Suricata

[root@mybox:~]# perf report --stdio --sort comm,dso --header

Failed to open /tmp/perf-4040.map, continuing without symbols

# ========

# captured on: Fri Apr 29 14:31:24 2016

# hostname : mybox

# os release : 3.10.0-327.13.1.el7.x86_64

# perf version : 3.10.0-327.13.1.el7.x86_64.debug

# arch : x86_64

# nrcpus online : 32

# nrcpus avail : 32

# cpudesc : Intel(R) Xeon(R) CPU E5-2640 v2 @ 2.00GHz

# cpuid : GenuineIntel,6,62,4

# total memory : 98796164 kB

# cmdline : /usr/bin/perf record -t 4048

# event : name = cycles, , size = 104, { sample_period, sample_freq } = 4000, sample_type = IP|TID|TIME|PERIOD, disabled = 1, mmap = 1, comm = 1, fre

# HEADER_CPU_TOPOLOGY info available, use -I to display

# HEADER_NUMA_TOPOLOGY info available, use -I to display

# pmu mappings: cpu = 4, software = 1, power = 23, uncore_pcu = 22, tracepoint = 2, uncore_imc_0 = 9, uncore_imc_1 = 10, uncore_imc_2 = 7, uncore_imc

# ========

#

# Samples: 1M of event 'cycles'

# Event count (approx.): 584334857560

#

# Overhead Command Shared Object

# ........ ............. ......................

#

91.30% RxPFRzc:99@91 suricata

4.39% RxPFRzc:99@91 libc-2.17.so

1.42% RxPFRzc:99@91 libpthread-2.17.so

1.22% RxPFRzc:99@91 libpfring.so

1.03% RxPFRzc:99@91 [kernel.kallsyms]

0.22% RxPFRzc:99@91 libjansson.so.4.4.0

0.21% RxPFRzc:99@91 [vdso]

0.15% RxPFRzc:99@91 libhtp-0.5.19.so.1.0.0

0.04% RxPFRzc:99@91 libz.so.1.2.7

0.01% RxPFRzc:99@91 perf-4040.map

0.00% RxPFRzc:99@91 libpcre.so.1.2.0

perf report:

Samples: 1M of event 'cycles', Event count (approx.): 584334857560

Overhead Command Shared Object Symbol

86.02% RxPFRzc:99@91 suricata [.] SCACSearch

2.81% RxPFRzc:99@91 libc-2.17.so [.] __memcmp_sse4_1

0.91% RxPFRzc:99@91 libpfring.so [.] __pfring_zc_spsc_recv_pkt

0.73% RxPFRzc:99@91 libpthread-2.17.so [.] pthread_mutex_unlock

0.68% RxPFRzc:99@91 libpthread-2.17.so [.] pthread_mutex_lock

0.57% RxPFRzc:99@91 suricata [.] SigMatchSignatures

0.53% RxPFRzc:99@91 suricata [.] memcmp@plt

root@mybox:~]# perf annotate --stdio --symbol=SCACSearch

[root@mybox:~]# cat perfannotate.txt

Failed to open /tmp/perf-4040.map, continuing without symbols

Percent | Source code & Disassembly of suricata for cycles

----------------------------------------------------------------

:

:

:

: Disassembly of section .text:

:

: 0000000000566b30 <SCACSearch>:

: SCACSearch():

: *

: * \retval matches Match count.

: */

: uint32_t SCACSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,

: PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen)

: {

0.00 : 566b30: push %rbp

: * to dig deeper */

: /* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */

: SCACPatternList *pid_pat_list = ctx->pid_pat_list;

:

: uint8_t bitarray[pmq->pattern_id_bitarray_size];

: memset(bitarray, 0, pmq->pattern_id_bitarray_size);

0.01 : 566b31: xor %esi,%esi

: *

: * \retval matches Match count.

: */

: uint32_t SCACSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,

: PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen)

: {

0.00 : 566b33: mov %rsp,%rbp

0.00 : 566b36: push %r15

0.00 : 566b38: push %r14

0.00 : 566b3a: push %r13

0.00 : 566b3c: push %r12

0.00 : 566b3e: mov %rdx,%r12

0.00 : 566b41: push %rbx

0.00 : 566b42: mov %r8d,%ebx

0.00 : 566b45: sub $0x78,%rsp

0.00 : 566b49: mov %rcx,-0x40(%rbp)

: SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx;

0.00 : 566b4d: mov (%rdi),%rax

: /* \todo tried loop unrolling with register var, with no perf increase. Need

: * to dig deeper */

: /* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */

: SCACPatternList *pid_pat_list = ctx->pid_pat_list;

:

: uint8_t bitarray[pmq->pattern_id_bitarray_size];

0.00 : 566b50: mov 0x18(%rdx),%edx

: * \retval matches Match count.

: */

: uint32_t SCACSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,

: PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen)

: {

: SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx;

0.00 : 566b53: mov %rax,%r14

0.00 : 566b56: mov %rax,-0x80(%rbp)

: int matches = 0;

:

: /* \todo tried loop unrolling with register var, with no perf increase. Need

: * to dig deeper */

: /* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */

: SCACPatternList *pid_pat_list = ctx->pid_pat_list;

0.00 : 566b5a: mov 0x40(%rax),%rax

0.02 : 566b5e: mov %rax,-0x68(%rbp)

:

: uint8_t bitarray[pmq->pattern_id_bitarray_size];

0.00 : 566b62: lea 0xf(%rdx),%rax

0.00 : 566b66: shr $0x4,%rax

0.00 : 566b6a: shl $0x4,%rax

0.00 : 566b6e: sub %rax,%rsp

: memset(bitarray, 0, pmq->pattern_id_bitarray_size);

0.00 : 566b71: mov %rsp,%rdi

: /* \todo tried loop unrolling with register var, with no perf increase. Need

: * to dig deeper */

: /* \todo Change it for stateful MPM. Supply the state using mpm_thread_ctx */

: SCACPatternList *pid_pat_list = ctx->pid_pat_list;

:

: uint8_t bitarray[pmq->pattern_id_bitarray_size];

0.00 : 566b74: mov %rsp,%r13

: memset(bitarray, 0, pmq->pattern_id_bitarray_size);

0.00 : 566b77: callq 4053d0 <memset@plt>

:

: if (ctx->state_count < 32767) {

0.00 : 566b7c: cmpl $0x7ffe,0x10(%r14)

: register SC_AC_STATE_TYPE_U16 state = 0;

: SC_AC_STATE_TYPE_U16 (*state_table_u16)[256] = ctx->state_table_u16;

0.01 : 566b84: mov -0x80(%rbp),%rax

: SCACPatternList *pid_pat_list = ctx->pid_pat_list;

:

: uint8_t bitarray[pmq->pattern_id_bitarray_size];

: memset(bitarray, 0, pmq->pattern_id_bitarray_size);

:

: if (ctx->state_count < 32767) {

0.00 : 566b88: ja 566da0 <SCACSearch+0x270>

: register SC_AC_STATE_TYPE_U16 state = 0;

: SC_AC_STATE_TYPE_U16 (*state_table_u16)[256] = ctx->state_table_u16;

0.00 : 566b8e: mov 0x18(%rax),%rax

0.00 : 566b92: mov %rax,-0x88(%rbp)

: for (i = 0; i < buflen; i++) {

0.00 : 566b99: movzwl %bx,%eax

0.00 : 566b9c: test %eax,%eax

0.00 : 566b9e: mov %eax,-0x70(%rbp)

0.00 : 566ba1: je 567208 <SCACSearch+0x6d8>

: state = state_table_u16[state & 0x7FFF][u8_tolower(buf[i])];

0.00 : 566ba7: callq 406090 <__ctype_tolower_loc@plt>

0.00 : 566bac: xor %r10d,%r10d

: uint32_t SCACSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,

: PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen)

: {

: SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx;

: int i = 0;

: int matches = 0;

0.00 : 566baf: xor %r14d,%r14d

:

: if (ctx->state_count < 32767) {

: register SC_AC_STATE_TYPE_U16 state = 0;

: SC_AC_STATE_TYPE_U16 (*state_table_u16)[256] = ctx->state_table_u16;

: for (i = 0; i < buflen; i++) {

: state = state_table_u16[state & 0x7FFF][u8_tolower(buf[i])];

0.00 : 566bb2: mov %rax,-0x90(%rbp)

:

: uint8_t bitarray[pmq->pattern_id_bitarray_size];

: memset(bitarray, 0, pmq->pattern_id_bitarray_size);

:

: if (ctx->state_count < 32767) {

: register SC_AC_STATE_TYPE_U16 state = 0;

0.00 : 566bb9: xor %eax,%eax

0.00 : 566bbb: mov %ax,-0x60(%rbp)

: matches++;

: } else {

: if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {

: ;

: } else {

: pmq->pattern_id_bitarray[(pids[k]) / 8] |= (1 << ((pids[k]) % 8));

0.00 : 566bbf: mov %r10,%rax

0.00 : 566bc2: mov %rsp,%r10

0.00 : 566bc5: mov %rax,%r13

0.00 : 566bc8: jmp 566bde <SCACSearch+0xae>

0.00 : 566bca: nopw 0x0(%rax,%rax,1)

3.30 : 566bd0: add $0x1,%r13

: memset(bitarray, 0, pmq->pattern_id_bitarray_size);

:

: if (ctx->state_count < 32767) {

: register SC_AC_STATE_TYPE_U16 state = 0;

: SC_AC_STATE_TYPE_U16 (*state_table_u16)[256] = ctx->state_table_u16;

: for (i = 0; i < buflen; i++) {

0.78 : 566bd4: cmp %r13d,-0x70(%rbp)

0.00 : 566bd8: jle 567071 <SCACSearch+0x541>

: state = state_table_u16[state & 0x7FFF][u8_tolower(buf[i])];

0.44 : 566bde: mov -0x40(%rbp),%rdi

0.01 : 566be2: mov -0x90(%rbp),%rsi

2.62 : 566be9: mov -0x60(%rbp),%rax

31.52 : 566bed: movzbl (%rdi,%r13,1),%ecx

0.33 : 566bf2: mov (%rsi),%rdx

0.06 : 566bf5: and $0x7fff,%eax

2.97 : 566bfa: shl $0x9,%rax

2.39 : 566bfe: add -0x88(%rbp),%rax

2.48 : 566c05: movslq (%rdx,%rcx,4),%rdx

0.47 : 566c09: movzwl (%rax,%rdx,2),%eax

: if (state & 0x8000) {

18.89 : 566c0d: test %ax,%ax

:

: if (ctx->state_count < 32767) {

: register SC_AC_STATE_TYPE_U16 state = 0;

: SC_AC_STATE_TYPE_U16 (*state_table_u16)[256] = ctx->state_table_u16;

: for (i = 0; i < buflen; i++) {

: state = state_table_u16[state & 0x7FFF][u8_tolower(buf[i])];

2.49 : 566c10: mov %ax,-0x60(%rbp)

: if (state & 0x8000) {

0.00 : 566c14: jns 566bd0 <SCACSearch+0xa0>

: uint32_t no_of_entries = ctx->output_table[state & 0x7FFF].no_of_entries;

1.27 : 566c16: mov -0x60(%rbp),%rax

8.25 : 566c1a: mov -0x80(%rbp),%rdi

0.00 : 566c1e: and $0x7fff,%eax

0.60 : 566c23: shl $0x4,%rax

0.61 : 566c27: add 0x38(%rdi),%rax

0.91 : 566c2b: mov 0x8(%rax),%edx

: uint32_t *pids = ctx->output_table[state & 0x7FFF].pids;

3.18 : 566c2e: mov (%rax),%rbx

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

0.12 : 566c31: test %edx,%edx

0.00 : 566c33: je 566bd0 <SCACSearch+0xa0>

0.58 : 566c35: lea -0x1(%rdx),%eax

0.00 : 566c38: mov %r13,-0x78(%rbp)

0.01 : 566c3c: mov %r10,%r13

0.02 : 566c3f: lea 0x4(%rbx,%rax,4),%rax

1.80 : 566c44: mov %rax,-0x38(%rbp)

0.60 : 566c48: jmp 566c7d <SCACSearch+0x14d>

0.00 : 566c4a: nopw 0x0(%rax,%rax,1)

: MpmAddPid(pmq, lower_pid);

: MpmAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size);

: }

: matches++;

: } else {

: if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {

0.00 : 566c50: mov %r8d,%eax

0.00 : 566c53: mov %r8d,%ecx

0.00 : 566c56: shr $0x3,%eax

0.00 : 566c59: and $0x7,%ecx

0.00 : 566c5c: movzbl 0x0(%r13,%rax,1),%edx

0.00 : 566c62: bt %ecx,%edx

0.00 : 566c65: jae 567088 <SCACSearch+0x558>

: pmq->pattern_id_bitarray[(pids[k]) / 8] |= (1 << ((pids[k]) % 8));

: bitarray[pids[k] / 8] |= (1 << (pids[k] % 8));

: MpmAddPid(pmq, pids[k]);

: MpmAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size);

: }

: matches++;

0.60 : 566c6b: add $0x1,%r14d

0.01 : 566c6f: add $0x4,%rbx

: state = state_table_u16[state & 0x7FFF][u8_tolower(buf[i])];

: if (state & 0x8000) {

: uint32_t no_of_entries = ctx->output_table[state & 0x7FFF].no_of_entries;

: uint32_t *pids = ctx->output_table[state & 0x7FFF].pids;

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

0.00 : 566c73: cmp -0x38(%rbp),%rbx

0.00 : 566c77: je 567160 <SCACSearch+0x630>

: if (pids[k] & 0xFFFF0000) {

0.00 : 566c7d: mov (%rbx),%r8d

0.45 : 566c80: test $0xffff0000,%r8d

0.00 : 566c87: je 566c50 <SCACSearch+0x120>

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

: buf + i - pid_pat_list[lower_pid].patlen + 1,

: pid_pat_list[lower_pid].patlen) != 0) {

0.20 : 566c89: mov -0x68(%rbp),%rsi

: uint32_t no_of_entries = ctx->output_table[state & 0x7FFF].no_of_entries;

: uint32_t *pids = ctx->output_table[state & 0x7FFF].pids;

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

0.41 : 566c8d: movzwl %r8w,%r8d

: SCMemcmp():

: {

: __m128i b1, b2;

:

: int r;

: /* counter for how far we already matched in the buffer */

: size_t m = 0;

0.00 : 566c91: xor %r10d,%r10d

: SCACSearch():

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

: buf + i - pid_pat_list[lower_pid].patlen + 1,

: pid_pat_list[lower_pid].patlen) != 0) {

0.00 : 566c94: mov %r8d,%eax

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

: buf + i - pid_pat_list[lower_pid].patlen + 1,

0.19 : 566c97: mov -0x40(%rbp),%rdi

: _mm_cmpestri():

: }

:

: extern __inline int __attribute__((__gnu_inline__, __always_inline__, __artificial__))

: _mm_cmpestri (__m128i __X, int __LX, __m128i __Y, int __LY, const int __M)

: {

: return __builtin_ia32_pcmpestri128 ((__v16qi)__X, __LX,

0.42 : 566c9b: mov $0x10,%edx

: SCACSearch():

: pid_pat_list[lower_pid].patlen) != 0) {

0.00 : 566ca0: lea (%rax,%rax,2),%rax

0.00 : 566ca4: lea (%rsi,%rax,8),%r15

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

: buf + i - pid_pat_list[lower_pid].patlen + 1,

0.20 : 566ca8: mov -0x78(%rbp),%rax

: pid_pat_list[lower_pid].patlen) != 0) {

0.42 : 566cac: movzwl 0x8(%r15),%r11d

: uint32_t *pids = ctx->output_table[state & 0x7FFF].pids;

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

2.81 : 566cb1: movzwl %r11w,%r9d

: buf + i - pid_pat_list[lower_pid].patlen + 1,

0.60 : 566cb5: sub %r9,%rax

0.60 : 566cb8: lea 0x1(%rdi,%rax,1),%rsi

: uint32_t *pids = ctx->output_table[state & 0x7FFF].pids;

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

1.83 : 566cbd: mov (%r15),%rdi

: SCMemcmp():

:

: do {

: /* apparently we can't just read 16 bytes even though

: * it almost always works fine :) */

: if (likely(n - m < 16)) {

0.01 : 566cc0: mov %r9,%rax

0.00 : 566cc3: sub %r10,%rax

0.00 : 566cc6: cmp $0xf,%rax

0.00 : 566cca: ja 567285 <SCACSearch+0x755>

: return memcmp(s1, s2, n - m) ? 1 : 0;

0.60 : 566cd0: mov %rax,%rdx

0.00 : 566cd3: mov %r8d,-0x6c(%rbp)

0.01 : 566cd7: callq 4060d0 <memcmp@plt>

0.01 : 566cdc: mov -0x6c(%rbp),%r8d

0.00 : 566ce0: test %eax,%eax

0.58 : 566ce2: setne %al

0.58 : 566ce5: movzbl %al,%eax

: SCACSearch():

0.60 : 566ce8: test %eax,%eax

0.00 : 566cea: jne 566c6f <SCACSearch+0x13f>

: buf + i - pid_pat_list[lower_pid].patlen + 1,

: pid_pat_list[lower_pid].patlen) != 0) {

: /* inside loop */

: continue;

: }

: if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) {

0.59 : 566cec: mov %r8d,%eax

0.00 : 566cef: mov %r8d,%ecx

0.00 : 566cf2: shr $0x3,%eax

0.00 : 566cf5: and $0x7,%ecx

0.61 : 566cf8: movzbl 0x0(%r13,%rax,1),%edx

0.04 : 566cfe: movzbl %dl,%esi

0.00 : 566d01: bt %ecx,%esi

0.02 : 566d04: jb 566c6b <SCACSearch+0x13b>

: ;

: } else {

: pmq->pattern_id_bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));

0.01 : 566d0a: mov %rax,%rsi

0.00 : 566d0d: mov $0x1,%edi

0.00 : 566d12: add 0x10(%r12),%rsi

0.00 : 566d17: shl %cl,%edi

0.00 : 566d19: mov %edi,%ecx

: bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));

0.00 : 566d1b: or %edx,%ecx

0.00 : 566d1d: mov %cl,0x0(%r13,%rax,1)

: continue;

: }

: if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) {

: ;

: } else {

: pmq->pattern_id_bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));

0.01 : 566d22: or %dil,(%rsi)

: MpmAddPid():

: int MpmAddPidResize(PatternMatcherQueue *pmq, uint32_t new_size);

:

: static inline void

: MpmAddPid(PatternMatcherQueue *pmq, uint32_t patid)

: {

: uint32_t new_size = pmq->pattern_id_array_cnt + 1;

0.01 : 566d25: mov 0x8(%r12),%eax

0.00 : 566d2a: lea 0x1(%rax),%edx

: if (new_size > pmq->pattern_id_array_size) {

0.00 : 566d2d: cmp 0xc(%r12),%edx

0.00 : 566d32: ja 567210 <SCACSearch+0x6e0>

: if (MpmAddPidResize(pmq, new_size) == 0)

: return;

: }

: pmq->pattern_id_array[pmq->pattern_id_array_cnt] = patid;

0.00 : 566d38: mov 0x8(%r12),%ecx

0.00 : 566d3d: mov (%r12),%rax

0.00 : 566d41: mov %r8d,(%rax,%rcx,4)

: pmq->pattern_id_array_cnt = new_size;

0.00 : 566d45: mov %edx,0x8(%r12)

: SCACSearch():

: bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));

: MpmAddPid(pmq, lower_pid);

: MpmAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size);

0.00 : 566d4a: mov 0xc(%r15),%edx

0.00 : 566d4e: mov 0x10(%r15),%r15

: MpmAddSids():

: *

: */

: static inline void

: MpmAddSids(PatternMatcherQueue *pmq, SigIntId *sids, uint32_t sids_size)

: {

: if (sids_size == 0)

0.00 : 566d52: test %edx,%edx

0.00 : 566d54: je 566c6b <SCACSearch+0x13b>

: return;

:

: uint32_t new_size = pmq->rule_id_array_cnt + sids_size;

0.00 : 566d5a: mov 0x28(%r12),%esi

0.00 : 566d5f: add %edx,%esi

: if (new_size > pmq->rule_id_array_size) {

0.00 : 566d61: cmp 0x2c(%r12),%esi

0.00 : 566d66: ja 567260 <SCACSearch+0x730>

: sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;

: }

: }

: SCLogDebug("Adding %u sids", sids_size);

: // Add SIDs for this pattern to the end of the array

: SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;

0.00 : 566d6c: mov 0x28(%r12),%ecx

0.00 : 566d71: mov 0x20(%r12),%rax

0.00 : 566d76: lea (%rax,%rcx,4),%rax

: SigIntId *end = ptr + sids_size;

0.00 : 566d7a: mov %edx,%ecx

0.00 : 566d7c: lea (%rax,%rcx,4),%rsi

: do {

: *ptr++ = *sids++;

0.00 : 566d80: add $0x4,%r15

0.00 : 566d84: mov -0x4(%r15),%ecx

0.03 : 566d88: add $0x4,%rax

: } while (ptr != end);

0.00 : 566d8c: cmp %rax,%rsi

: SCLogDebug("Adding %u sids", sids_size);

: // Add SIDs for this pattern to the end of the array

: SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;

: SigIntId *end = ptr + sids_size;

: do {

: *ptr++ = *sids++;

0.00 : 566d8f: mov %ecx,-0x4(%rax)

: } while (ptr != end);

0.00 : 566d92: jne 566d80 <SCACSearch+0x250>

: pmq->rule_id_array_cnt += sids_size;

0.00 : 566d94: add %edx,0x28(%r12)

0.00 : 566d99: jmpq 566c6b <SCACSearch+0x13b>

0.00 : 566d9e: xchg %ax,%ax

: SCACSearch():

: }

: } /* for (i = 0; i < buflen; i++) */

:

: } else {

: register SC_AC_STATE_TYPE_U32 state = 0;

: SC_AC_STATE_TYPE_U32 (*state_table_u32)[256] = ctx->state_table_u32;

0.00 : 566da0: mov 0x20(%rax),%rax

0.00 : 566da4: mov %rax,-0x88(%rbp)

: for (i = 0; i < buflen; i++) {

0.00 : 566dab: movzwl %bx,%eax

0.00 : 566dae: test %eax,%eax

0.00 : 566db0: mov %eax,-0x70(%rbp)

0.00 : 566db3: je 567208 <SCACSearch+0x6d8>

: state = state_table_u32[state & 0x00FFFFFF][u8_tolower(buf[i])];

0.00 : 566db9: callq 406090 <__ctype_tolower_loc@plt>

: uint32_t SCACSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,

: PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen)

: {

: SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx;

: int i = 0;

: int matches = 0;

0.00 : 566dbe: xor %r14d,%r14d

:

: } else {

: register SC_AC_STATE_TYPE_U32 state = 0;

: SC_AC_STATE_TYPE_U32 (*state_table_u32)[256] = ctx->state_table_u32;

: for (i = 0; i < buflen; i++) {

: state = state_table_u32[state & 0x00FFFFFF][u8_tolower(buf[i])];

0.00 : 566dc1: movq $0x0,-0x60(%rbp)

0.00 : 566dc9: mov %rax,-0x90(%rbp)

: }

: }

: } /* for (i = 0; i < buflen; i++) */

:

: } else {

: register SC_AC_STATE_TYPE_U32 state = 0;

0.00 : 566dd0: movl $0x0,-0x78(%rbp)

0.00 : 566dd7: nopw 0x0(%rax,%rax,1)

: SC_AC_STATE_TYPE_U32 (*state_table_u32)[256] = ctx->state_table_u32;

: for (i = 0; i < buflen; i++) {

: state = state_table_u32[state & 0x00FFFFFF][u8_tolower(buf[i])];

0.00 : 566de0: mov -0x40(%rbp),%rdi

0.00 : 566de4: mov -0x60(%rbp),%rsi

0.00 : 566de8: mov -0x78(%rbp),%eax

0.00 : 566deb: movzbl (%rdi,%rsi,1),%ecx

0.00 : 566def: mov -0x90(%rbp),%rdi

0.00 : 566df6: and $0xffffff,%eax

0.00 : 566dfb: shl $0xa,%rax

0.00 : 566dff: add -0x88(%rbp),%rax

0.00 : 566e06: mov (%rdi),%rdx

0.00 : 566e09: movslq (%rdx,%rcx,4),%rdx

0.00 : 566e0d: mov (%rax,%rdx,4),%eax

: if (state & 0xFF000000) {

0.00 : 566e10: test $0xff000000,%eax

:

: } else {

: register SC_AC_STATE_TYPE_U32 state = 0;

: SC_AC_STATE_TYPE_U32 (*state_table_u32)[256] = ctx->state_table_u32;

: for (i = 0; i < buflen; i++) {

: state = state_table_u32[state & 0x00FFFFFF][u8_tolower(buf[i])];

0.00 : 566e15: mov %eax,-0x78(%rbp)

: if (state & 0xFF000000) {

0.00 : 566e18: je 567060 <SCACSearch+0x530>

: uint32_t no_of_entries = ctx->output_table[state & 0x00FFFFFF].no_of_entries;

0.00 : 566e1e: mov -0x80(%rbp),%rdi

0.00 : 566e22: and $0xffffff,%eax

0.00 : 566e27: shl $0x4,%rax

0.00 : 566e2b: add 0x38(%rdi),%rax

0.00 : 566e2f: mov 0x8(%rax),%edx

: uint32_t *pids = ctx->output_table[state & 0x00FFFFFF].pids;

0.00 : 566e32: mov (%rax),%rbx

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

0.00 : 566e35: test %edx,%edx

0.00 : 566e37: je 567060 <SCACSearch+0x530>

0.00 : 566e3d: lea -0x1(%rdx),%eax

0.00 : 566e40: lea 0x4(%rbx,%rax,4),%rax

0.00 : 566e45: mov %rax,-0x38(%rbp)

0.00 : 566e49: jmp 566e7d <SCACSearch+0x34d>

0.00 : 566e4b: nopl 0x0(%rax,%rax,1)

: MpmAddPid(pmq, lower_pid);

: MpmAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size);

: }

: matches++;

: } else {

: if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {

0.00 : 566e50: mov %r8d,%eax

0.00 : 566e53: mov %r8d,%ecx

0.00 : 566e56: shr $0x3,%eax

0.00 : 566e59: and $0x7,%ecx

0.00 : 566e5c: movzbl 0x0(%r13,%rax,1),%edx

0.00 : 566e62: bt %ecx,%edx

0.00 : 566e65: jae 566fa0 <SCACSearch+0x470>

: pmq->pattern_id_bitarray[(pids[k]) / 8] |= (1 << ((pids[k]) % 8));

: bitarray[pids[k] / 8] |= (1 << (pids[k] % 8));

: MpmAddPid(pmq, pids[k]);

: MpmAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size);

: }

: matches++;

0.00 : 566e6b: add $0x1,%r14d

0.00 : 566e6f: add $0x4,%rbx

: state = state_table_u32[state & 0x00FFFFFF][u8_tolower(buf[i])];

: if (state & 0xFF000000) {

: uint32_t no_of_entries = ctx->output_table[state & 0x00FFFFFF].no_of_entries;

: uint32_t *pids = ctx->output_table[state & 0x00FFFFFF].pids;

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

0.00 : 566e73: cmp -0x38(%rbp),%rbx

0.00 : 566e77: je 567060 <SCACSearch+0x530>

: if (pids[k] & 0xFFFF0000) {

0.00 : 566e7d: mov (%rbx),%r8d

0.00 : 566e80: test $0xffff0000,%r8d

0.00 : 566e87: je 566e50 <SCACSearch+0x320>

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

: buf + i - pid_pat_list[lower_pid].patlen + 1,

: pid_pat_list[lower_pid].patlen) != 0) {

0.00 : 566e89: mov -0x68(%rbp),%rdi

: uint32_t no_of_entries = ctx->output_table[state & 0x00FFFFFF].no_of_entries;

: uint32_t *pids = ctx->output_table[state & 0x00FFFFFF].pids;

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

0.00 : 566e8d: movzwl %r8w,%r8d

: SCMemcmp():

: {

: __m128i b1, b2;

:

: int r;

: /* counter for how far we already matched in the buffer */

: size_t m = 0;

0.00 : 566e91: xor %r10d,%r10d

: SCACSearch():

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

: buf + i - pid_pat_list[lower_pid].patlen + 1,

: pid_pat_list[lower_pid].patlen) != 0) {

0.00 : 566e94: mov %r8d,%eax

: _mm_cmpestri():

0.00 : 566e97: mov $0x10,%edx

: SCACSearch():

0.00 : 566e9c: lea (%rax,%rax,2),%rax

0.00 : 566ea0: lea (%rdi,%rax,8),%r15

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

: buf + i - pid_pat_list[lower_pid].patlen + 1,

0.00 : 566ea4: mov -0x60(%rbp),%rax

: pid_pat_list[lower_pid].patlen) != 0) {

0.00 : 566ea8: movzwl 0x8(%r15),%r11d

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

: buf + i - pid_pat_list[lower_pid].patlen + 1,

0.00 : 566ead: mov -0x40(%rbp),%rdi

: uint32_t *pids = ctx->output_table[state & 0x00FFFFFF].pids;

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

0.00 : 566eb1: movzwl %r11w,%r9d

: buf + i - pid_pat_list[lower_pid].patlen + 1,

0.00 : 566eb5: sub %r9,%rax

0.00 : 566eb8: lea 0x1(%rdi,%rax,1),%rsi

: uint32_t *pids = ctx->output_table[state & 0x00FFFFFF].pids;

: uint32_t k;

: for (k = 0; k < no_of_entries; k++) {

: if (pids[k] & 0xFFFF0000) {

: uint32_t lower_pid = pids[k] & 0x0000FFFF;

: if (SCMemcmp(pid_pat_list[lower_pid].cs,

0.00 : 566ebd: mov (%r15),%rdi

: SCMemcmp():

:

: do {

: /* apparently we can't just read 16 bytes even though

: * it almost always works fine :) */

: if (likely(n - m < 16)) {

0.00 : 566ec0: mov %r9,%rax

0.00 : 566ec3: sub %r10,%rax

0.00 : 566ec6: cmp $0xf,%rax

0.00 : 566eca: ja 5672c0 <SCACSearch+0x790>

: return memcmp(s1, s2, n - m) ? 1 : 0;

0.00 : 566ed0: mov %rax,%rdx

0.00 : 566ed3: mov %r8d,-0x6c(%rbp)

0.00 : 566ed7: callq 4060d0 <memcmp@plt>

0.00 : 566edc: mov -0x6c(%rbp),%r8d

0.00 : 566ee0: test %eax,%eax

0.00 : 566ee2: setne %al

0.00 : 566ee5: movzbl %al,%eax

: SCACSearch():

0.00 : 566ee8: test %eax,%eax

0.00 : 566eea: jne 566e6f <SCACSearch+0x33f>

: buf + i - pid_pat_list[lower_pid].patlen + 1,

: pid_pat_list[lower_pid].patlen) != 0) {

: /* inside loop */

: continue;

: }

: if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) {

0.00 : 566eec: mov %r8d,%eax

0.00 : 566eef: mov %r8d,%ecx

0.00 : 566ef2: shr $0x3,%eax

0.00 : 566ef5: and $0x7,%ecx

0.00 : 566ef8: movzbl 0x0(%r13,%rax,1),%edx

0.00 : 566efe: movzbl %dl,%esi

0.00 : 566f01: bt %ecx,%esi

0.00 : 566f04: jb 566e6b <SCACSearch+0x33b>

: ;

: } else {

: pmq->pattern_id_bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));

0.00 : 566f0a: mov %rax,%rsi

0.00 : 566f0d: mov $0x1,%edi

0.00 : 566f12: add 0x10(%r12),%rsi

0.00 : 566f17: shl %cl,%edi

0.00 : 566f19: mov %edi,%ecx

: bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));

0.00 : 566f1b: or %edx,%ecx

0.00 : 566f1d: mov %cl,0x0(%r13,%rax,1)

: continue;

: }

: if (bitarray[(lower_pid) / 8] & (1 << ((lower_pid) % 8))) {

: ;

: } else {

: pmq->pattern_id_bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));

0.00 : 566f22: or %dil,(%rsi)

: MpmAddPid():

: int MpmAddPidResize(PatternMatcherQueue *pmq, uint32_t new_size);

:

: static inline void

: MpmAddPid(PatternMatcherQueue *pmq, uint32_t patid)

: {

: uint32_t new_size = pmq->pattern_id_array_cnt + 1;

0.00 : 566f25: mov 0x8(%r12),%eax

0.00 : 566f2a: lea 0x1(%rax),%edx

: if (new_size > pmq->pattern_id_array_size) {

0.00 : 566f2d: cmp 0xc(%r12),%edx

0.00 : 566f32: ja 5671b8 <SCACSearch+0x688>

: if (MpmAddPidResize(pmq, new_size) == 0)

: return;

: }

: pmq->pattern_id_array[pmq->pattern_id_array_cnt] = patid;

0.00 : 566f38: mov 0x8(%r12),%ecx

0.00 : 566f3d: mov (%r12),%rax

0.00 : 566f41: mov %r8d,(%rax,%rcx,4)

: pmq->pattern_id_array_cnt = new_size;

0.00 : 566f45: mov %edx,0x8(%r12)

: SCACSearch():

: bitarray[(lower_pid) / 8] |= (1 << ((lower_pid) % 8));

: MpmAddPid(pmq, lower_pid);

: MpmAddSids(pmq, pid_pat_list[lower_pid].sids, pid_pat_list[lower_pid].sids_size);

0.00 : 566f4a: mov 0xc(%r15),%edx

0.00 : 566f4e: mov 0x10(%r15),%r15

: MpmAddSids():

: *

: */

: static inline void

: MpmAddSids(PatternMatcherQueue *pmq, SigIntId *sids, uint32_t sids_size)

: {

: if (sids_size == 0)

0.00 : 566f52: test %edx,%edx

0.00 : 566f54: je 566e6b <SCACSearch+0x33b>

: return;

:

: uint32_t new_size = pmq->rule_id_array_cnt + sids_size;

0.00 : 566f5a: mov 0x28(%r12),%esi

0.00 : 566f5f: add %edx,%esi

: if (new_size > pmq->rule_id_array_size) {

0.00 : 566f61: cmp 0x2c(%r12),%esi

0.00 : 566f66: ja 56723b <SCACSearch+0x70b>

: sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;

: }

: }

: SCLogDebug("Adding %u sids", sids_size);

: // Add SIDs for this pattern to the end of the array

: SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;

0.00 : 566f6c: mov 0x28(%r12),%ecx

0.00 : 566f71: mov 0x20(%r12),%rax

0.00 : 566f76: lea (%rax,%rcx,4),%rax

: SigIntId *end = ptr + sids_size;

0.00 : 566f7a: mov %edx,%ecx

0.00 : 566f7c: lea (%rax,%rcx,4),%rsi

: do {

: *ptr++ = *sids++;

0.00 : 566f80: add $0x4,%r15

0.00 : 566f84: mov -0x4(%r15),%ecx

0.00 : 566f88: add $0x4,%rax

: } while (ptr != end);

0.00 : 566f8c: cmp %rax,%rsi

: SCLogDebug("Adding %u sids", sids_size);

: // Add SIDs for this pattern to the end of the array

: SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;

: SigIntId *end = ptr + sids_size;

: do {

: *ptr++ = *sids++;

0.00 : 566f8f: mov %ecx,-0x4(%rax)

: } while (ptr != end);

0.00 : 566f92: jne 566f80 <SCACSearch+0x450>

: pmq->rule_id_array_cnt += sids_size;

0.00 : 566f94: add %edx,0x28(%r12)

0.00 : 566f99: jmpq 566e6b <SCACSearch+0x33b>

0.00 : 566f9e: xchg %ax,%ax

: SCACSearch():

: matches++;

: } else {

: if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {

: ;

: } else {

: pmq->pattern_id_bitarray[(pids[k]) / 8] |= (1 << ((pids[k]) % 8));

0.00 : 566fa0: add 0x10(%r12),%rax

0.00 : 566fa5: mov $0x1,%edi

0.00 : 566faa: shl %cl,%edi

0.00 : 566fac: or %dil,(%rax)

: bitarray[pids[k] / 8] |= (1 << (pids[k] % 8));

0.00 : 566faf: mov $0x1,%edi

0.00 : 566fb4: mov (%rbx),%r15d

0.00 : 566fb7: mov %r15d,%ecx

0.00 : 566fba: mov %r15d,%eax

0.00 : 566fbd: and $0x7,%ecx

0.00 : 566fc0: shr $0x3,%eax

0.00 : 566fc3: shl %cl,%edi

0.00 : 566fc5: or %dil,0x0(%r13,%rax,1)

: MpmAddPid():

: int MpmAddPidResize(PatternMatcherQueue *pmq, uint32_t new_size);

:

: static inline void

: MpmAddPid(PatternMatcherQueue *pmq, uint32_t patid)

: {

: uint32_t new_size = pmq->pattern_id_array_cnt + 1;

0.00 : 566fca: mov 0x8(%r12),%eax

0.00 : 566fcf: lea 0x1(%rax),%edx

: if (new_size > pmq->pattern_id_array_size) {

0.00 : 566fd2: cmp 0xc(%r12),%edx

0.00 : 566fd7: ja 567140 <SCACSearch+0x610>

: if (MpmAddPidResize(pmq, new_size) == 0)

: return;

: }

: pmq->pattern_id_array[pmq->pattern_id_array_cnt] = patid;

0.00 : 566fdd: mov 0x8(%r12),%ecx

0.00 : 566fe2: mov (%r12),%rax

0.00 : 566fe6: mov %r15d,(%rax,%rcx,4)

: pmq->pattern_id_array_cnt = new_size;

0.00 : 566fea: mov %edx,0x8(%r12)

: SCACSearch():

: MpmAddPid(pmq, pids[k]);

: MpmAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size);

0.00 : 566fef: mov (%rbx),%eax

0.00 : 566ff1: mov -0x68(%rbp),%rsi

0.00 : 566ff5: lea (%rax,%rax,2),%rax

0.00 : 566ff9: lea (%rsi,%rax,8),%rax

0.00 : 566ffd: mov 0xc(%rax),%edx

0.00 : 567000: mov 0x10(%rax),%r15

: MpmAddSids():

: *

: */

: static inline void

: MpmAddSids(PatternMatcherQueue *pmq, SigIntId *sids, uint32_t sids_size)

: {

: if (sids_size == 0)

0.00 : 567004: test %edx,%edx

0.00 : 567006: je 566e6b <SCACSearch+0x33b>

: return;

:

: uint32_t new_size = pmq->rule_id_array_cnt + sids_size;

0.00 : 56700c: mov 0x28(%r12),%esi

0.00 : 567011: add %edx,%esi

: if (new_size > pmq->rule_id_array_size) {

0.00 : 567013: cmp 0x2c(%r12),%esi

0.00 : 567018: ja 567190 <SCACSearch+0x660>

: sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;

: }

: }

: SCLogDebug("Adding %u sids", sids_size);

: // Add SIDs for this pattern to the end of the array

: SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;

0.00 : 56701e: mov 0x28(%r12),%ecx

0.00 : 567023: mov 0x20(%r12),%rax

0.00 : 567028: lea (%rax,%rcx,4),%rax

: SigIntId *end = ptr + sids_size;

0.00 : 56702c: mov %edx,%ecx

0.00 : 56702e: lea (%rax,%rcx,4),%rsi

0.00 : 567032: nopw 0x0(%rax,%rax,1)

: do {

: *ptr++ = *sids++;

0.00 : 567038: add $0x4,%r15

0.00 : 56703c: mov -0x4(%r15),%ecx

0.00 : 567040: add $0x4,%rax

: } while (ptr != end);

0.00 : 567044: cmp %rax,%rsi

: SCLogDebug("Adding %u sids", sids_size);

: // Add SIDs for this pattern to the end of the array

: SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;

: SigIntId *end = ptr + sids_size;

: do {

: *ptr++ = *sids++;

0.00 : 567047: mov %ecx,-0x4(%rax)

: } while (ptr != end);

0.00 : 56704a: jne 567038 <SCACSearch+0x508>

: pmq->rule_id_array_cnt += sids_size;

0.00 : 56704c: add %edx,0x28(%r12)

0.00 : 567051: jmpq 566e6b <SCACSearch+0x33b>

0.00 : 567056: nopw %cs:0x0(%rax,%rax,1)

0.00 : 567060: addq $0x1,-0x60(%rbp)

: SCACSearch():

: } /* for (i = 0; i < buflen; i++) */

:

: } else {

: register SC_AC_STATE_TYPE_U32 state = 0;

: SC_AC_STATE_TYPE_U32 (*state_table_u32)[256] = ctx->state_table_u32;

: for (i = 0; i < buflen; i++) {

0.00 : 567065: mov -0x60(%rbp),%eax

0.00 : 567068: cmp %eax,-0x70(%rbp)

0.00 : 56706b: jg 566de0 <SCACSearch+0x2b0>

: }

: } /* for (i = 0; i < buflen; i++) */

: }

:

: return matches;

: }

0.00 : 567071: lea -0x28(%rbp),%rsp

0.00 : 567075: mov %r14d,%eax

0.00 : 567078: pop %rbx

0.00 : 567079: pop %r12

0.00 : 56707b: pop %r13

0.00 : 56707d: pop %r14

0.00 : 56707f: pop %r15

0.00 : 567081: pop %rbp

0.00 : 567082: retq

0.00 : 567083: nopl 0x0(%rax,%rax,1)

: matches++;

: } else {

: if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {

: ;

: } else {

: pmq->pattern_id_bitarray[(pids[k]) / 8] |= (1 << ((pids[k]) % 8));

0.00 : 567088: add 0x10(%r12),%rax

0.00 : 56708d: mov $0x1,%esi

: bitarray[pids[k] / 8] |= (1 << (pids[k] % 8));

0.00 : 567092: mov $0x1,%edi

: matches++;

: } else {

: if (bitarray[pids[k] / 8] & (1 << (pids[k] % 8))) {

: ;

: } else {

: pmq->pattern_id_bitarray[(pids[k]) / 8] |= (1 << ((pids[k]) % 8));

0.00 : 567097: shl %cl,%esi

0.00 : 567099: or %sil,(%rax)

: bitarray[pids[k] / 8] |= (1 << (pids[k] % 8));

0.00 : 56709c: mov (%rbx),%r15d

0.00 : 56709f: mov %r15d,%ecx

0.00 : 5670a2: mov %r15d,%eax

0.00 : 5670a5: and $0x7,%ecx

0.00 : 5670a8: shr $0x3,%eax

0.00 : 5670ab: shl %cl,%edi

0.00 : 5670ad: or %dil,0x0(%r13,%rax,1)

: MpmAddPid():

: int MpmAddPidResize(PatternMatcherQueue *pmq, uint32_t new_size);

:

: static inline void

: MpmAddPid(PatternMatcherQueue *pmq, uint32_t patid)

: {

: uint32_t new_size = pmq->pattern_id_array_cnt + 1;

0.00 : 5670b2: mov 0x8(%r12),%eax

0.00 : 5670b7: lea 0x1(%rax),%edx

: if (new_size > pmq->pattern_id_array_size) {

0.00 : 5670ba: cmp 0xc(%r12),%edx

0.00 : 5670bf: ja 567170 <SCACSearch+0x640>

: if (MpmAddPidResize(pmq, new_size) == 0)

: return;

: }

: pmq->pattern_id_array[pmq->pattern_id_array_cnt] = patid;

0.00 : 5670c5: mov 0x8(%r12),%ecx

0.00 : 5670ca: mov (%r12),%rax

0.00 : 5670ce: mov %r15d,(%rax,%rcx,4)

: pmq->pattern_id_array_cnt = new_size;

0.00 : 5670d2: mov %edx,0x8(%r12)

: SCACSearch():

: MpmAddPid(pmq, pids[k]);

: MpmAddSids(pmq, pid_pat_list[pids[k]].sids, pid_pat_list[pids[k]].sids_size);

0.00 : 5670d7: mov (%rbx),%eax

0.00 : 5670d9: mov -0x68(%rbp),%rsi

0.00 : 5670dd: lea (%rax,%rax,2),%rax

0.00 : 5670e1: lea (%rsi,%rax,8),%rax

0.00 : 5670e5: mov 0xc(%rax),%edx

0.01 : 5670e8: mov 0x10(%rax),%r15

: MpmAddSids():

: *

: */

: static inline void

: MpmAddSids(PatternMatcherQueue *pmq, SigIntId *sids, uint32_t sids_size)

: {

: if (sids_size == 0)

0.00 : 5670ec: test %edx,%edx

0.00 : 5670ee: je 566c6b <SCACSearch+0x13b>

: return;

:

: uint32_t new_size = pmq->rule_id_array_cnt + sids_size;

0.00 : 5670f4: mov 0x28(%r12),%esi

0.00 : 5670f9: add %edx,%esi

: if (new_size > pmq->rule_id_array_size) {

0.00 : 5670fb: cmp 0x2c(%r12),%esi

0.00 : 567100: ja 5671e3 <SCACSearch+0x6b3>

: sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;

: }

: }

: SCLogDebug("Adding %u sids", sids_size);

: // Add SIDs for this pattern to the end of the array

: SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;

0.00 : 567106: mov 0x28(%r12),%ecx

0.00 : 56710b: mov 0x20(%r12),%rax

0.00 : 567110: lea (%rax,%rcx,4),%rax

: SigIntId *end = ptr + sids_size;

0.00 : 567114: mov %edx,%ecx

0.00 : 567116: lea (%rax,%rcx,4),%rsi

0.00 : 56711a: nopw 0x0(%rax,%rax,1)

: do {

: *ptr++ = *sids++;

0.00 : 567120: add $0x4,%r15

0.00 : 567124: mov -0x4(%r15),%ecx

0.02 : 567128: add $0x4,%rax

: } while (ptr != end);

0.00 : 56712c: cmp %rax,%rsi

: SCLogDebug("Adding %u sids", sids_size);

: // Add SIDs for this pattern to the end of the array

: SigIntId *ptr = pmq->rule_id_array + pmq->rule_id_array_cnt;

: SigIntId *end = ptr + sids_size;

: do {

: *ptr++ = *sids++;

0.00 : 56712f: mov %ecx,-0x4(%rax)

: } while (ptr != end);

0.00 : 567132: jne 567120 <SCACSearch+0x5f0>

: pmq->rule_id_array_cnt += sids_size;

0.00 : 567134: add %edx,0x28(%r12)

0.00 : 567139: jmpq 566c6b <SCACSearch+0x13b>

0.00 : 56713e: xchg %ax,%ax

: MpmAddPid():

: static inline void

: MpmAddPid(PatternMatcherQueue *pmq, uint32_t patid)

: {

: uint32_t new_size = pmq->pattern_id_array_cnt + 1;

: if (new_size > pmq->pattern_id_array_size) {

: if (MpmAddPidResize(pmq, new_size) == 0)

0.00 : 567140: mov %edx,%esi

0.00 : 567142: mov %r12,%rdi

0.00 : 567145: mov %edx,-0x6c(%rbp)

0.00 : 567148: callq 576250 <MpmAddPidResize>

0.00 : 56714d: mov -0x6c(%rbp),%edx

0.00 : 567150: test %eax,%eax

0.00 : 567152: jne 566fdd <SCACSearch+0x4ad>

0.00 : 567158: jmpq 566fef <SCACSearch+0x4bf>

0.00 : 56715d: nopl (%rax)

0.64 : 567160: mov %r13,%r10

0.00 : 567163: mov -0x78(%rbp),%r13

0.03 : 567167: jmpq 566bd0 <SCACSearch+0xa0>

0.00 : 56716c: nopl 0x0(%rax)

0.00 : 567170: mov %edx,%esi

0.00 : 567172: mov %r12,%rdi

0.00 : 567175: mov %edx,-0x6c(%rbp)

0.00 : 567178: callq 576250 <MpmAddPidResize>

0.00 : 56717d: mov -0x6c(%rbp),%edx

0.00 : 567180: test %eax,%eax

0.00 : 567182: jne 5670c5 <SCACSearch+0x595>

0.00 : 567188: jmpq 5670d7 <SCACSearch+0x5a7>

0.00 : 56718d: nopl (%rax)

: MpmAddSids():

: if (sids_size == 0)

: return;

:

: uint32_t new_size = pmq->rule_id_array_cnt + sids_size;

: if (new_size > pmq->rule_id_array_size) {

: if (MpmAddSidsResize(pmq, new_size) == 0) {

0.00 : 567190: mov %r12,%rdi

0.00 : 567193: mov %edx,-0x6c(%rbp)

0.00 : 567196: callq 575e50 <MpmAddSidsResize>

0.00 : 56719b: mov -0x6c(%rbp),%edx

0.00 : 56719e: test %eax,%eax

0.00 : 5671a0: jne 56701e <SCACSearch+0x4ee>

: // Failed to allocate larger memory for all the SIDS, but

: // keep as many as we can.

: sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;

0.00 : 5671a6: mov 0x2c(%r12),%edx

0.00 : 5671ab: sub 0x28(%r12),%edx

0.00 : 5671b0: jmpq 56701e <SCACSearch+0x4ee>

0.00 : 5671b5: nopl (%rax)

: MpmAddPid():

: static inline void

: MpmAddPid(PatternMatcherQueue *pmq, uint32_t patid)

: {

: uint32_t new_size = pmq->pattern_id_array_cnt + 1;

: if (new_size > pmq->pattern_id_array_size) {

: if (MpmAddPidResize(pmq, new_size) == 0)

0.00 : 5671b8: mov %edx,%esi

0.00 : 5671ba: mov %r12,%rdi

0.00 : 5671bd: mov %r8d,-0x94(%rbp)

0.00 : 5671c4: mov %edx,-0x6c(%rbp)

0.00 : 5671c7: callq 576250 <MpmAddPidResize>

0.00 : 5671cc: mov -0x6c(%rbp),%edx

0.00 : 5671cf: test %eax,%eax

0.00 : 5671d1: mov -0x94(%rbp),%r8d

0.00 : 5671d8: jne 566f38 <SCACSearch+0x408>

0.00 : 5671de: jmpq 566f4a <SCACSearch+0x41a>

: MpmAddSids():

: if (sids_size == 0)

: return;

:

: uint32_t new_size = pmq->rule_id_array_cnt + sids_size;

: if (new_size > pmq->rule_id_array_size) {

: if (MpmAddSidsResize(pmq, new_size) == 0) {

0.00 : 5671e3: mov %r12,%rdi

0.00 : 5671e6: mov %edx,-0x6c(%rbp)

0.00 : 5671e9: callq 575e50 <MpmAddSidsResize>

0.00 : 5671ee: mov -0x6c(%rbp),%edx

0.00 : 5671f1: test %eax,%eax

0.00 : 5671f3: jne 567106 <SCACSearch+0x5d6>

: // Failed to allocate larger memory for all the SIDS, but

: // keep as many as we can.

: sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;

0.00 : 5671f9: mov 0x2c(%r12),%edx

0.00 : 5671fe: sub 0x28(%r12),%edx

0.00 : 567203: jmpq 567106 <SCACSearch+0x5d6>

: SCACSearch():

: uint32_t SCACSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,

: PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen)

: {

: SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx;

: int i = 0;

: int matches = 0;

0.00 : 567208: xor %r14d,%r14d

0.00 : 56720b: jmpq 567071 <SCACSearch+0x541>

: MpmAddPid():

: static inline void

: MpmAddPid(PatternMatcherQueue *pmq, uint32_t patid)

: {

: uint32_t new_size = pmq->pattern_id_array_cnt + 1;

: if (new_size > pmq->pattern_id_array_size) {

: if (MpmAddPidResize(pmq, new_size) == 0)

0.00 : 567210: mov %edx,%esi

0.00 : 567212: mov %r12,%rdi

0.00 : 567215: mov %r8d,-0x94(%rbp)

0.00 : 56721c: mov %edx,-0x6c(%rbp)

0.00 : 56721f: callq 576250 <MpmAddPidResize>

0.00 : 567224: mov -0x6c(%rbp),%edx

0.00 : 567227: test %eax,%eax

0.00 : 567229: mov -0x94(%rbp),%r8d

0.00 : 567230: jne 566d38 <SCACSearch+0x208>

0.00 : 567236: jmpq 566d4a <SCACSearch+0x21a>

: MpmAddSids():

: if (sids_size == 0)

: return;

:

: uint32_t new_size = pmq->rule_id_array_cnt + sids_size;

: if (new_size > pmq->rule_id_array_size) {

: if (MpmAddSidsResize(pmq, new_size) == 0) {

0.00 : 56723b: mov %r12,%rdi

0.00 : 56723e: mov %edx,-0x6c(%rbp)

0.00 : 567241: callq 575e50 <MpmAddSidsResize>

0.00 : 567246: mov -0x6c(%rbp),%edx

0.00 : 567249: test %eax,%eax

0.00 : 56724b: jne 566f6c <SCACSearch+0x43c>

: // Failed to allocate larger memory for all the SIDS, but

: // keep as many as we can.

: sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;

0.00 : 567251: mov 0x2c(%r12),%edx

0.00 : 567256: sub 0x28(%r12),%edx

0.00 : 56725b: jmpq 566f6c <SCACSearch+0x43c>

: if (sids_size == 0)

: return;

:

: uint32_t new_size = pmq->rule_id_array_cnt + sids_size;

: if (new_size > pmq->rule_id_array_size) {

: if (MpmAddSidsResize(pmq, new_size) == 0) {

0.00 : 567260: mov %r12,%rdi

0.00 : 567263: mov %edx,-0x6c(%rbp)

0.00 : 567266: callq 575e50 <MpmAddSidsResize>

0.00 : 56726b: mov -0x6c(%rbp),%edx

0.00 : 56726e: test %eax,%eax

0.00 : 567270: jne 566d6c <SCACSearch+0x23c>

: // Failed to allocate larger memory for all the SIDS, but

: // keep as many as we can.

: sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;

0.00 : 567276: mov 0x2c(%r12),%edx

0.00 : 56727b: sub 0x28(%r12),%edx

0.00 : 567280: jmpq 566d6c <SCACSearch+0x23c>

: _mm_loadu_si128():

: }

:

: extern __inline __m128i __attribute__((__gnu_inline__, __always_inline__, __artificial__))

: _mm_loadu_si128 (__m128i const *__P)

: {

: return (__m128i) __builtin_ia32_loaddqu ((char const *)__P);

0.00 : 567285: vmovdqu (%rdi),%xmm0

: SCMemcmp():

: /* load the buffers into the 128bit vars */

: b1 = _mm_loadu_si128((const __m128i *) s1);

: b2 = _mm_loadu_si128((const __m128i *) s2);

:

: /* do the actual compare */

: m += (r = _mm_cmpestri(b1, n - m, b2, 16,

0.00 : 567289: mov %r11d,%eax

0.00 : 56728c: sub %r10d,%eax

: _mm_cmpestri():

0.00 : 56728f: vpcmpestri $0x38,(%rsi),%xmm0

: SCMemcmp():

0.00 : 567295: movslq %ecx,%rax

: _SIDD_CMP_EQUAL_EACH | _SIDD_MASKED_NEGATIVE_POLARITY));

:

: s1 += 16;

0.00 : 567298: add $0x10,%rdi

: /* load the buffers into the 128bit vars */

: b1 = _mm_loadu_si128((const __m128i *) s1);

: b2 = _mm_loadu_si128((const __m128i *) s2);

:

: /* do the actual compare */

: m += (r = _mm_cmpestri(b1, n - m, b2, 16,

0.00 : 56729c: add %rax,%r10

: _SIDD_CMP_EQUAL_EACH | _SIDD_MASKED_NEGATIVE_POLARITY));

:

: s1 += 16;

: s2 += 16;

0.00 : 56729f: add $0x10,%rsi

: } while (r == 16);

0.00 : 5672a3: cmp $0x10,%ecx

0.00 : 5672a6: je 566cc0 <SCACSearch+0x190>

:

: return ((m == n) ? 0 : 1);

0.00 : 5672ac: xor %eax,%eax

0.00 : 5672ae: cmp %r10,%r9

0.00 : 5672b1: setne %al

0.00 : 5672b4: jmpq 566ce8 <SCACSearch+0x1b8>

0.00 : 5672b9: nopl 0x0(%rax)

: _mm_loadu_si128():

0.00 : 5672c0: vmovdqu (%rdi),%xmm0

: SCMemcmp():

: /* load the buffers into the 128bit vars */

: b1 = _mm_loadu_si128((const __m128i *) s1);

: b2 = _mm_loadu_si128((const __m128i *) s2);

:

: /* do the actual compare */

: m += (r = _mm_cmpestri(b1, n - m, b2, 16,

0.00 : 5672c4: mov %r11d,%eax

0.00 : 5672c7: sub %r10d,%eax

: _mm_cmpestri():

0.00 : 5672ca: vpcmpestri $0x38,(%rsi),%xmm0

: SCMemcmp():

0.00 : 5672d0: movslq %ecx,%rax

: _SIDD_CMP_EQUAL_EACH | _SIDD_MASKED_NEGATIVE_POLARITY));

:

: s1 += 16;

0.00 : 5672d3: add $0x10,%rdi

: /* load the buffers into the 128bit vars */

: b1 = _mm_loadu_si128((const __m128i *) s1);

: b2 = _mm_loadu_si128((const __m128i *) s2);

:

: /* do the actual compare */

: m += (r = _mm_cmpestri(b1, n - m, b2, 16,

0.00 : 5672d7: add %rax,%r10

: _SIDD_CMP_EQUAL_EACH | _SIDD_MASKED_NEGATIVE_POLARITY));

:

: s1 += 16;

: s2 += 16;

0.00 : 5672da: add $0x10,%rsi

: } while (r == 16);

0.00 : 5672de: cmp $0x10,%ecx

0.00 : 5672e1: je 566ec0 <SCACSearch+0x390>

:

: return ((m == n) ? 0 : 1);

0.00 : 5672e7: xor %eax,%eax

0.00 : 5672e9: cmp %r10,%r9

0.00 : 5672ec: setne %al

0.00 : 5672ef: jmpq 566ee8 <SCACSearch+0x3b8>