in the instruction cache, then fetching by the unified fetch and parse module, the instruction from the signature memory;
assign those of the instructions containing op-codes of the first instruction type to a first instruction pipe of a plurality of instruction pipes of the co-processor for execution;
assign those of the instructions containing op-codes of the second instruction type to a second instruction pipe of the plurality of instruction pipes for execution; and
execute an instruction of the assigned instructions containing op-codes of the first instruction type including accessing a portion of the content object from the system memory.
12. The content scanning system of claim 11 , wherein the co-processor is further configured to determine a type of the content object and wherein said content scanning parameters include information regarding the type of the content object.
13. The content scanning system of claim 12 , wherein the instructions contain intermixed op-codes of the first instruction type and the second instruction type and wherein the co-processor is further configured to determine if execution, by the second instruction pipe, of a particular instruction of the assigned instructions containing op-codes of the second instruction type is to be delayed to assure ordered execution of the intermixed op-codes.
14. The content scanning system of claim 13 , wherein the co-processor is further configured to write, by the first instruction pipe, a result of executing the instruction of the assigned instructions containing op-codes of the first instruction type to the system memory.
15. The content scanning system of claim 14 , wherein the co-processor is further configured to perform a first write back to the system memory associated with a preceding instruction before performing a second write back to the system memory associated with a succeeding instruction.
16. The content scanning system of claim 15 , wherein the preceding instruction comprises one of the assigned instructions containing op-codes of the first instruction type and wherein the succeeding instruction comprises one of the assigned instructions containing op-codes of the second instruction type.
17. The content scanning system of claim 11 , wherein the content object is stored using a virtual address, wherein the system memory has stored therein paging data structures containing information for translating virtual addresses to physical addresses within a physical address space of the system memory and wherein the co-processor is further configured to cache a plurality of most recently used entries of the paging data structures within one or more translation lookaside buffers.
18. The content scanning system of claim 11 , wherein the undesired content comprises a known virus having a virus signature represented within the signature memory in a form of one or more op-codes of the first instruction type and one or more op-codes of the second instruction type.
19. The content scanning system of claim 18 , wherein the content scanning parameters include a file type indicative of a class of content with which the content object is associated and a pointer to the content object and wherein the file type is used to reduce a number of signatures in the signature memory that are applied to the content object.
20. The content scanning system of claim 18 , wherein the op-codes of the second instruction type include:
a compare text string op-code that matches a specified string;
a search text string op-code that searches for a first occurrence of a specified string;
a bitmask op-code that applies a specified bitmask to a specified byte;
a checksum op-code that calculates a checksum of a specified number of bytes and compares the calculated checksum to a specified checksum; and
a goto op-code that moves a signature pointer to a specified location within the signature memory.