Introduction

This document describes how to install and compile Hyperscan based on the Kunpeng 920 processor and openEuler.

Hyperscan is a high-performance regular expression matching library. It is developed based on Perl Compatible Regular Expressions (PCRE) and is open-source under the Berkeley Software Distribution (BSD) license. It follows the regular expression syntax of the commonly used libpcre library but has its own C interfaces. Based on the official Hyperscan release and Kunpeng microarchitecture, the implementation mechanism of core interfaces is redesigned, the development and performance are optimized, and the software package suitable for the Kunpeng platform is released. Users of the Kunpeng platform can download this software package based on their service requirements to improve the stability and performance of services on the Kunpeng platform.

The following functions are added to the Hyperscan version dedicated for the Kunpeng platform:

• The Kunpeng platform branch fully compatible with Armv8-A is added. In addition, its use on the x86 platform is not affected.
• NEON instruction, inline assembly, data alignment, instruction alignment, memory prefetch, static branch prediction, and adjusted code structure are used to improve the performance on the Kunpeng platform.
• The Kunpeng Hyperscan Enhanced Library (KHSEL) is released. It includes the KHSEL_ops and KHSEL_core sub-libraries, a hybrid model with a short-rule bypass, and a false-positive blocking model.
  • KHSEL_ops provides the ReplaceAllAcc function, which accelerates the ReplaceAll function of the C++ standard library in a fixed rule. The optimization effect can be obtained on Kunpeng 920 series processors.
  • KHSEL_core optimizes the large-pattern matching algorithm FDR, small-pattern quick matching algorithm Shufti, and long-rule verification, and enhances the scan performance of Hyperscan for processing datasets such as snort_literal and snort_pcre.
  • The hybrid model with a short-rule bypass significantly improves the matching performance for rule sets containing short rules.
  • The false-positive blocking model greatly improves the matching performance for rule sets that contain bad string fragments. "Bad strings" refer to a small number of rules with special fragments, causing excessive false positives in multi-pattern matching. This triggers a large number of interpreter calls and inefficient long-rule verification, but yields zero true matches. These unnecessary interpreter calls become computing hotspots, undermining the pre-filtering capability of multi-pattern matching.

For more information about Hyperscan, visit the Kunpeng repository on GitCode.