detect: optimize non-mpm mask checking

Store id and mask in a single array of type SignatureNonMpmStore so
that both are loaded into the same cache line.

src/detect-engine-siggroup.c

@@ -192,16 +192,10 @@ void SigGroupHeadFree(SigGroupHead *sgh)
         sgh->match_array = NULL;
     }
 
-    if (sgh->non_mpm_id_array != NULL) {
-        SCFree(sgh->non_mpm_id_array);
-        sgh->non_mpm_id_array = NULL;
-        sgh->non_mpm_id_cnt = 0;
-    }
-
-    if (sgh->non_mpm_mask_array != NULL) {
-        SCFree(sgh->non_mpm_mask_array);
-        sgh->non_mpm_mask_array = NULL;
-        sgh->non_mpm_mask_cnt = 0;
+    if (sgh->non_mpm_store_array != NULL) {
+        SCFree(sgh->non_mpm_store_array);
+        sgh->non_mpm_store_array = NULL;
+        sgh->non_mpm_store_cnt = 0;
     }
 
     sgh->sig_cnt = 0;
@@ -1705,8 +1699,7 @@ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
     if (sgh == NULL)
         return 0;
 
-    BUG_ON(sgh->non_mpm_id_array != NULL);
-    BUG_ON(sgh->non_mpm_mask_array != NULL);
+    BUG_ON(sgh->non_mpm_store_array != NULL);
 
     for (sig = 0; sig < sgh->sig_cnt; sig++) {
         s = sgh->match_array[sig];
@@ -1720,17 +1713,13 @@ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
     }
 
     if (non_mpm == 0) {
-        sgh->non_mpm_id_array = NULL;
+        sgh->non_mpm_store_array = NULL;
         return 0;
     }
 
-    sgh->non_mpm_id_array = SCMalloc(non_mpm * sizeof(SigIntId));
-    BUG_ON(sgh->non_mpm_id_array == NULL);
-    memset(sgh->non_mpm_id_array, 0, non_mpm * sizeof(SigIntId));
-
-    sgh->non_mpm_mask_array = SCMalloc(non_mpm * sizeof(SignatureMask));
-    BUG_ON(sgh->non_mpm_mask_array == NULL);
-    memset(sgh->non_mpm_mask_array, 0, non_mpm * sizeof(SignatureMask));
+    sgh->non_mpm_store_array = SCMalloc(non_mpm * sizeof(SignatureNonMpmStore));
+    BUG_ON(sgh->non_mpm_store_array == NULL);
+    memset(sgh->non_mpm_store_array, 0, non_mpm * sizeof(SignatureNonMpmStore));
 
     for (sig = 0; sig < sgh->sig_cnt; sig++) {
         s = sgh->match_array[sig];
@@ -1738,13 +1727,15 @@ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
             continue;
 
         if (s->mpm_sm == NULL) {
-            BUG_ON(sgh->non_mpm_id_cnt >= non_mpm);
-            sgh->non_mpm_id_array[sgh->non_mpm_id_cnt++] = s->num;
-            sgh->non_mpm_mask_array[sgh->non_mpm_mask_cnt++] = s->mask;
+            BUG_ON(sgh->non_mpm_store_cnt >= non_mpm);
+            sgh->non_mpm_store_array[sgh->non_mpm_store_cnt].id = s->num;
+            sgh->non_mpm_store_array[sgh->non_mpm_store_cnt].mask = s->mask;
+            sgh->non_mpm_store_cnt++;
         } else if (s->flags & (SIG_FLAG_MPM_PACKET_NEG|SIG_FLAG_MPM_STREAM_NEG|SIG_FLAG_MPM_APPLAYER_NEG)) {
-            BUG_ON(sgh->non_mpm_id_cnt >= non_mpm);
-            sgh->non_mpm_id_array[sgh->non_mpm_id_cnt++] = s->num;
-            sgh->non_mpm_mask_array[sgh->non_mpm_mask_cnt++] = s->mask;
+            BUG_ON(sgh->non_mpm_store_cnt >= non_mpm);
+            sgh->non_mpm_store_array[sgh->non_mpm_store_cnt].id = s->num;
+            sgh->non_mpm_store_array[sgh->non_mpm_store_cnt].mask = s->mask;
+            sgh->non_mpm_store_cnt++;
         }
     }
     return 0;

src/detect.c

@@ -1335,11 +1335,12 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
     /* prefilter non_mpm list against the mask of the packet */
     det_ctx->non_mpm_id_cnt = 0;
     uint32_t x = 0;
-    for (x = 0; x < det_ctx->sgh->non_mpm_id_cnt; x++) {
+    for (x = 0; x < det_ctx->sgh->non_mpm_store_cnt; x++) {
         /* only if the mask matches this rule can possibly match,
          * so build the non_mpm array only for match candidates */
-        if ((det_ctx->sgh->non_mpm_mask_array[x] & mask) == det_ctx->sgh->non_mpm_mask_array[x]) {
-            det_ctx->non_mpm_id_array[det_ctx->non_mpm_id_cnt++] = det_ctx->sgh->non_mpm_id_array[x];
+        SignatureMask rule_mask = det_ctx->sgh->non_mpm_store_array[x].mask;
+        if ((rule_mask & mask) == rule_mask) {
+            det_ctx->non_mpm_id_array[det_ctx->non_mpm_id_cnt++] = det_ctx->sgh->non_mpm_store_array[x].id;
         }
     }
 
@@ -1352,7 +1353,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
         SCPerfCounterAddUI64(det_ctx->counter_mpm_list, th_v->sc_perf_pca,
                              (uint64_t)det_ctx->pmq.rule_id_array_cnt);
         SCPerfCounterAddUI64(det_ctx->counter_nonmpm_list, th_v->sc_perf_pca,
-                             (uint64_t)det_ctx->sgh->non_mpm_id_cnt);
+                             (uint64_t)det_ctx->sgh->non_mpm_store_cnt);
         /* non mpm sigs after mask prefilter */
         SCPerfCounterAddUI64(det_ctx->counter_fnonmpm_list,
                 th_v->sc_perf_pca, (uint64_t)det_ctx->non_mpm_id_cnt);

src/detect.h

@@ -953,6 +953,11 @@ typedef struct SigGroupHeadInitData_ {
     struct DetectPort_ *port;
 } SigGroupHeadInitData;
 
+typedef struct SignatureNonMpmStore_ {
+    SigIntId id;
+    SignatureMask mask;
+} SignatureNonMpmStore;
+
 /** \brief Container for matching data for a signature group */
 typedef struct SigGroupHead_ {
     uint32_t flags;
@@ -967,11 +972,8 @@ typedef struct SigGroupHead_ {
     SignatureMask *mask_array;
 #endif
 
-    SigIntId *non_mpm_id_array;
-    uint32_t non_mpm_id_cnt; // size is cnt * sizeof(SigIntId)
-
-    SignatureMask *non_mpm_mask_array;
-    uint32_t non_mpm_mask_cnt; // size is cnt * sizeof(SignatureMask)
+    SignatureNonMpmStore *non_mpm_store_array;
+    uint32_t non_mpm_store_cnt; // size is cnt * sizeof(SignatureNonMpmStore)
 
     /* pattern matcher instances */
     MpmCtx *mpm_proto_other_ctx;