Fast Pattern Matching on the Cell Broadband Engine

Transcription

1 Fas Paern Maching on he Cell Broadband Engine Francesco Iorio IBM Sysems & Technology Grou, Dublin Sofware Laboraory, Dublin, Ireland francesco Jan van Luneren IBM Research, Zurich Research Laboraory Säumersrasse 4, CH-8803 Rüschlikon, Swizerland (conac auhor) Absrac Paern-maching algorihms, which are essenial o inrusion deecion and virus scanning alicaions, yically only make limied use of he Single Insrucion Mulile Daa (SIMD) caabiliies available in new generaions of general-urose rocessors. This aer resens he iniial resuls of a sudy o increase he SIMD exloiaion by aern-maching schemes consising of a novel vecorized sae-machine imlemenaion ha is able o uilize he vecor-rocessing unis in he Cell Broadband Engine almos fully for all is rocessing ses by soring mos of he daa srucure in he large inernal regiser ses. The imlemenaion rovides an exremely deerminisic aggregae rocessing rae of 6.7 Gb/s for a single vecor uni, which can be scaled u o 50 Gb/s for one Cell Broadband Engine and u o 100 Gb/s for a blade for small aern ses. I also suors configuraions in which he scan rae can be arially raded off for increasing he number of aerns suored. Keywords: Paern maching, finie-sae machine, arallel algorihms, Cell Broadband Engine Cell Broadband Engine is a rademark of Sony Comuer Enerainmen, Inc. in he Unied Saes, oher counries, or boh and is used under license herefrom. IBM, PowerPC, and BladeCener are regisered rademarks of Inernaional Business Machines Cororaion in he Unied Saes, oher counries, or boh. Inel is a rademark of Inel Cororaion in he Unied Saes, oher counries, or boh. Oher comany, roduc or service names may be rademarks or service marks of ohers.

2 1 Inroducion Afer iniially having been emloyed mainly in suercomuers, SIMD echniques have found a growing alicaion in general-urose rocessors argeed a he desko in he as decade, wih examles including IBM s VMX, Inel s sreaming SIMD exensions (SSE) and HP s Mulimedia Acceleraion exensions (MAX). These exensions have yically been used o accelerae alicaions such as video and image rocessing, ha lend hemselves very well for vecorizaion. Paern-maching funcions also have become increasingly imoran in recen years, in aricular because of heir usage for inrusion deecion and virus scanning alicaions. Many aern-maching algorihms are based on finie-sae machines (FSMs). In arallel FSM imlemenaions, several essenial rocessing ses, such as branches and memory accesses, deend on mulile indeenden inu sreams and herefor yically can only be erformed in a serial fashion. Thus i is much more difficul o exloi he available SIMD caabiliies. In view of he above observaion, we sared o invesigae he quesion wheher i is ossible o devise an oimized sae-machine imlemenaion ha is able o exloi SIMD caabiliies o a much larger exen han convenional imlemenaions do. This effor has focused on creaing a arallel imlemenaion of a novel ye of rogrammable sae machine, called B-FSM [1], on a Synergisic Processing Elemen abbreviaed as SPE, which is he vecor-rocessing uni in he Cell Broadband Engine joinly develoed by Sony, Toshiba and IBM. In his aer, we resen he firs resul of our work, namely, a arallel B-FSM imlemenaion ha, o he bes of our knowledge, is he firs o achieve a full vecorizaion of all rocessing ses, including he memory accesses. This resuled in very high uilizaion of he available execuion unis enabling high scan raes of several ens of gigabis er second. We achieved his by leing he B-FSMs execue direcly ou of he large SPE regiser ses. This iniial imlemenaion herefor limis he size of he execued sae diagrams o a maximum of a few housand B-FSM ransiion rules, for which he corresonding daa srucures fi enirely ino he SPE regiser ses. The B-FSM ransiion rules, unlike convenional sae ransiions, also suor wildcards and rioriies and herefor can exress mach funcions in a much more comac way. This aeared sufficien o suor alicaions involving aern ses wih u o a few hundred aerns, such as okenizers, as well as alicaions in which he aern collecion is consruced ou of smaller subses, for which he corresonding daa srucures can be swaed efficienly beween he regiser ses and memory. The aer is organized in he following way. Secion 2 discusses relaed work on aern-maching algorihms ha ry o exloi SIMD caabiliies. Secion 3 rovides a shor inroducion of he Cell Broadband Engine and he SPEs. Secion 4 inroduces he B-FSM algorihm, which forms he core of our work. Secion 5 describes he vecorized imlemenaion of he B-FSM algorihm. The erformance of his imlemenaion is hen evaluaed in Secion 6. Secion 7 concludes he aer. 2 Relaed Work While aern-maching algorihms have already been sudied for several decades, research in his field has been inensified in recen years because of heir alicaion for inrusion deecion and oher (nework) securiy-relaed alicaions ha have raidly gained imorance. This has resuled in a large number of ublicaions on a wide secrum of boh hardware- and sofware-oriened schemes, wih caabiliies ranging from basic sring-maching o comlex regular-exression suor. A selecion can be found in [2]-[11]. Desie he large number of ublicaions, very few address he exloiaion of SIMD caabiliies. To our knowledge, no FSM-based aern-maching scheme has been ublished o dae ha inends o or has been able o aly an efficien vecorizaion of all rocessing ses, including he memory accesses. The work ha is closes o ours, is robably he sring-maching scheme ublished by Scarazza e al., which also arges he Cell Broadband Engine [12]. Their scheme is based on a daa srucure comrised of 1

3 fully exanded sae ables ha conain enries for all ossible sae and inu combinaions and are sored in he SPE s local sore. Their scheme has been limied o 5-bi-encoded inu characers, which only require 32-enry sae ables for each sae, so ha i can suor a reasonable number of saes, abou 1500, in he 256 KB local sore. Each SPE rocesses 16 inu sreams in arallel, wih he inu inerleaving being erformed by he PowerPC core. The corresonding address generaion and sae udae oeraions are imlemened in a arallel fashion. The acual accesses o he sae ables in he local sore, however, are erformed in a serial fashion. They reor a rocessing rae of 5.11 Gb/s er SPE. A key difference of our work comared wih he mehod by Scarazza e al., is he comression ha we aly by exloiing he B-FSM algorihm, which has been reored o imrove he sorage efficiency by a facor of 15 o 500 comared wih convenional schemes [1]. This comression allows he creaion of a subsanially more comac daa srucure, enabling an efficien exloiaion of smaller bu faser memories, such as he SPE regiser se in our iniial imlemenaion resened below. This comression comes, however, a he cos of addiional insrucions as he B-FSM algorihm involves slighly more comlex rocessing ses han he simler sae-able looku oeraion of he scheme by Scarazza e al. These insrucions, however, could be vecorized efficienly, requiring relaively few exra cycles. The erformance evaluaion, which will be resened in Secion 6, revealed ha he erformance gain we achieved hanks o he lower access laency o he vecor regiser se clearly ouweighed he addiional insrucion cycles, resuling in an overall rocessing rae ha is higher han he one reored by Scarazza. Comared wih our work, he scheme by Scarazza e al. is able o suor a larger sae ransiion diagram and, consequenly, a larger number of aerns. This is, however, for a large ar also due o he 5-bi inu encoding alied in heir scheme. If he encoding were increased o a 7-bi encoding similar o our imlemenaion (see Secion 5), hen he sae-able size would increase by a facor of four, allowing only one fourh of aroximaely 1500 saes o be sored. This is less han 400 saes and comes much closer o wha he B-FSM imlemenaion is able o sore in he vecor regiser se. In summary, boh schemes have heir own secific meris and, based on he characerisics of he mach funcion, have heir own secific alicaion domain in which hey achieve favorable erformance resuls. 3 Overview of he Cell Broadband Engine The Cell Broadband Engine [13] is a rocessor archiecure designed in a join venure beween Sony, Toshiba and IBM o overcome he radiional limiaions in high-hroughu rocessing caabiliy and he memory subsysems incaabiliy of susaining he ever increasing ace of he rocessors daa-access demands. The soluion o hese fundamenal obsacles o scalabiliy was imlemened in an archiecure ha encomasses several sraegies o increase he overall daa-rocessing caabiliies while obaining a beer ower efficiency. The archiecure consiss of one 64-bi PowerPC core (PowerPC Processor Elemen or PPE), which is he overall sysem conroller and runs he oeraing sysem and alicaions, eigh indeenden vecorrocessing unis (Synergisic Processor Elemens or SPE [14]), which are secialized in comue-inensive SIMD alicaions, a high-bandwidh inernal communicaion and daa ransfer nework (Elemen Inerconnec Bus or EIB), and a high-hroughu memory conroller (Memory Inerface Conroller or MIC), lus addiional I/O devices. This is illusraed in Fig. 1. The PPE is an in-order-execuion, dual-issue, dual-hreaded 64-bi varian of he PowerPC RISC rocessor family. I feaures 32 KB of Level 1 insrucion cache, 32 KB of Level 1 daa cache, lus an addiional 512 KB of Level 2 cache, and VMX SIMD vecor-rocessing exensions. The Synergisic Processor Elemens are very efficien 128-bi RISC vecor rocessors dedicaed o running rocessing and daa-inensive workloads. Each of he eigh SPEs in he Cell Broadband Engine feaures 256 KB of embedded sofware-managed local memory sore, and a large (128-elemen) 128-bi vecor regiser se. In addiion, each SPE embeds a owerful memory conroller (Memory Flow Conroller or MFC), 2

4 Figure 1: Cell Broadband Engine Overview. whose main feaure is he caabiliy of erforming asynchronous DMA daa ransfers beween he main sysem memory and he SPE local sore. The SPE rocessing core (SPU) has direc access only o is own local sore for boh insrucions and daa, hus a careful inerleaving of daa ransfer and rocessing oeraions is crucial and is enabled by an aroriae choice of daa buffering schemes. To fully exloi he vas comuing ower of he Cell Broadband Engine, four levels of rocessing arallelism mus be exloied when designing or oring algorihms: 1. Muli-core concurren rocessing: each Cell Broadband Engine conains eigh SPE cores, herefor algorihm-level arallelizaion is essenial o disribue he comuaion on all resources available. 2. SIMD / vecor rocessing: The SPEs are vecor rocessors designed o oerae on mulile oerands wih individual insrucions. Accordingly, roer daa srucures organizaion and full usage of he insrucion se are required o obain oimal insrucion level arallelism. 3. Pieline oimizaion: Deending on he insrucion ye, he laencies of SPE insrucions differ. Therefor, he bes ieline uilizaion deends on how daa and resuls deendencies are masked wih furher comuaion o avoid emy insrucion slos (ieline salls). 4. Dual-issue oimizaion: he SPEs are equied wih wo execuion ielines, and are hus caable of execuing wo insrucions er clock cycle, deending on he insrucion yes. Proerly aired insrucions can be execued simulaneously, so oimal cycle er insrucion figures deend on aroriae use of insrucions o exloi boh ielines. 4 B-FSM Technology This secion rovides an inroducion o he B-FSM echnology, which forms he core of our aernmaching work. I will focus on he various rocessing ses ha are ar of he basic B-FSM oeraion and ha are subjec for vecorizaion. For a more general and deailed descriion of he B-FSM echnology and is alicaion o aern maching, including a descriion of he comiler ha convers aerns ino a B-FSM daa srucure, he reader is referred o [1]. 4.1 Transiion Rules wih Wildcards The B-FSM engine is a fas rogrammable sae machine originally designed for hardware imlemenaion. A he core of he B-FSM echnology is he conce of secifying sae ransiions using so-called ransiion 3

5 S 0 S 1 e S 8 a S 2 S 9 e s S 3 e S 10 S 4 i s S 11 e S 5 S 12 n r S 6 g S 13 n S 7 S 14 ( defaul ransiions o sae S0 are no shown). (a) Sae-ransiion diagram. rule curren sae inu nex sae rioriy R 0 * * S 0 0 R 1 * [74h] S 1 1 R 2 S 1 e [65h] S 2 2 R 3 S 2 s [73h] S 3 2 R 4 S 3 [74h] S 4 2 R 5 S 4 i [69h] S 5 2 R 6 S 5 n [6Eh] S 6 2 R 7 S 6 g [67h] S 7 2 R 8 * [70h] S 8 1 R 9 S 8 a [61h] S 9 2 R 10 S 9 [74h] S 10 2 R 11 S 10 [74h] S 11 2 R 12 S 11 e [65h] S 12 2 R 13 S 12 r [72h] S 13 2 R 14 S 13 n [6Eh] S 14 2 R 15 S 4 e [65h] S 2 2 R 16 S 10 e [65h] S 2 2 R 17 S 12 s [73h] S 3 2 (b) Sae-ransiion rules. Figure 2: Examle of a mach funcion. rules. Each ransiion rule consis of a es ar, conaining exac-mach and/or wildcard condiions for he curren sae and inu values, and a resul ar, conaining a nex sae and an oional ouu vecor. The ransiion-rule conce is illusraed in Fig. 2 using an examle involving he simulaneous scanning of an inu sream for all occurrences of wo characer srings esing and aern. Fig. 2(a) shows a 4

6 convenional sae ransiion diagram ha can be consruced for his mach funcion using exising mehods. An arrival in sae S 7 or sae S 14 corresonds o he deecion of he firs or he second aern, resecively. Noe ha he diagram in Fig. 2(a) is slighly simlified for illusraive uroses; he defaul sae ransiions o sae S 0, which are aken if no oher ransiion shown in he diagram can be used, have been omied for clariy. Fig. 2(b) shows a se of ransiion rules ha can be used o describe he same mach funcion and was derived as described in [1]. In his examle, he inu is assumed o be encoded as ASCII and he corresonding numerical values are lised in hexadecimal noaion afer he characers. The B-FSM imlemenaion discussed below direcly execues his secificaion by searching in each cycle for he highes-rioriy ransiion rule ha maches he acual values of he sae regiser and inu. I hen uses he resul ar of ha rule o udae he sae regiser and, oionally, o generae ouu. As can be seen from he examle, wildcards allow he use of a single ransiion rule o describe mulile sae ransiions in he original sae ransiion diagram (e.g., rules R 0, R 1 and R 8 ), enabling a more comac and flexible definiion of he mach funcion. 4.2 Transiion Rule Selecion The B-FSM engine searches for he highes-rioriy maching ransiion rule in each clock cycle using a daa srucure ha is comrised of mulile equally-sized so-called ransiion-rule ables, wih each able corresonding o a aricular cluser of saes and conaining all he ransiion rules relaed o he saes in ha cluser. Wihin a given cluser, all saes are encoded using local sae vecors ha are only unique wihin ha cluser. Consequenly, a sae is idenified globally by he cluser idenifier uon which i is maed (yically he address of he corresonding ransiion-rule able is used for his) in combinaion wih is local sae vecor wihin ha cluser. This informaion is conained in he B-FSM sae regiser. For each sae a searae hash funcion is used o selec one of he ransiion rules ha aly o ha sae, based on he curren inu value. This hash funcion has been derived from he Balanced Rouing able (BART) search algorihm [15], hence he name BART-based Finie-Sae Machine (B-FSM). The hash funcion is defined by a mask vecor ha secifies how he hash index bis are exraced from he local sae and inu vecors according o he following funcion: index = (sae and no mask) or (inu and mask), (1) where and, or, and no are bi-wise oeraors, and sae and inu conain he curren values of he local sae and inu vecors. According o (1), each mask vecor bi secifies wheher a corresonding hash index bi is exraced from he sae vecor (mask bi equals zero) or from he inu vecor (mask bi equals one), enabling a very efficien and fas imlemenaion. In addiion o he local sae vecor of he nex sae, he resul ar of each ransiion rule also sores he address of he ransiion-rule able conaining he ransiion rules for ha nex sae and he mask ha secifies which hash funcion has o be used for selecing one of hese ransiion rules in he following cycle based on he nex inu value. Desie he simliciy of he above hash funcion, he B-FSM comiler is able o achieve a very efficien consrucion of he hash ables so ha each ransiion rule occurs only once and mos ables are fully occuied. This resuls in near-oimal sorage efficiency for a wide range of alicaions and aern ses. For examle as reored in [1], a collecion of abou 2,000 aerns involving a oal of 32K characers can be comiled ino less han 128 KB for a small array of B-FSMs. This reresens one of he mos comac srucures reored in he lieraure. The comiler achieves his high sorage efficiency by exloiing wo oimizaion echniques. The firs oimizaion involves he searaion of ransiion rules ha involve a wildcard condiion for he curren sae (and hence are only deenden on he inu value) and soring he resul ars of hese rules in a so-called defaul-rule able, which is being accessed based on he inu value only. In his way, he ransiion-rule ables described above will only sore ransiion rules involving exac-mach condiions for boh he curren 5

7 sae vecor mask able S 0 00h 00h 0000h S 1 08h 00h 0000h S 2 01h 00h 0000h S 3 09h 00h 0000h S 4 04h 04h 0000h S 5 0Dh 00h 0000h S 6 0Ch 00h 0000h S 7 06h 00h 0000h S 8 0Bh 00h 0000h S 9 0Ah 00h 0000h S 10 03h 01h 0000h S 11 05h 00h 0000h S 12 07h 01h 0000h S 13 0Eh 00h 0000h S 14 02h 00h 0000h (a) Sae encoding and masks. inu resul ar 7Fh.. rule R 0 75h 74h rule R 1 73h.. rule R 0 71h 70h rule R 8 6Fh.. rule R 0 00h (b) Defaul-rule able. index ransiion rule 7Fh.. 0Eh rule R 14 0Dh rule R 6 0Ch rule R 7 0Bh rule R 9 0Ah rule R 10 09h rule R 4 08h rule R 2 07h rule R 17 06h rule R 13 05h rule R 12 04h rule R 15 03h rule R 16 02h rule R 11 01h rule R 3 00h rule R 5 (c) Transiion-rule able. Figure 3: Samle sae encoding, defaul-rule able and ransiion-rule able conens. sae and inu. Only when no maching rule can be found in he ransiion-rule memory, will a looku be erformed on he defaul-rule able. The second oimizaion involves an efficien aroach for a combined sae clusering, sae encoding and hash funcion selecion described in more deail in [1]. Fig. 3 illusraes an examle of he comilaion resuls for he ransiion rules shown in Fig. 2(b), while alying he wo oimizaions menioned above. Fig. 3(a) shows he encoded sae vecors and masks defining he hash funcions for all saes S 0 o S 14. Fig. 3(b) shows he conens of he defaul-rule able, assuming a 7-bi inu value (ASCII encoding) which resuls in a oal of 128 able enries, one for each inu value. As can be verified in Fig. 2(b), he defaul-rule able imlemens he search for he highes-rioriy maching rule ha has a wildcard condiion for he curren sae, by a looku on he inu value. Fig. 3(c) shows he maing of he remaining rules ha involve exac-mach condiions on boh he curren sae and inu on he ransiion-rule able. The B-FSM oeraion based on he defaul-rule able and ransiion-rule able will now be illusraed using he following examle, in which i is assumed ha he B-FSM is in sae S 4. As can be seen in Fig. 2, ransiions can be made from sae S 4 o five ossible nex saes: wih an inu i (69h) o sae S 5 according o rule R 5 ; wih an inu e (65h) o sae S 2 according o rule R 15 ; wih an inu (74h) o sae S 1 according o rule R 1 ; wih an inu (70h) o sae S 8 according o rule R 8, and wih any oher inu o sae S 0 according o rule R 0 (noe ha his ransiion o S 0 is no shown o kee he sae diagram simle). These five cases are handled by he B-FSM in he following way. Sae S 4 is encoded using a local sae vecor 04h, and he ransiion-rule selecion for his sae is erformed using a hash funcion defined by a mask 04h (see Fig. 3(a)). If he inu equals i (69h), hen according o (1) a hash index value 00 is calculaed for he sae vecor 04h and mask 04h. A his index value, rule R 5 is rerieved from he curren hash able, as shown in Fig. 3(c). The es ar of his rule maches boh he curren sae and inu values, and consequenly, he nex sae S 5 will be rerieved from is resul ar. Similarly, if he inu equals e (65h), hen a hash index value 04h will be calculaed, and he maching rule R 15 rerieved from he ransiion-rule able, roviding a nex sae S 2. Any oher inu value will also resul in a hash index value equal o eiher 00h or 04h, bu neiher of he wo rules will mach he inu value. Consequenly, he defaul-rule able will be accessed. For inu values equal o (74h) or (70h), a ransiion o sae S 1 or S 8, resecively, will be made. For all oher inu values, a ransiion o sae S 0 will ake lace. 6

8 sruc { /* address generaion */ unsigned in mask : 7; MemAddr = ((SaeReg & (MaskRegˆ0x7F)) unsigned in able_addr; (InuVal & MaskReg)); unsigned in nx_sae : 7; MemAddr = (TableAddrReg << 7); unsigned in res_flag : 1; } DefaulRuleMem[128]; /* rule selecion */ sruc { if ((TransRuleMem[MemAddr].cur_sae == SaeReg) && unsigned in cur_sae : 7; (TransRuleMem[MemAddr].inu_val == InuVal)) { unsigned in inu_val : 7; SaeReg = TransRuleMem[MemAddr].nx_sae; unsigned in mask : 7; TableAddrReg = TransRuleMem[MemAddr].able_addr; unsigned in able_addr; MaskReg = TransRuleMem[MemAddr].mask; unsigned in nx_sae : 7; ResulFlag = TransRuleMem[MemAddr].res_flag; unsigned in res_flag : 1; } } TransRuleMem[]; else { SaeReg = DefaulRuleMem[InuVal].nx_sae; unsigned in SaeReg = 0; TableAddrReg = DefaulRuleMem[InuVal].able_addr; unsigned in TableAddrReg = 0; MaskReg = DefaulRuleMem[InuVal].mask; unsigned in MaskReg = 0; ResulFlag = DefaulRuleMem[InuVal].res_flag; unsigned in InuVal; } (a) Variables. (b) B-FSM core loo. Figure 4: Serial B-FSM imlemenaion. 5 Vecorized B-FSM imlemenaion This secion will resen a vecorized imlemenaion of he B-FSM algorihm described above which is able o exloi he caabiliies of he Cell Broadband Engine and of oher rocessors wih similar SIMD caabiliies. Firs, a serial B-FSM imlemenaion in C will be resened, which will hen be convered ino a arallel SPE imlemenaion ha can scan 16 indeenden inu sreams simulaneously agains a single se of aerns ha is comiled ino one B-FSM daa srucure ha comleely fis ino he SPE regiser ses. The key asec of he imlemenaion, which enables he vecorizaion of all B-FSM ses, is how he daa srucure is maed ono he SPE vecor regisers. 5.1 Serial B-FSM imlemenaion Fig. 4 shows he B-FSM core loo in C ha imlemens he conces described in Secion 4. This code fragmen involves 7-bi sae, mask, and inu vecors. I covers he B-FSM core loo, which consiss of he following rocessing ses: Firs a memory address is generaed by calculaing a hash index according o (1), which forms he lower ar of he address, whereas he able address forms he uer ar. Nex, he curren values of he sae regiser and inu vecor are comared wih he corresonding fields in he ransiion rule conained a he locaion in he ransiion-rule memory ha corresonds o he memory address calculaed. If hese wo values mach, hen he nex sae, able address and mask are aken from he resul ar of ha ransiion rule oherwise hey are obained by a looku on he defaul-rule able indexed by he curren inu value. This loo is reeaed for each new sae and inu value. In his examle, each ransiion rule includes a so-called resul flag, which is se if ha ransiion involves a nex sae ha corresonds o a maching aern found in he inu sream. Uon he deecion of a se resul flag, he mach funcion will erform a looku on he able address and sae vecor o deermine he aern idenifier. This looku, however, will no be discussed in his aer. For more deails, he reader is referred o [1]). 5.2 Daa Srucure Each SPE conains a oal of 128 vecor regisers, each 128 bis wide, corresonding o a oal of 2 KB of sorage. Eighy of hese regisers will be used o sore one defaul rule able and wo ransiion-rule ables, 7

9 #define SIMD_Looku128(index, able, resul) lsb3_7 = su_and(index, 0x1F); bl0_1 = su_shuffle(able[0],able[1],lsb3_7); bl2_3 = su_shuffle(able[2],able[3],lsb3_7); bl4_5 = su_shuffle(able[4],able[5],lsb3_7); bl6_7 = su_shuffle(able[6],able[7],lsb3_7); bi2 = su_cmeq(su_and(index,0x20),0x20); bl0_3 = su_sel(bl0_1,bl2_3,bi2); bl4_7 = su_sel(bl4_5,bl6_7,bi2); bi1 = su_cmg(index,0x3f); resul = su_sel(bl0_3,bl4_7,bi1); Figure 5: Samle daa srucure maing. Figure 6: Selecing each of 16 byes indeendenly from any of 128 bye locaions in 8 vecor regisers. which can conain a maximum of = 384 ransiion rules. The remaining 48 regisers are sufficien for erforming he various B-FSMs oeraions, including inu inerleaving. For his configuraion, he able address field consiss of a single bi. Each ransiion rule vecor has six fields, as shown in Fig. 4(a). Insead of soring he ransiion rules as an array of srucures, hey are sored as a srucure of arrays, as is illusraed in Fig. 5 for he curren sae field: A block of 16 consecuive vecor regisers is used o sore he 256 curren-sae fields of all he ransiion rules in he wo ransiion-rule ables. The inu, mask, and nex-sae fields are maed in a similar way ono hree oher blocks of 16 consecuive vecor regisers, hereby he single-bi resul-flag and able-address fields are acked a he mos-significan bi osiions ogeher wih he 7-bi mask and nexsae fields, resecively. In his way, a oal of 64 vecor regisers is used for soring he wo ransiion-rule ables. The defaul-rule able is maed in he same way. As shown in Fig. 4(a), each defaul-able enry conains only four fields, which can be combined ino wo acked fields as described above, so ha he 128 defaul-able enries can be maed ono wo blocks of 8 vecor regisers. The maing of he daa srucure on he SPE regiser se is illusraed in more deail in Fig. 7 in he Aendix. 5.3 Vecorized B-FSM Oeraion Following he yical aroach for vecorizaion, he curren sae, mask and inu values for all 16 B-FSMs are maed ogeher ono hree vecor regisers. Similarly, as done wih he ransiion-rule ables discussed above, he single-bi able address of he curren ransiion-rule able is acked wih he 7-bi curren sae value a he mos significan bi osiion. The arallel imlemenaion of he address generaion funcion, described in Fig. 4(b), is realized using a single SPE insrucion, su sel, which erforms a mask-conrolled bi selecion from wo vecor regisers, and hus direcly imlemens he index calculaion according o (1). By maing he able-address bi a he mos significan bi osiion wih he curren sae vecor and forcing he corresonding bi of he mask vecor o be zero, he addiion/concaenaion of he able address (see Fig. 4(b)) is erformed as ar of he same insrucion. The arallel imlemenaion of he rule selecion funcion shown in Fig. 4(b) and described in Secion 5.1, exlois he caabiliies of he SPE su shuffle insrucion o vecorize he 16 indeenden accesses o he daa srucure. This insrucion allows each of he 16 byes in he arge vecor regiser o be seleced indeendenly, from any of he 32 bye locaions in wo source vecor regisers, under conrol of a hird vecor regiser. By combining mulile su shuffle insrucions wih su sel and some comare insrucions, i is ossible o increase he number of source byes from which he 16 arge byes can be seleced. Fig. 6 illusraes a code fragmen ha allows he 16 byes o be indeendenly seleced from 128 differen bye locaions in a oal of 8 vecor regisers. A grahic reresenaion is rovided in Fig. 8 in he Aendix. 8

10 Wih he daa srucure being organized as described in Secion 5.2, his flexible bye selecion can now be used o fech he various fields of he seleced ransiion rules (also using a 16 ou of 256 bye selecion funcion) under conrol of he calculaed addresses for all 16 B-FSMs in arallel. In a similar way, he defaul rule able can be accessed in arallel for all 16 B-FSMs (using a 16 ou of 128 bye selecion funcion, as shown in Fig. 6) under conrol of he curren inu value (see Fig. 4(b)). The 16 sae and inu fields of he ransiion rules seleced are groued ino wo vecor regisers, and comared agains he vecor regisers conaining he acual sae and inu values by means of a simle comare insrucion. The comare-resul vecor is hen used o conrol a su sel insrucion ha will selec wheher he sae, mask, and able address values will be udaed from he ransiion rule seleced if i maches or from he defaul rule able enry oherwise. 5.4 Inu and Resul Processing Because of he arallel rocessing of 16 inu sreams in vecor form (16 elemens of 8 bis each, forming a 128-bi word) he inu daa mus be inerleaved, as each elemen in he vecor word reresens an inu daum sourced from a differen sream. If he PPE is used for he inu-daa sream inerleaving ask and hus simulaneously serves mulile SPEs, hen here is a high robabiliy for he inerleaving rocess o become a hroughu boleneck, as he PPE would be required o erform daa reads, shuffles, and wries a a daa rae sufficien o feed all 8 SPEs daa sreams, while concurrenly running OS faciliies and nework rocessing. For his reason we imlemened wo versions of he B-FSM loo, one ha erforms daa inerleaving direcly on he SPE and one ha assumes he inu daa is re-inerleaved by an exernal rocess, as described in relevan relaed lieraure [12]. Boh imlemenaions load inu daa from he main memory by means of DMA ransfers o he SPE local sore in blocks of 256 elemens er sream for a oal of = 4096 byes. They exloi a double buffering scheme o hide daa ransfer laency and all DMA ransfers are SPEiniiaed. The firs imlemenaion, which includes daa inerleaving, uses DMA liss o fech blocks of 256 byes from 16 differen sources in he main memory, as in his case he inu daa sreams are assumed o reside in searae memory locaions. The second imlemenaion, which does no include daa inerleaving, uses single DMA ransfer commands o fech blocks of 4096 byes of re-inerleaved coniguous daa from he main memory. The resul flags generaed by each B-FSM rocessing se are sored in an aroriae memory area in he SPE s local sore, and can be ransferred o he main memory for furher use. This rocess incurs only in a very minimal enaly: Noe ha our curren imlemenaion does no move he resuls daa o he main memory. 6 Performance Evaluaion 6.1 Exerimenal Seu The sofware was develoed using he C language wih secific language exensions and exloiing he IBM Cell SDK v2.1 gcc comiler and ools [16]. Exerimenaion and erformance measuremens were erformed on a IBM BladeCener QS21 blade server running a 3.2 GHz [17]. Profiling informaion for uning was colleced using a combinaion of he IBM Cell Broadband Engine Full Sysem Simulaor and he IBM Assembly Visualizer for he Cell Broadband Engine [18]. 6.2 Exerimenal Resuls The version of he B-FSM imlemenaion ha includes inu inerleaving consiss of wo nesed loos. The inu sream inerleaving rocess resides ouside of he B-FSM core loo and rocesses 16 byes from each lain inu sream ino an inerleaved block of 256 byes, which corresond o he 16 inu elemens for each of he 16 inu sreams. This oeraion was measured o require 105 clock cycles. 9

11 Table 1: Measured erformance resuls for a single SPE. Wih daa sream Wihou daa sream inerleaving inerleaving Avg. clock cycles er sae ransiion Throughu (M sae ransiions/sec.) Throughu (Gb/s) B-FSM core loo CPI B-FSM core loo dual issue B-FSM core loo salls Regisers used By using saic ieline analysis we could infer ha he B-FSM core loo, which oeraes on all 16 daa sreams in arallel, consiss of 57 insrucions in he even and 44 in he odd ieline, requiring a oal of 58 clock cycles, aking ino accoun dual issued insrucions. This corresonds o a heoreical eak erformance of 3.65 (58/16) clock cycles er individual sae ransiion made by each of he 16 B-FSMs. Table 1 rovides deails on he erformance measured for a single SPE: he version wihou inu inerleaving achieves a hroughu of 6.7 Gb/s and has erformance characerisics close o he heoreical eak, as i consiss of he B-FSM core loo and only some minimal ouer loo srucures. The version wih inu inerleaving needs o erform he inu rocessing ouside of he core loo, hus incurring a enaly, resuling in a slighly reduced hroughu of 6.05 Gb/s. In boh versions no loo unrolling of he B-FSM core loo was erformed because of limiaions in he curren comiler regiser allocaion olicy ha generaes unwaned sills of values o memory, which degrades he overall erformance. The inu sream inerleaving code, which is ouside of he core loo, runs enirely on he odd ieline and akes a oal of 105 cycles o execue. As here are 13 unused odd ieline insrucion slos er se in he core loo, he enire inu inerleaving rocess could be oimized manually o fi ino he unused ieline slos by emloying a fully unrolled core loo (16 imes), hus obaining he full 6.7 Gb/s hroughu including sream inerleaving. An ineresing roery of he B-FSM imlemenaion is ha all ossible execuion ahs in he code ake he same number of cycles, rendering he above erformance numbers deerminisic and comleely indeenden of he characerisics of he inu sream and he aerns. All eigh SPEs in he Cell Broadband Engine were oeraing in arallel, each scanning a se of 16 inu sreams a a rae of 6.7 Gb/s agains he ransiion diagram sored in is vecor regiser se. As ar of he exerimens, various configuraions were esed ha involved differen allocaions of inu sreams o hese eigh SPEs, allowing he aggregae scan rae and number of ransiions (and aerns) o be scaled in a flexible way. In one exreme configuraion, all 8 SPEs were oeraing on 8 differen ses of 16 inu sreams, corresonding o a oal of 128 indeenden inu sreams, scanning each se agains a sae diagram consising of u o 384 ransiion rules (256 regular rules and 128 defaul rules). This resuled in a oal measured scan rae of over 50 Gb/s. In he oher exreme configuraion, all 8 SPEs were oeraing on he same se of 16 inu sreams, scanning hese a a oal scan rae of 6.7 Gb/s agains a disribued sae diagram ha has u o = 3072 ransiion rules (2048 regular rules and 1024 defaul rules). Oher configuraions allow oher combinaions of aggregae scan rae (in ses of 6.7 Gb/s) and number of ransiion rules beween hese exremes, e.g., a scan rae of 13 Gb/s agains u o 1536 ransiion rules, a scan rae of 26 Gb/s agains u o 768 ransiion rules, and so on. Because he rocess is scalable, more han one rocessor can be used in arallel. The QS21 Blade used in he exerimens has wo Cell Broadband Engine rocessors, which allowed a furher scaling of he scan rae u o 100 Gb/s (which was measured) or he suored number of ransiion rules o be increased u o a oal of

12 An ineresing feaure is ha he B-FSM daa srucure in each SPE only uses a oal of 80 vecor regisers, which can be loaded from he SPE s local sore in 85 cycles. This allows a raid swiching beween differen aern ses for which he corresonding comiled B-FSM daa srucures have been re-sored in he local sore. Wih he local sore in each SPE being 256 KB, i allows 200 differen B-FSM daa srucures o be sored, which consis of u o 76K ransiions rules er SPE and over 600K ransiion rules er Cell Broadband Engine. This is, of course, aricularly useful for mach alicaions for which he aern se is organized ino several smaller subses, agains which he inu sreams need o be scanned selecively. Various aern ses and inu races were used during he exerimens o verify he correc oeraion of he mach funcion. As already indicaed in he inroducion, i is imoran o noe ha he B-FSM ransiion rules menioned here are differen from convenional sae ransiions, because hey suor wildcard condiions and rioriies, allowing a more comac reresenaion of mach funcions. As a resul, he B-FSM comiler was able o comile a few ens of aerns ino he regiser se of each SPE, i.e., a few hundred aerns for all 8 SPEs. The acual number of aerns ha fi ino he regiser ses deends on he aern characerisics which deermine how well hey can be maed ono a se of B-FSM ransiion rules. This oic, however, is beyond he scoe of his aer, bu has been addressed in [1]. Noe ha by means of a selecive aern-disribuion funcion as described in [1] he comiler is able o imrove he sorage efficiency furher for configuraions in which mulile SPEs oerae on he same se of inu sreams. 7 Conclusion This aer has resened a novel arallel imlemenaion of he B-FSM algorihm on he Cell Broadband Engine, which, o our knowledge, is one of he firs fully vecorized imlemenaions of a sae machine involving arallel memory accesses. This was achieved by soring he main daa srucures direcly in he SPE regiser ses, and by a aricular organizaion of hese srucures ha made i ossible o arallelize he accesses from he 16 B-FSMs execued by each SPE. A key feaure of his imlemenaion is ha he rocessing rae is exremely deerminisic and indeenden of he inu sream and he aern characerisics. Each SPE achieved an aggregae scan rae of 6.7 Gb/s for mach funcions secified by u o a few hundred B-FSM ransiion rules, which suor wildcards and rioriies. The aggregae scan rae could be scaled o a measured value of over 50 Gb/s when using all 8 SPEs in he Cell Broadband Engine o simulaneously scan 128 indeenden sreams, and o over 100 Gb/s for a blade conaining wo Cell Broadband Engines when scanning 256 indeenden sreams. Alernaively, mulile SPEs could also be allocaed o scan he same se of inu sreams, enabling one o scale he number of ransiion rules raher han he aggregae scan rae, which resuled in an increase of he number of aerns suored. The resuls also indicae ha he addiional comlexiy he B-FSM algorihm incurs comared wih convenional schemes based on a simle nex-sae able looku, only resuls in a relaively small number of exra insrucion cycles because of an effecive arallel imlemenaion of he B-FSM core loo. Furhermore, hese exra cycles are comleely comensaed by he higher sorage efficiency obained in his way, which allows he efficien exloiaion of smaller and much faser memories (in his case he SPE regiser ses) o realize very high rocessing raes. A furher advanage is ha his also allows one o swich efficienly beween mulile mach funcions for which he B-FSM daa srucures are sored in he local sore. The work resened here was he firs resul of an invesigaion ino he efficien exloiaion of SIMD caabiliies for aern maching. Ongoing work is argeed a scaling owards subsanially larger aern ses, hereby alying he exerience gained from his firs imlemenaion. A second research oic is direced a exensions for regular exressions, in aricular sorage-efficien suor for characer classes. 11

13 References [1] J. van Luneren, High-erformance aern-maching for inrusion deecion, Proc. IEEE INFOCOM, Barcelona, Sain, Aril [2] A.V. Aho and M.J. Corasick, Efficien sring maching: An aid o bibliograhic search, Communicaions of he ACM, vol. 18, no. 6, , [3] R.S. Boyer and J.S. Moore, A fas sring searching algorihm, Communicaions of he ACM, vol. 20, no. 10, , Oc [4] B. Commenz-Waler, A sring maching algorihm fas on he average, Proc. of he 6h Colloquium, on Auomaa, Languages and Programming, , July [5] S. Wu and U. Manber, A fas algorihm for muli-aern searching, Technical reor TR-94-17, Dearmen of Comuer Science, Universiy of Arizona, May [6] C. Coi, S. Saniford, and J. McAlerney, Towards faser sring maching for inrusion deecion, Proc. of he DARPA Informaion Survivabiliy Conference and Exhibiion, , [7] N. Tuck, T. Sherwood, B. Calder, and G. Varghese, Deerminisic memory-efficien sring maching algorihms for inrusion deecion, Proc. IEEE Infocom, vol. 4, , March [8] R. Sidhu and V.K. Prasanna, Fas regular exression maching using FPGAs, Proc. IEEE Symosium on Field-Programmable Cusom Comuing Machines (FCCM), , [9] B.L. Huchings, R. Franklin, and D. Carver, Assising nework inrusion deecion wih reconfigurable hardware, Proc. IEEE Symosium on Field-Programmable Cusom Comuing Machines (FCCM), , Aril [10] C.R. Clark and D.E. Schimmel, Scalable aern maching for high seed neworks, Proc. IEEE Symosium on Field-Programmable Cusom Comuing Machines (FCCM), , Aril [11] I. Sourdis and D. Pnevmaikaos, Pre-decoded CAMs for efficien and high-seed NIDS aern maching, Proc. IEEE Symosium on Field-Programmable Cusom Comuing Machines (FCCM), , Aril [12] D.P. Scarazza, O. Villa, and F. Perini, Peak-erformance DFA-based sring maching on he Cell rocessor, Parallel and Disribued Processing Symosium, IPDPS 2007,. 1-8, March [13] J. A. Kahle, M. N. Day, H. P. Hofsee, C. R. Johns, T. R. Maeurer, and D. Shiy, Inroducion o he Cell Mulirocessor, IBM Journal of Research and Develomen, , July/Seember [14] B. Flachs e al., The Microarchiecure of he Sreaming Processor for a CELL Processor, Proc. IEEE Inernaional Solid-Sae Circuis Symosium, , February [15] J. van Luneren, Searching very large rouing ables in wide embedded memory, Proc. IEEE Globecom, vol. 3, , November [16] h:// [17] h://www-03.ibm.com/sysems/bladecener/ hardware/servers/qs21/index.hml [18] h://w3.alhaworks.ibm.com/ech/asmvis 12

14 A Aendix 13

15 Figure 7: SPE regiser allocaion. 14

16 Figure 8: Flexible looku. 15