Regular expression matching method and system for synchronous FPGA-CPU architecture

Abstract

This application relates to a regular expression matching method and system for a synchronous FPGA-CPU architecture. By designing a new regular expression matching architecture based on a synchronous FPGA-CPU architecture, in the regular expression matching processing of a service package, facing the challenge of having to wait for the results to be returned before continuing to send subsequent messages after all data is sent (to the FPGA), by switching threads, the idle time after the data is sent is filled; facing the challenge of only being able to send one message at a time, by parallelizing threads, bandwidth utilization is improved; facing the performance requirement of having to be able to achieve the single-core Gbps level, the data competition and result distribution problems in the parallel process are solved to ensure that the performance requirement is met. In this way, through the improvement of the above architecture and its data interaction process, the regular expression matching performance is greatly improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network data processing and relates to a regular expression matching method and system for a synchronous FPGA-CPU architecture. Background Art

[0002] Deep Packet Inspection (DPI) is one of the most important technologies in network management, network security, and network analysis. DPI systems analyze the metadata and payload within packets to understand what is happening on the network and what users are transmitting. DPI systems are primarily used in intrusion detection (such as detecting attacks, viruses, and data leaks), service quality assurance (such as analyzing network status to adjust management policies), and network service providers (such as enhancing network functionality and providing higher-quality services).

[0003] The DPI system first extracts data from the message (usually in binary form) and then searches for substrings of interest to the user, such as email addresses, names, and phone numbers, based on rules. Finding these substrings in messages is typically accomplished using regular expressions. Regular expression matching is the process of searching for a class of similar text. Users can use established symbols to describe a class of strings and search for them. For example, in (0|[1-9][0-9]*), "|" represents "or," [1-9] represents the nine digits from 1 to 9, and "*" represents any number of repetitions. Therefore, this expression means "find a substring starting with 0 or 1-9 followed by any number of 0-9 digits," meaning it searches for natural numbers in the message.

[0004] DPI systems often include a rule table containing numerous regular expressions. Whenever a packet arrives, the data in the packet is matched against these regular expressions to determine whether it contains sensitive information. In recent years, a significant amount of research has been conducted to improve the performance of regular expression matching. This work can be broadly categorized into two types: software solutions and hardware acceleration. However, these traditional technologies suffer from insufficient performance when applied to regular expression matching in modern network scenarios. Summary of the Invention

[0005] In response to the problems existing in the above-mentioned traditional methods, the present invention proposes a regular expression matching method for a synchronous FPGA-CPU architecture, a regular expression matching system for a synchronous FPGA-CPU architecture, and a computer device, which can significantly improve the regular expression matching performance.

[0006] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0007] On the one hand, a regular expression matching method for a synchronous FPGA-CPU architecture is provided, which is applied to a regular expression matching system for a synchronous FPGA-CPU architecture. The regular expression matching system includes a CPU chip and an FPGA chip that are communicatively connected. The CPU chip includes multiple CPU cores. One CPU core is used to control the regular expression matching processing of a service package. The CPU core schedules each worker thread through an administrator thread to send each message under a service package to the FPGA chip. The administrator thread also distributes the matching results corresponding to each message returned by the FPGA chip to each worker thread. Each worker thread stores a message and the matching result corresponding to the message. The data queue corresponding to the CPU core is stored in the DMA area of ​​the CPU chip. The service package notifies the FPGA chip of data transmission and reception between the data queue and the FPGA chip through memory-mapped I / O technology.

[0008] The regular expression matching method includes the following steps:

[0009] The administrator thread and each worker thread are initialized separately;

[0010] The administrator thread sends a ready instruction to each worker thread, causing each worker thread to start a "send message - collect results" cycle;

[0011] When the status of all worker threads corresponding to a service package is set to "Ended", the administrator thread exits. The "send message - receive result" cycle includes:

[0012] The administrator thread continuously reads the result queue;

[0013] After the worker thread sends a message to the FPGA chip, it begins to prepare to receive the matching result returned by the FPGA chip and sets its own state to standby;

[0014] After the FPGA chip returns the matching result, the administrator thread obtains the thread identity in the matching result and checks whether the worker thread corresponding to the thread identity is in the standby state;

[0015] The administrator thread tells the worker thread to read the matching results when the worker thread is in the standby state, otherwise it waits for the worker thread to be in the standby state;

[0016] The worker thread sets its own status to busy and completes the reading and post-processing of the matching results. The administrator thread prepares for the next data reading.

[0017] On the other hand, a regular expression matching system for a synchronous FPGA-CPU architecture is also provided, comprising a CPU chip and an FPGA chip in communication connection, the CPU chip comprising multiple CPU cores, one CPU core being used to control the regular expression matching processing of a service package, the CPU core scheduling each worker thread through an administrator thread to send each message under a service package to the FPGA chip, and distributing the matching results corresponding to each message returned by the FPGA chip to each worker thread through the administrator thread, one worker thread correspondingly storing one message and the matching result corresponding to the message, the data queue corresponding to the CPU core being stored in the DMA area of ​​the CPU chip, and the service package notifying the FPGA chip of data transmission and reception between the data queue through memory-mapped I / O technology; the regular expression matching system is used to implement the above-mentioned regular expression matching method for the synchronous FPGA-CPU architecture.

[0018] On the other hand, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned regular expression matching method of the synchronous FPGA-CPU architecture when executing the computer program.

[0019] One of the above technical solutions has the following advantages and beneficial effects:

[0020] The above-mentioned regular expression matching method and system for a synchronous FPGA-CPU architecture, by designing a new regular expression matching architecture based on the synchronous FPGA-CPU architecture, addresses the challenge of waiting for the return of results after all data is sent to the FPGA before continuing to send subsequent messages. By switching threads, the system fills the idle time after data is sent. By addressing the challenge of only being able to send one message at a time, the system improves bandwidth utilization through thread parallelization. Furthermore, by addressing the single-core Gbps performance requirement, the system addresses data contention and result distribution issues during the parallel process to ensure that these performance requirements are met. Thus, through improvements to the above-mentioned architecture and its data interaction process, regular expression matching performance is significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the conventional technology, the following briefly introduces the drawings required for use in the embodiments or the conventional technology descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A schematic flow chart of a regular expression matching method for a synchronized FPGA-CPU architecture in one embodiment;

[0023] Figure 2 A schematic diagram of the overall structure of a regular expression matching architecture in one embodiment;

[0024] Figure 3 A schematic diagram of a process in which an administrator thread controls a worker thread to write data in one embodiment;

[0025] Figure 4 is a timing diagram of the interaction process between the administrator thread and the worker thread in one embodiment;

[0026] Figure 5 1 is a flow chart of a coroutine-based interaction process in one embodiment;

[0027] Figure 6 is a flowchart of an optimized interaction process in one embodiment;

[0028] Figure 7 A schematic diagram of the module structure of a regular expression matching system with a synchronized FPGA-CPU architecture in one embodiment. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Unless otherwise defined, all technical and scientific terms used in the present application have the same meaning as those commonly understood by those skilled in the art of the present application. The terms used in the specification of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application.

[0030] It should be noted that the reference to "embodiment" in this application means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The presentation of this phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It will be understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments. The term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0031] DPI systems often contain a rule table containing a large number of regular expressions. Whenever a message arrives, the data in the message is matched one by one with these regular expressions to determine whether the message contains "sensitive information." The matching algorithm for regular expressions is usually completed by converting them into automatic state machines (such as DFA (deterministic finite automaton) and NFA (non-deterministic finite automaton)). The automatic state machine is similar to a flowchart. The matching starts from a certain initial state and transfers to the corresponding subsequent state for different characters in the message. If the process eventually enters the "hit state", it indicates that it meets the description of a regular expression. Otherwise, if the process is terminated midway (there is no subsequent state to transfer to), it indicates that it does not meet any rule description.

[0032] Regular expression matching problems are almost ubiquitous in the network, but the throughput of regular expressions has always been a bottleneck for various traffic analysis systems. The throughput of traditional matching algorithms is already far lower than the processing rate required for current network data transmission. Therefore, in recent years, a lot of work has been done to study how to improve the performance of regular expression matching. These works can be mainly divided into two categories: software solutions and hardware acceleration solutions. Among them, software solutions mainly use pure software algorithms based on CPU (Central Processing Unit). Such algorithms are easy to implement and deploy, but usually have low throughput. Hardware acceleration solutions require additional hardware support. Although they can provide higher throughput, they often have problems such as compatibility with existing systems, difficulty in deployment, and high cost and power consumption. The following are the most advanced regular expression matching solutions, covering the above two types:

[0033] HyperScan—A representative software algorithm, HyperScan implements a high-performance regular expression matching library, primarily designed for high-speed multi-pattern matching. HyperScan can be directly used for network security, log analysis, and other scenarios requiring efficient text search. It offers high scalability and is suitable for multi-core processor environments. Using HyperScan is straightforward: simply install it in your operating system and call the corresponding Application Programming Interface (API) functions.

[0034] NetAcc—As a representative hardware acceleration solution, NetAcc uses an FPGA (Field Programmable Gate Array) to accelerate the matching process. It integrates the state machine into the FPGA, leveraging its high parallelism to achieve high-speed matching. Because of the FPGA's support, NetAcc requires first installing the corresponding board driver and performing certain configurations. Then, data is directly exchanged between the CPU and FPGA to complete the entire matching process. In terms of performance, NetAcc offers significantly higher throughput than HyperScan.

[0035] Current DPI system deployment environments include synchronous and asynchronous logic, such as batch processing and single-pass processing. Synchronous and asynchronous logic are two different forms of data exchange. In synchronous logic, data exchange has a strong correspondence. For example, when module A and module B communicate, the result of A sending information is B returning information. Therefore, the returned information and the sent information have a one-to-one correspondence, and the process of A sending information cannot be completed without B's feedback. The simplest example of synchronous logic is calling a function. A calls a function with parameters and waits for the function to return to obtain the return value.

[0036] In asynchronous logic, data transmission and reception are independent. In this case, A needs to be split into two parts (denoted as As and Ar). As is solely responsible for sending messages. Since there's no need to establish a correspondence and wait for results, As will continuously send messages to B without needing to understand B's current status or the results it returns. Similarly, Ar will continuously receive results (if any). There are clear differences between synchronous and asynchronous logic. Synchronous logic offers the advantage of simple implementation and deployment, while asynchronous logic offers significantly higher performance.

[0037] Batch processing and single-pass processing correspond to two different types of data exchange. Batch processing is typically used in offline mode, where A sends a large batch of messages (e.g., 64) to B simultaneously. This allows for full bandwidth utilization and improved performance. Single-pass processing, on the other hand, is typically used in real-time mode. Due to the sheer volume and high throughput of real-time network traffic, real-time DPI systems are unable to effectively store data. Therefore, every incoming message must be processed immediately and the corresponding results obtained.

[0038] Changing the batch size to 1 in batch processing is not completely equivalent to one-way processing, because one-way processing not only processes one message at a time (that is, it cannot be cached as a batch of messages), but also requires that already processed messages cannot be reprocessed. In batch processing, already processed messages are usually available at any time later.

[0039] In actual applications, it can be found that, on the one hand, many traditional DPI systems are designed based on synchronous logic. That is, in the early stages of development, most DPI systems use a single function interface for regular expression matching. Almost no DPI system implements two different processes to handle sending and receiving respectively, and further completes the association of receiving and sending information. After years of iteration, the most commonly used synchronous DPI systems have reached a considerable level of code size and functional complexity. They may have already been widely deployed in various network scenarios. Therefore, it is almost impossible to radically transform and reapply these DPI systems to adapt to an asynchronous regular expression matching architecture.

[0040] On the other hand, in network traffic analysis, the scenario that truly requires high throughput is real-time traffic processing. This type of task is often highly important and urgent. In an offline environment, packets are readily available, and offline analysis has a high tolerance for latency. However, real-time analysis requires extremely high throughput. Insufficient throughput will directly lead to network service delays or incomplete traffic analysis, which is unacceptable in security analysis and service quality assurance.

[0041] Based on the above two facts, HyperScan, currently the most commonly used software algorithm among traditional software and hardware acceleration solutions, is capable of both offline and real-time analysis. HyperScan's underlying logic is synchronous, making it compatible with most DPI systems. Many mainstream DPI systems still use HyperScan to analyze real-time network traffic. However, even with numerous optimizations to improve its performance, HyperScan's throughput remains at the megabit level. With modern network transmission rates often reaching 10Gbps or even 100Gbps, HyperScan is no longer able to perform complete traffic analysis. NetAcc uses FPGAs as hardware acceleration, significantly increasing the speed of state machine operations. However, packets received from the NIC (network interface card, used in computer devices to receive and pre-process data from the network) still need to be processed by the CPU and the preceding DPI system functions before being sent to the FPGA. The results then need to be returned to the CPU for the DPI system. Therefore, NetAcc's bottleneck lies in the data exchange between the CPU and FPGA. To improve the efficiency of this process, NetAcc chose asynchronous logic and batch processing, achieving performance exceeding 9Gbps ​​per core (35Gbps per quad-core). However, as mentioned earlier, batch processing is only suitable for offline environments, and asynchronous logic is incompatible with most existing DPI systems. Therefore, this performance cannot be used in modern real-world network environments.

[0042] To address the shortcomings of these traditional technologies, the regular expression matching architecture of the present invention utilizes synchronous logic, making it suitable for single-pass processing. After all data is sent (to the FPGA), subsequent messages must wait for the results to be returned before continuing. Only one message can be sent at a time, requiring single-core Gbps performance. To this end, the present invention utilizes thread switching to fill the idle time after data is sent. This allows for increased bandwidth utilization through thread parallelism, addressing data contention and result distribution issues during parallel processes.

[0043] The following describes the embodiments of the present invention in detail with reference to the accompanying drawings.

[0044] In one embodiment, Figure 1 As shown, a regular expression matching method for a synchronous FPGA-CPU architecture is provided. The method is applied to a regular expression matching system for a synchronous FPGA-CPU architecture. The regular expression matching system includes a CPU chip and an FPGA chip in communication with each other. The CPU chip includes multiple CPU cores, each of which is used to control the regular expression matching processing of a service package. The CPU core schedules each worker thread through an administrator thread to send each message under a service package to the FPGA chip. The administrator thread also distributes the matching results corresponding to each message returned by the FPGA chip to each worker thread. Each worker thread stores a message and its corresponding matching result. The data queue corresponding to the CPU core is stored in the DMA area of ​​the CPU chip. The service package notifies the FPGA chip of data transmission and reception between the data queue and the FPGA chip using memory-mapped I / O technology.

[0045] The regular expression matching method may include the following steps:

[0046] S10, the administrator thread and each worker thread are initialized respectively;

[0047] S12: The administrator thread sends a ready instruction to each worker thread, causing each worker thread to start a "send message - collect result" cycle;

[0048] S14: When the status of all worker threads corresponding to a service package is set to end, the administrator thread exits.

[0049] The "send message - retrieve result" cycle includes: the administrator thread continuously reads the result queue; after the worker thread sends a message to the FPGA chip, it starts to prepare to receive the matching result returned by the FPGA chip and sets its own status to standby; after the FPGA chip returns the matching result, the administrator thread obtains the thread identity in the matching result and checks whether the worker thread corresponding to the thread identity is in standby; if the worker thread is in standby, the administrator thread notifies the worker thread to read the matching result, otherwise it waits for the worker thread to be in standby; the worker thread sets its own status to busy and completes the reading and post-processing of the matching result, and the administrator thread prepares for the next data reading.

[0050] It can be understood that the overall structural design of the regular expression matching architecture is as follows Figure 2 As shown, the concept of service bundle is first introduced. A service bundle represents multiple interfaces that provide matching services to the upper layer. For example, a bundle can include 4 interfaces, which provide API functions to 4 network cards or 4 upper-layer applications respectively, receive regular expression matching requests from them, and return corresponding matching results. Parallel units refer to the parallelism implemented by the computer (operating system). The most common parallel unit is a thread. In addition, this embodiment will also use coroutines for parallelism. The relationship between parallel units and service bundles: one CPU core controls one data queue, and one service bundle also corresponds to one data queue. Therefore, one CPU core controls one service bundle. Parallel units exist in a service bundle, and parallel units of the same service bundle compete for the data queue under the service bundle. There is no competitive relationship between different service bundles (between different CPU cores), and they are independent of each other.

[0051] Figure 2 The left side shows the data interaction process of a single service package. Each parallel unit processes data from one interface. Data is written to the same queue ( Figure 2 The data is then transferred to the FPGA, causing data contention between parallel units within the same service package. After the FPGA completes the matching, the returned results are written back to the ring queue. It's important to note that the order of the upstream results differs from the downstream data because the time required to match different packets varies significantly. Therefore, the challenge in designing service packages lies in how to handle data contention and result distribution.

[0052] Figure 2The right side of the figure shows a complete workflow (requiring two CPU cores) involving two service packages (e.g., Package A and Package B). Each service package independently executes the data exchange process. Data queues (Rings, such as A and B) are stored in the DMA (Direct Memory Access) area. After downlink data is written to the ring queues, the service package uses memory-mapped I / O (MMIO) technology to overwrite registers on the FPGA, informing it to begin receiving data using the PCI-E bus. Similarly, by observing changes in the FPGA registers, the ring queues retrieve the results from the PCI-E bus.

[0053] In the above architecture, there are two key issues: how to resolve contention between different parallel units when sending messages, and how to resolve the distribution of returned results when collecting them. Regarding how to resolve contention between different parallel units when sending messages, it has the following characteristics: the arrival time of data cannot be determined, and the matching process must be precise and error-free. To this end, this embodiment adds an additional "manager thread" to schedule other "worker threads."

[0054] When returning matching results, the issue of distributing them arises. The same message can have multiple hits, resulting in more than one matching result. Furthermore, the complexity of matching different message contents within the FPGA varies. Therefore, the matching results returned by the FPGA often do not maintain the order in which the service packet sent them, and matching results for the same message may be scattered and continuous. Therefore, this embodiment utilizes an "administrator thread" to distribute these matching results.

[0055] The advantage of using a manager thread is that it has minimal work and doesn't consume excessive resources, while allowing for flexible and orderly scheduling of worker threads. The manager thread directly reads the ID (identity identifier) ​​contained in the matching result and then notifies the corresponding worker thread to read the matching result, requiring only two memory accesses. If worker threads take turns reading the ID, this often requires more than two memory accesses.

[0056] When sending messages, the administrator thread is mainly responsible for avoiding competition problems. The core is to ensure that only one parallel unit writes to the data queue at a time, and the opportunities and frequencies of writing to all parallel units should be consistent. To this end, this embodiment uses a polling queue to manage data writing. The specific working principle is as follows Figure 3As shown, threads 1-4 are worker threads, and the administrator thread will allow each thread to write to the queue in a preset order. The preset order includes: thread ID ascending / descending order, the time order of the thread's write request, and the priority order set by the user based on the importance of the service provided by the service package. Figure 3 Polling queue) and time order ( Figure 3 The timing queue in ) can ensure that the resources of all worker threads are evenly distributed, and according to the priority order, important services can be given priority. Figure 3 In the first round of polling, no message has arrived for thread 3, so only threads 1, 2, and 4 participate in the polling. In the second round, thread 3 participates in the polling.

[0057] When the matching results are recovered, they will be (considered to be) out of order and rewritten to the data queue. The administrator thread will read the ID number of each matching result from the head of the queue and then notify the corresponding worker thread to obtain the matching results.

[0058] Specifically, the interaction process between the administrator thread and a single worker thread is as follows Figure 4 As shown, a straight solid arrow line represents thread communication, a straight dashed arrow line represents protocol interaction, a short double slash represents scheduling, and a curved solid arrow line and a broken dashed arrow line represent loops. Figure 4 In this process, the administrator thread and worker thread each perform their own initialization (including creating and opening data queues and binding to CPU cores). The administrator thread then sends a "ready" command to the worker thread, initiating a "send message - retrieve result" loop, while the administrator thread continuously reads the result queue. After the worker thread finishes sending its message packet, it prepares to receive the matching result data structure (ready to receive) and sets its own status to "standby." When the FPGA returns a matching result, the administrator thread first obtains the thread identification (ID) number from the matching result (read ID) and checks whether the corresponding worker thread is in the "standby" state (check ID). A worker thread that is not in the standby state may still be processing the previous matching result or sending a new message and is temporarily unable to retrieve the current matching result. Once the worker thread is ready, the administrator thread tells it the location to read (write offset, transmit). At this point, the worker thread sets its status to "busy" and completes subsequent matching result processing (such as reading the data queue, editing the write pointer / registering, and post-processing), while the administrator thread prepares for the next read (editing the read pointer). When a worker thread is closed (that is, the interface in the corresponding service package is closed), its status is set to "end". When all interfaces in a service package are stopped, the administrator thread exits (check the number of worker threads).

[0059] The above-mentioned regular expression matching method for a synchronous FPGA-CPU architecture, by designing a new regular expression matching architecture based on the synchronous FPGA-CPU architecture, addresses the challenge of waiting for the results to be returned before continuing to send subsequent messages after all data is sent to the FPGA. Thread switching is used to fill the idle time after data is sent. Furthermore, the challenge of only being able to send one message at a time is addressed by parallelizing threads to improve bandwidth utilization. Furthermore, the requirement of single-core Gbps performance is addressed by resolving data contention and result distribution issues during parallel processing to ensure that this performance requirement is met. Thus, through improvements to this architecture and its data interaction process, regular expression matching performance is significantly improved.

[0060] In one embodiment, the regular expression matching method for the synchronous FPGA-CPU architecture may further include the following steps:

[0061] The administrator thread exits if it fails to successfully read data within a set long period of time.

[0062] It is understandable that in order to prevent the administrator thread from an infinite loop, the administrator thread is allowed to exit at the end of the above process or when it fails to read data successfully for a long time.

[0063] In one embodiment, the regular expression matching method for the synchronous FPGA-CPU architecture may further include the following steps:

[0064] Switch the administrator thread in the regular expression matching system to the administrator coroutine, and switch each worker thread to a worker coroutine.

[0065] It is understandable that thread switching requires entering kernel state and completing corresponding on-site save and restore operations, which will reduce performance. Therefore, further, this embodiment can also use coroutines as parallel units to implement the above-mentioned interactive process. Unlike threads, coroutines are parallel units that are completely controlled by developers, such as Figure 5 The left figure shows the execution of a thread. The double slash indicates that the thread is blocked at that point, thus interrupting the interaction between the two and requiring more resources to switch to other interactive processes. The coroutine interaction shown on the right does not have this problem. The solid line represents the actual program execution path, and the dashed double slash indicates the abstract blocking point. When the coroutine reaches the abstract blocking point, it returns to the calling point and continues the work of the manager coroutine until the blocking condition is resolved. In fact, if the entire process is properly configured by the developer, there will be no blocking.

[0066] A coroutine can be thought of as an interruptible function call. Therefore, in practice, the interaction between a manager coroutine and a worker coroutine can be viewed as the manager coroutine calling a worker coroutine function. When a worker coroutine finishes sending a message or becomes busy, the function saves its fields on the stack and temporarily returns to the call point. Once the manager coroutine receives the result, it can reactivate any previously suspended worker coroutine functions based on their IDs. When a worker coroutine has transmitted all messages or is terminated by the user, the function returns normally. Similarly, the manager coroutine terminates after all worker coroutine functions return.

[0067] The advantage of coroutines is their high performance, but not all DPI systems can support coroutine parallelism, and the popularity and development maturity of coroutine libraries are far less than those of threads. Therefore, both can be used as alternative options in this embodiment.

[0068] Since the scenario targeted by the present invention is one-way real-time processing of synchronous logic, the following three optimizations are also performed based on this premise.

[0069] In one embodiment, while the manager thread is waiting for a worker thread to enter a standby state, it allows another worker thread waiting to send a message to jump in and transmit a message. If there is no worker thread waiting to send a message, a set number of matching results ranked high in the matching result queue in the data queue are reordered.

[0070] It can be understood that the first optimization is to reduce the waiting time (idle time): As mentioned earlier, if a worker thread is still processing the previous matching result, and the next matching result obtained by the administrator thread still belongs to this thread, it must wait for it to finish processing the previous matching result. It has been observed that in real traffic, consecutive matching results with the same ID are often sent back by the FPGA. At this time, a thread that is waiting to send a message is allowed to jump the queue and transmit a message, which increases the diversity of the returned results. If there is no waiting thread, then this time will be used to reorder the set number of matching results ranked at the top of the result queue to disperse the matching results with the same ID, and to ensure that waiting will not occur again in the next period of time. The specific value of the set number can be set according to the actual application needs, as long as the required dispersion effect mentioned above can be achieved.

[0071] In one embodiment, when the manager thread continuously reads the result queue, if the result queue is empty, the manager thread is suspended until at least one worker thread obtains the mutex, and then resumes reading the result queue.

[0072] As you can understand, another waiting period occurs shortly after system startup: the first batch of messages has been sent to the FPGA, but no matching results have been received. During the time between a worker thread sending a message and the FPGA returning a matching result, any attempt to read data from the queue will repeatedly fail, wasting resources. Furthermore, the CPU may allocate a large number of time slices to the manager thread to perform a large number of read operations, causing threads that haven't yet started sending messages to be unable to send messages in a timely manner, resulting in significant startup delays. To address this, the solution is: if the read queue is empty, the manager thread is suspended until at least one worker thread acquires the mutex (that is, after the worker thread sends a message, the FPGA returns a matching result in the result queue). Conversely, once all worker threads have delivered their first message, the manager thread will resume checking the queue after a short interval. This mechanism is also effective for later matching processes, as there is a certain probability that the queue for returning matching results will be empty due to a period of low message density.

[0073] In one embodiment, the regular expression matching method for the synchronous FPGA-CPU architecture may further include the following steps:

[0074] The supervisor thread maintains a timer and checks the timer after editing the read pointer. When the timer counts the CPU time slice of the CPU core and reaches a specific threshold, it notifies to update the register in the FPGA chip and reset the timer.

[0075] It can be understood that the second optimization is the MMIO register modification strategy optimization: according to the overall architecture, after a message is stored in the DMA memory, the CPU will send a notification to the FPGA through MMIO. Under asynchronous logic, a direct corresponding method is that the worker thread modifies the FPGA register to notify it of the reception after writing the message to the DMA. However, in synchronous logic, the PCI-E at this time only transmits one message at a time. Therefore, in order to improve bandwidth utilization, a timer is introduced in this embodiment and maintained by the administrator thread. To this end, certain modifications need to be made to the interaction process, such as Figure 6 shown.

[0076] As interactions progress, the CPU time slice count increases. Once the timer reaches a specific threshold, the supervisory thread updates registers in the hardware device and resets the timer. It's important to note that increasing the number of CPU time slices is independent of the current thread's working state. Even if all service threads are inactive, the CPU time slice count still increases. When there are many service threads, setting an appropriate threshold can improve bandwidth utilization, allowing messages from multiple service threads to be sent simultaneously within a short period of time (reducing the amount of time waiting for PCI-E idle time). When there are few messages to match, the time slice count increases normally, allowing the matching task to complete without having to wait for a certain number of messages before transmission. This also reduces the frequency of FPGA register modifications, helping prevent device operation overflow and thus conserving hardware resources.

[0077] The third optimization is memory allocation: messages to be sent are typically placed in a DMA area and retrieved directly by the hardware device. In existing matching architectures, each thread provides multiple messages at a time (i.e., batch processing), and the capacity of the DMA area is often insufficient to allocate sufficient data for all threads. Therefore, they often need to share the DMA area. That is, when a thread needs to transfer data, the existing data is written back to the memory, and the space is then given to the thread to write. This incurs memory management and data transfer overhead.

[0078] Under synchronous logic, each thread only needs to store one message and its corresponding matching result. Only after the message matching process is completed will the next message be written. To optimize efficiency, the DMA area will no longer be shared, but directly allocated to each thread. That is, the DMA area is evenly divided into several equal parts, and each thread receives one part, eliminating the need for write-back and data switching. In most cases, the space in the DMA area is sufficient to store these messages, thus significantly improving the efficiency of data preparation.

[0079] In some embodiments, a large number of experiments have shown that the new architecture proposed in this article is compatible with almost all existing DPI systems. For users, they only need to call a function interface downward to complete all matching operations and finally obtain the matching results in the form of return values. In summary: the new architecture proposed in this article is compatible with existing synchronous logic DPI systems and can be applied to real-time traffic analysis. It is an important breakthrough in the practicality and compatibility of existing regular expression matching architectures. The throughput can reach 3-4Gbps in single-core mode and 10Gbps in multi-core mode, which can cope with common network scenarios today. This performance is more than 10 times that of the most advanced software algorithms available, and is on the same order of magnitude as the existing asynchronous batch processing architecture. The performance of directly applying the existing asynchronous batch processing architecture to real-time one-way network scenarios for traffic analysis is less than 40Mbps, while this article improves this performance by about 100 times.

[0080] It should be understood that although the above process Figure 1 The steps in the flowchart are shown in the order indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this application, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0081] In one embodiment, Figure 7 As shown, a regular expression matching system 100 for a synchronous FPGA-CPU architecture is also provided, comprising a CPU chip 101 and an FPGA chip 102 in communication connection. The CPU chip comprises multiple CPU cores, one of which is used to control the regular expression matching processing of a service package. The CPU core dispatches each worker thread through an administrator thread to send each message under a service package to the FPGA chip, and distributes the matching results corresponding to each message returned by the FPGA chip to each worker thread through the administrator thread. A worker thread stores a message and the matching results corresponding to the message. The data queue corresponding to the CPU core is stored in the DMA area of ​​the CPU chip. The service package notifies the FPGA chip of the data transmission and reception between the data queue and the FPGA chip through memory-mapped I / O technology. The regular expression matching system 100 is used to implement the above-mentioned regular expression matching method for a synchronous FPGA-CPU architecture.

[0082] The regular expression matching system 100 based on the synchronous FPGA-CPU architecture, by designing a new regular expression matching architecture based on the synchronous FPGA-CPU architecture, addresses the challenge of waiting for the results to be returned before continuing to send subsequent messages after all data is sent (to the FPGA) by switching threads to fill the idle time after data is sent. It also addresses the challenge of only being able to send one message at a time by parallelizing threads to improve bandwidth utilization. Furthermore, it addresses the requirement of single-core Gbps performance by resolving data contention and result distribution issues during parallel processing to ensure that such performance requirements are met. Thus, through improvements to the above architecture and its data interaction process, regular expression matching performance is significantly improved.

[0083] It can be understood that the explanation of each feature in each embodiment of the regular expression matching system 100 of the synchronous FPGA-CPU architecture can be understood by referring to the explanation of the corresponding features of each embodiment of the regular expression matching method of the synchronous FPGA-CPU architecture above, and no further details will be given here. The various thread function modules in the regular expression matching system 100 of the synchronous FPGA-CPU architecture can be implemented in whole or in part by software, hardware, and a combination thereof. The above modules can be embedded in or independent of the above chip in hardware form, or can be stored in software form on the aforementioned chip or in a memory connected thereto, so that the processor can call and execute the operations corresponding to the above thread modules.

[0084] In one embodiment, a computer device is provided, comprising a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the following processing steps are implemented: the administrator thread and each worker thread are initialized; the administrator thread sends a ready instruction to each worker thread, causing each worker thread to begin a "send message - retrieve result" cycle; and when the status of all worker threads corresponding to a service package is set to "end", the administrator thread exits. The "send message - retrieve result" cycle includes: the administrator thread continuously reads the result queue; after the worker thread sends a message to the FPGA chip, it prepares to receive the matching result returned by the FPGA chip and sets its own status to a standby state; after the FPGA chip returns the matching result, the administrator thread obtains the thread identity in the matching result and checks whether the worker thread corresponding to the thread identity is in a standby state; if the worker thread is in a standby state, the administrator thread notifies the worker thread to read the matching result, otherwise it waits for the worker thread to enter a standby state; the worker thread sets its own status to a busy state, completes reading and post-processing the matching result, and the administrator thread prepares for the next data read.

[0085] It can be understood that in addition to the memory and processor mentioned above, the above-mentioned computer device may also include other software and hardware components not listed in this specification. The specific components can be determined according to the model of the specific network data processing device in different application scenarios. This specification will not list them one by one in detail.

[0086] In one embodiment, when executing the computer program, the processor may further implement the additional steps or sub-steps in each embodiment of the regular expression matching method for the synchronous FPGA-CPU architecture.

[0087] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus dynamic random access memory (Rambus DRAM, referred to as RDRAM) and interface dynamic random access memory (DRDRAM).

[0088] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above embodiments only express several implementation methods of the present application. The description is relatively specific and detailed, but it cannot be understood as a limitation on the scope of protection of the invention. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several variations and improvements can be made, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be based on the attached claims.

Claims

1. A regular expression matching method for a synchronous FPGA-CPU architecture, characterized in that: A regular expression matching system for a synchronous FPGA-CPU architecture includes a CPU chip and an FPGA chip in communication with each other. The CPU chip includes multiple CPU cores. One CPU core is used to control regular expression matching processing for a service package. The CPU core schedules worker threads through an administrator thread to send messages under a service package to the FPGA chip. The administrator thread also distributes matching results corresponding to messages returned by the FPGA chip to the worker threads. Each worker thread stores a message and its corresponding matching result. A data queue corresponding to the CPU core is stored in a DMA area of ​​the CPU chip. The service package notifies the FPGA chip of data transmission and reception between the data queue and the FPGA chip through memory-mapped I / O technology. The regular expression matching method comprises the steps of: The administrator thread and each of the worker threads are initialized respectively; The administrator thread sends a ready instruction to each worker thread, so that each worker thread starts a "send message-recover result" cycle; When the status of all worker threads corresponding to a service package is set to end, the administrator thread exits; wherein the "send message - receive result" cycle process includes: The administrator thread continuously reads the result queue; After the worker thread sends a message to the FPGA chip, it starts preparing to receive the matching result returned by the FPGA chip and sets its own state to standby state; After the FPGA chip returns a matching result, the administrator thread obtains the thread identity in the matching result and checks whether the worker thread corresponding to the thread identity is in a standby state; The administrator thread notifies the worker thread to read the matching result when the worker thread is in a standby state, otherwise waits for the worker thread to be in a standby state; The worker thread sets its own state to busy and completes the reading and post-processing of the matching results, and the administrator thread prepares for the next data reading.

2. The regular expression matching method for synchronous FPGA-CPU architecture according to claim 1, characterized in that: Also includes the steps: The administrator thread exits when it fails to successfully read data within a set long period of time.

3. The regular expression matching method for synchronous FPGA-CPU architecture according to claim 1, characterized in that: The administrator thread allows another worker thread that is waiting to send a message to jump in line and transmit a message while waiting for the worker thread to be in a standby state; If there is no worker thread waiting to send a message, a set number of matching results that are ranked high in the matching result queue in the data queue are reordered.

4. The regular expression matching method for a synchronous FPGA-CPU architecture according to any one of claims 1 to 3, characterized in that: During the process of the administrator thread continuously reading the result queue, if the result queue is empty, the administrator thread is suspended until at least one worker thread obtains the mutex, and then resumes reading the result queue.

5. The regular expression matching method for synchronous FPGA-CPU architecture according to claim 4, characterized in that: Also includes the steps: The administrator thread maintains a timer and checks the timer after editing the read pointer. When the timer counts the CPU time slice of the CPU core to a specific threshold, it notifies to update the register in the FPGA chip and reset the timer.

6. The regular expression matching method for synchronous FPGA-CPU architecture according to claim 4, characterized in that: Also includes the steps: The administrator thread in the regular expression matching system is switched to an administrator coroutine, and each of the worker threads is switched to a worker coroutine.

7. A regular expression matching system for a synchronous FPGA-CPU architecture, characterized in that: It comprises a CPU chip and an FPGA chip that are communicatively connected, the CPU chip comprising multiple CPU cores, one of the CPU cores being used to control the regular expression matching processing of a service package, the CPU core scheduling each worker thread through an administrator thread to send each message under a service package to the FPGA chip, and distributing the matching results corresponding to each message returned by the FPGA chip to each worker thread through the administrator thread, each worker thread correspondingly storing a message and the matching result corresponding to the message, the data queue corresponding to the CPU core being stored in the DMA area of ​​the CPU chip, the service package notifying the FPGA chip of data transmission and reception with the data queue through memory-mapped I / O technology; the regular expression matching system being used to implement the regular expression matching method for a synchronous FPGA-CPU architecture as described in any one of claims 1 to 6.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the regular expression matching method for the synchronous FPGA-CPU architecture according to any one of claims 1 to 6 are implemented.

Images