From 4c10635dc1f820d37e43f44e06d318decc5cd150 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sat, 8 Nov 2014 12:25:30 +0100 Subject: [PATCH] detect: optimize non-mpm mask checking Store id and mask in a single array of type SignatureNonMpmStore so that both are loaded into the same cache line. --- src/detect-engine-siggroup.c | 43 ++++++++++++++---------------------- src/detect.c | 9 ++++---- src/detect.h | 12 +++++----- 3 files changed, 29 insertions(+), 35 deletions(-) diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index 5f3a9f14ab..08c298159c 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -192,16 +192,10 @@ void SigGroupHeadFree(SigGroupHead *sgh) sgh->match_array = NULL; } - if (sgh->non_mpm_id_array != NULL) { - SCFree(sgh->non_mpm_id_array); - sgh->non_mpm_id_array = NULL; - sgh->non_mpm_id_cnt = 0; - } - - if (sgh->non_mpm_mask_array != NULL) { - SCFree(sgh->non_mpm_mask_array); - sgh->non_mpm_mask_array = NULL; - sgh->non_mpm_mask_cnt = 0; + if (sgh->non_mpm_store_array != NULL) { + SCFree(sgh->non_mpm_store_array); + sgh->non_mpm_store_array = NULL; + sgh->non_mpm_store_cnt = 0; } sgh->sig_cnt = 0; @@ -1705,8 +1699,7 @@ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh) if (sgh == NULL) return 0; - BUG_ON(sgh->non_mpm_id_array != NULL); - BUG_ON(sgh->non_mpm_mask_array != NULL); + BUG_ON(sgh->non_mpm_store_array != NULL); for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; @@ -1720,17 +1713,13 @@ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh) } if (non_mpm == 0) { - sgh->non_mpm_id_array = NULL; + sgh->non_mpm_store_array = NULL; return 0; } - sgh->non_mpm_id_array = SCMalloc(non_mpm * sizeof(SigIntId)); - BUG_ON(sgh->non_mpm_id_array == NULL); - memset(sgh->non_mpm_id_array, 0, non_mpm * sizeof(SigIntId)); - - sgh->non_mpm_mask_array = SCMalloc(non_mpm * sizeof(SignatureMask)); - BUG_ON(sgh->non_mpm_mask_array == NULL); - memset(sgh->non_mpm_mask_array, 0, non_mpm * sizeof(SignatureMask)); + sgh->non_mpm_store_array = SCMalloc(non_mpm * sizeof(SignatureNonMpmStore)); + BUG_ON(sgh->non_mpm_store_array == NULL); + memset(sgh->non_mpm_store_array, 0, non_mpm * sizeof(SignatureNonMpmStore)); for (sig = 0; sig < sgh->sig_cnt; sig++) { s = sgh->match_array[sig]; @@ -1738,13 +1727,15 @@ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh) continue; if (s->mpm_sm == NULL) { - BUG_ON(sgh->non_mpm_id_cnt >= non_mpm); - sgh->non_mpm_id_array[sgh->non_mpm_id_cnt++] = s->num; - sgh->non_mpm_mask_array[sgh->non_mpm_mask_cnt++] = s->mask; + BUG_ON(sgh->non_mpm_store_cnt >= non_mpm); + sgh->non_mpm_store_array[sgh->non_mpm_store_cnt].id = s->num; + sgh->non_mpm_store_array[sgh->non_mpm_store_cnt].mask = s->mask; + sgh->non_mpm_store_cnt++; } else if (s->flags & (SIG_FLAG_MPM_PACKET_NEG|SIG_FLAG_MPM_STREAM_NEG|SIG_FLAG_MPM_APPLAYER_NEG)) { - BUG_ON(sgh->non_mpm_id_cnt >= non_mpm); - sgh->non_mpm_id_array[sgh->non_mpm_id_cnt++] = s->num; - sgh->non_mpm_mask_array[sgh->non_mpm_mask_cnt++] = s->mask; + BUG_ON(sgh->non_mpm_store_cnt >= non_mpm); + sgh->non_mpm_store_array[sgh->non_mpm_store_cnt].id = s->num; + sgh->non_mpm_store_array[sgh->non_mpm_store_cnt].mask = s->mask; + sgh->non_mpm_store_cnt++; } } return 0; diff --git a/src/detect.c b/src/detect.c index 1b561ff912..aba0a2c641 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1335,11 +1335,12 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* prefilter non_mpm list against the mask of the packet */ det_ctx->non_mpm_id_cnt = 0; uint32_t x = 0; - for (x = 0; x < det_ctx->sgh->non_mpm_id_cnt; x++) { + for (x = 0; x < det_ctx->sgh->non_mpm_store_cnt; x++) { /* only if the mask matches this rule can possibly match, * so build the non_mpm array only for match candidates */ - if ((det_ctx->sgh->non_mpm_mask_array[x] & mask) == det_ctx->sgh->non_mpm_mask_array[x]) { - det_ctx->non_mpm_id_array[det_ctx->non_mpm_id_cnt++] = det_ctx->sgh->non_mpm_id_array[x]; + SignatureMask rule_mask = det_ctx->sgh->non_mpm_store_array[x].mask; + if ((rule_mask & mask) == rule_mask) { + det_ctx->non_mpm_id_array[det_ctx->non_mpm_id_cnt++] = det_ctx->sgh->non_mpm_store_array[x].id; } } @@ -1352,7 +1353,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh SCPerfCounterAddUI64(det_ctx->counter_mpm_list, th_v->sc_perf_pca, (uint64_t)det_ctx->pmq.rule_id_array_cnt); SCPerfCounterAddUI64(det_ctx->counter_nonmpm_list, th_v->sc_perf_pca, - (uint64_t)det_ctx->sgh->non_mpm_id_cnt); + (uint64_t)det_ctx->sgh->non_mpm_store_cnt); /* non mpm sigs after mask prefilter */ SCPerfCounterAddUI64(det_ctx->counter_fnonmpm_list, th_v->sc_perf_pca, (uint64_t)det_ctx->non_mpm_id_cnt); diff --git a/src/detect.h b/src/detect.h index 9ded0077e1..2a130bb869 100644 --- a/src/detect.h +++ b/src/detect.h @@ -953,6 +953,11 @@ typedef struct SigGroupHeadInitData_ { struct DetectPort_ *port; } SigGroupHeadInitData; +typedef struct SignatureNonMpmStore_ { + SigIntId id; + SignatureMask mask; +} SignatureNonMpmStore; + /** \brief Container for matching data for a signature group */ typedef struct SigGroupHead_ { uint32_t flags; @@ -967,11 +972,8 @@ typedef struct SigGroupHead_ { SignatureMask *mask_array; #endif - SigIntId *non_mpm_id_array; - uint32_t non_mpm_id_cnt; // size is cnt * sizeof(SigIntId) - - SignatureMask *non_mpm_mask_array; - uint32_t non_mpm_mask_cnt; // size is cnt * sizeof(SignatureMask) + SignatureNonMpmStore *non_mpm_store_array; + uint32_t non_mpm_store_cnt; // size is cnt * sizeof(SignatureNonMpmStore) /* pattern matcher instances */ MpmCtx *mpm_proto_other_ctx;