Field of the Invention
This invention relates generally to the field of data processing systems. More particularly, the invention relates to a method and apparatus for performing complex regular expression pattern matching utilizing a hardware filter based on truncated deterministic finite automata.
Description of Related Art
The ability to spot existing or emerging patterns is one of the most critical skills in intelligent decision making. Such skill is more vital in today's technology than ever before. Pattern matching constitutes one of the most power and performance critical operations in applications such as antivirus scanner (AVS), database search, information extraction, and network intrusion detection (NIDS). The increase in network intrusions, virus attacks, and data analysis requirements have prompted a need for matching large numbers of complex and sophisticated patterns with high throughput and accuracy. One solution to address this problem is to represent patterns as complex regular expression (regex) based strings. The expressiveness, flexibility and compactness of regex patterns provide additional syntactic context to further sharpen textual searches. However, performing regex pattern matching in a general purpose microprocessors is computationally intensive and requires significant memory and CPU cycles. For example, regex based virus signatures in ClamAV (an open-source antivirus application) constitute only 2% of the total virus database and yet consume over 71% of the total search time. Although many pattern matching hardware have been proposed in the past, they are, however, typically limited to implementations of simple fixed string with basic regex patterns or exact match hardware that require significant Si area and processing complexity. A dedicated energy efficient hardware filter can offload these types of resource-intensive computation from the general purpose microprocessor while providing the desired high throughput.
A better understanding of the present invention can be obtained from the following detailed description in conjunction with the following drawings, in which:
Described below are embodiments of apparatus and method for performing complex regex pattern matching utilizing a hardware filter based on truncated Deterministic Finite Automata (“DFA”). Throughout the description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without some of these specific details. In other instances, well-known structures and devices are not shown or are shown in a block diagram form to avoid obscuring the underlying principles of the present invention.
Reference throughout this specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, the appearances of the phrases “in one embodiment” or “in an embodiment” in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.
For clarity, individual components in the Figures herein may also be referred to by their labels in the Figures, rather than by a particular reference number. Additionally, reference numbers referring to a particular type of component (as opposed to a particular component) may be shown with a reference number followed by “(typ)” meaning “typical.” It will be understood that the configuration of these components will be typical of similar components that may exist but are not shown in the drawing Figures for simplicity and clarity or otherwise similar components that are not labeled with separate reference numbers. Conversely, “(typ)” is not to be construed as meaning the component, element, etc. is typically used for its disclosed function, implement, purpose, etc.
A deterministic finite automaton (“DFA”)—also known as deterministic finite state machine—is a finite state machine that accepts/rejects finite strings of symbols and only produce a unique computation (or run) of the automaton for each input string. “Deterministic” refers to the uniqueness of the computation. Although a DFA is defined as an abstract mathematical concept, due to the deterministic nature of a DFA, it is implementable in hardware and software for solving various specific problems, including complex regular expression (“regex”) pattern matching.
As mentioned above, complex patterns may be represented as complex regex based strings. These regex based strings, in turn, may be represented as DFAs with O(1) processing complexity and O(2m) storage complexity, where m is the number of characters in the regex string. Moreover, k number of regex patterns can be merged into a single DFA with a maximum storage requirement of O(2mk). Implementing a full DFA in hardware for exact pattern match is very costly in terms of memory storage and processor cycle. The present invention solves this problem by taking into account various unique characteristics of the DFA to generate a hardware filter that is both area and power efficient.
To illustrate, input string “ABC123” is passed through DFA 100. Starting from state S0, a transition arrow 106 labeled “A-Z” points from S0 to S1. This means that upon reading any uppercase alphabet, DFA 100 would jump deterministically from state S0 to state S1. Conversely, if the character read is not an uppercase alphabet (i.e., lowercase alphabet, number, or symbol), then it would not be a match for transition arrow 106 and the DFA 100 would remain in state S0. With respect to input string “ABC123”, since the first character “A” is an uppercase alphabet, DFA 100 follows the transition arrow 106 and deterministically jumps from state S0 to state S1. Next, from state S1, DFA 100 processes the second character, “B”, from input string “ABC123”. The only transition arrow at state S1 that matches the input character “B” is arrow 108 labeled “A-Z” that loops from S1 back to S1. This means the next state is same as the current state and DFA 100 remains in state S1. From there, DFA 100 reads from the input string the third character, “C”, which again matches the transition arrow 108 that loops from S1 back to S1. The fourth character, “1”, does not match any transition arrow going out of state S1 and therefore, DFA 100 returns to the starting state S0. The fifth and sixth characters of the input string, “2” and “3” respectively, are not alphabets and therefore do not match any transition arrow going out of state S0. As such, DFA 100 remains in state S0. At this point, there are no more characters left in the input string and DFA 100 has yet to reach an acceptable state (e.g., state S4). This means input string “ABC123” is not a match for DFA 100.
To illustrate reaching an acceptable state, string “XYZ246” is passed through DFA 100. From starting state S0, the first character in the input string, “X”, is an uppercase alphabet matching transition arrow 106. Accordingly, DFA 100 jumps from state S0 to state S1 through the transition arrow 106. The second character, “Y”, matches the transition arrow 108 at state S1 which loops from state S1 back to S1 again. The same goes for the third character, “Z” and thus DFA 100 remains in state S1. The fourth character, “2”, matches transition arrow 110 and thus DFA 100 jumps from state S1 to S2. The fifth character, “4”, is a number between 0 and 9 and thus matches transition arrow 112 between states S2 and S3. Accordingly, DFA 100 jumps from S2 to S3. The sixth and final character, “6”, matches the transition arrow 116 leading from state S3 to S4 because 6 is a number between 0 and 9. Following transition arrow 116, DFA 100 arrives at state S4, which is an acceptable state denoted the double circle. By reaching an acceptable state in DFA 100, input string “XYZ246” is deemed a successful match.
In most cases, accesses to a DFA typically do not extend beyond the first few states. In the two examples illustrated above, the sequence of states in DFA 100 accessed by input string “ABC123” was S0→S1→S1→S1→S0→S0→S0. Thus input string “ABC123” did not access any state beyond the first two states. As for input string “XYZ246”, the sequence of states accessed was S0→S1→S1→S1→S2→S3→S4. Thus, while states S2-S4 were eventually accessed by input string “XYZ246”, states S0 and S1 represent the majority of all the states accessed in DFA 100. Various simulations confirm this notion.
Strings that are matched in the Partial Pattern Match Module 204 and identified as potential threats are then passed through the Exact Pattern Matching Module 206. Exact Pattern Matching Module 206 can be implemented in hardware, software, or a combination both. Since the search space has been filtered by the Partial Pattern Matching Module 204, the number of strings to pass through Exact Pattern Matching Module 206 is greatly reduced. This minimizes the work needed to be done by the resource-intensive Exact Pattern Matching Module 206.
According to one embodiment, the partial pattern matching module 204 utilizes a filter based on truncating DFAs at a fixed depth. For example, DFA 102, shown in
In another embodiment, the partial pattern matching module 204 utilizes a filter created by probability-based truncating. The probability referred to here is the probability for reaching each state in a DFA. Referring to
From S1, there are two possible next states—S2 and S3. To get from S1 to S2, the character “2” is required from the input string. Again, in an 8-bit ASCII scheme, the chance for a given character read from the input string being the number “2” is 1 out of 256, or 1/256. Together, the total probability of reaching S2 from S0 is the product of the probability of reaching S1 from S0 (i.e. 1/256) and the probability of reaching S2 from S1 (i.e. 1/256). As such, the probability of reaching S2 from S0 is (1/256)2, as denoted by P˜(1/256)2 above S2.
On the other hand, to get to S3 from S1, an uppercase alphabet is required from the input string. In an 8-bit ASCII scheme, the probability for a character being 1 of 26 uppercase alphabets is 26/256 (i.e., 1/256 for each alphabet multiplied by 26 alphabets). Putting it all together, the probability of reaching S3 to S0 is (1/256)*(26/256), or simply 26*(1/256)2 as denoted by P˜26*(1/256)2 under S3.
Next, to reach S4 from S3, a lowercase character “c” is required from the input string. Using similar logic and calculation as before, the probability for DFA 300 reaching S4 from S3 is 1 out of 256 or 1/256. The total probability of reaching S4 from S0 is the product of the probabilities of going from S0 to S1, S1 to S3, and S3 to S4, which is (1/256)*(26/256)*(1/256), or simply 26*(1/256)3 as denoted by P˜26*(1/256)3
To truncate a DFA based on probability, a threshold probability is first selected and then any state that has a probability lower than the threshold probability is removed from the DFA. The result is a truncated version of the original DFA. For instance, in
Besides truncating the reference DFA, the footprint of a DFA-based filter may further be optimized by removing redundancy. Since a matching pattern can start from any character in a string, a new check is performed on each character of the input string. This means every character is run through the DFA at least once beginning at S0 to see if it starts a possible match. Due to this continuous prefix evaluation for checking the start of a match, all transitions leading to a particular state tend to check for the same character or character class/range. This property is especially true for early states, such as those in a truncated DFA. For example, in
Moreover, to reduce memory size required for storing the truncated DFA, a more efficient way of representing DFA is adopted. In one embodiment, the DFA is broken down and stored as state-transition (ST) pairs. According to the embodiment, a truncated DFA filter is implemented by storing the transition value and the next state address of every transition originating from a state in a single row of a memory.
According to the embodiment illustrated in
In operation, according to an embodiment, the DFA is traversed by reading a state row from STA which can contain up-to 4 STTR read addresses. Thus, to processes the 4 STTR read addresses simultaneously, the STTR is designed with 4 read ports. As illustrated in
As mentioned above, in a typical truncated DFA, due to continuous prefix checking, some state-transition pairs are common to many of the states. In one embodiment, a parallel comparator (PCMP) unit comprising 12 parallel range comparators is implemented. Each parallel range comparator contains pre-stored common transitions (character ranges) to compare against the incoming text characters for all the states. In conjunction, the STA stores 12 enable bits per state (PCMPEn) to indicate which of the common state-transition pairs are valid for each given state. The results of 12 parallel comparators are gated with the 12 PCMPEn bits to generate final PCMP match and to determine the corresponding next state STA address. The implementation of PCMP unit reduces the number of STA entries needed for storing whole DFA filter as well as the average number of cycles needed to traverse a state. This optimization results in additional 30% reduction in storage cost and 4× improvement in throughput. All hardware architecture optimizations (isolating unique state-transition pairs, parallel detection of common transitions and empty transitions support) based on key DFA characteristics improve the area-efficiency of the DFA filter by 70%.
In one embodiment, the results from TCMP and PCMP are combined to form a match. Then the state address corresponding to the match is selected as new state address. However, if no match was found by both TCMP and PCMP, the empty transition bit is examined. If the empty transition bit is one, the previous STA address is incremented by one and set as the new state address. If empty transition bit is zero, then the matching process starts over with state zero address set for the next text character. This next character address is stored as initial scan address (character address starting from state zero) for current scan. In this design the leaf nodes of truncated DFA (representing positive) is also stored as address of state zero. Hence if there is a match and next state address is state zero this represents a true/false positive match. For these positive matches the initial scan address for current scan (stored earlier) are recorded which later used/handled by exact match software. The initial scan address enables software to start from state zero at this character address allowing hardware independent exact match software implementation with choice of any optimization algorithm. The whole dataset can either be divided into three sets or 3 independent datasets can run in parallel to fill the pipeline and hide 3 cycle latency.
In
The front end hardware 1230 includes a branch prediction hardware 1232 coupled to an instruction cache hardware 1234, which is coupled to an instruction translation lookaside buffer (TLB) 1236, which is coupled to an instruction fetch hardware 1238, which is coupled to a decode hardware 1240. The decode hardware 1240 (or decoder) may decode instructions, and generate as an output one or more micro-operations, micro-code entry points, microinstructions, other instructions, or other control signals, which are decoded from, or which otherwise reflect, or are derived from, the original instructions. The decode hardware 1240 may be implemented using various different mechanisms. Examples of suitable mechanisms include, but are not limited to, look-up tables, hardware implementations, programmable logic arrays (PLAs), microcode read only memories (ROMs), etc. In one embodiment, the core 1290 includes a microcode ROM or other medium that stores microcode for certain macroinstructions (e.g., in decode hardware 1240 or otherwise within the front end hardware 1230). The decode hardware 1240 is coupled to a rename/allocator hardware 1252 in the execution engine hardware 1250.
The execution engine hardware 1250 includes the rename/allocator hardware 1252 coupled to a retirement hardware 1254 and a set of one or more scheduler hardware 1256. The scheduler hardware 1256 represents any number of different schedulers, including reservations stations, central instruction window, etc. The scheduler hardware 1256 is coupled to the physical register file(s) hardware 1258. Each of the physical register file(s) hardware 1258 represents one or more physical register files, different ones of which store one or more different data types, such as scalar integer, scalar floating point, packed integer, packed floating point, vector integer, vector floating point, status (e.g., an instruction pointer that is the address of the next instruction to be executed), etc. In one embodiment, the physical register file(s) hardware 1258 comprises a vector registers hardware, a write mask registers hardware, and a scalar registers hardware. These register hardware may provide architectural vector registers, vector mask registers, and general purpose registers. The physical register file(s) hardware 1258 is overlapped by the retirement hardware 1254 to illustrate various ways in which register renaming and out-of-order execution may be implemented (e.g., using a reorder buffer(s) and a retirement register file(s); using a future file(s), a history buffer(s), and a retirement register file(s); using a register maps and a pool of registers; etc.). The retirement hardware 1254 and the physical register file(s) hardware 1258 are coupled to the execution cluster(s) 1260. The execution cluster(s) 1260 includes a set of one or more execution hardware 1262 and a set of one or more memory access hardware 1264. The execution hardware 1262 may perform various operations (e.g., shifts, addition, subtraction, multiplication) and on various types of data (e.g., scalar floating point, packed integer, packed floating point, vector integer, vector floating point). While some embodiments may include a number of execution hardware dedicated to specific functions or sets of functions, other embodiments may include only one execution hardware or multiple execution hardware that all perform all functions. The scheduler hardware 1256, physical register file(s) hardware 1258, and execution cluster(s) 1260 are shown as being possibly plural because certain embodiments create separate pipelines for certain types of data/operations (e.g., a scalar integer pipeline, a scalar floating point/packed integer/packed floating point/vector integer/vector floating point pipeline, and/or a memory access pipeline that each have their own scheduler hardware, physical register file(s) hardware, and/or execution cluster—and in the case of a separate memory access pipeline, certain embodiments are implemented in which only the execution cluster of this pipeline has the memory access hardware 1264). It should also be understood that where separate pipelines are used, one or more of these pipelines may be out-of-order issue/execution and the rest in-order.
The set of memory access hardware 1264 is coupled to the memory hardware 1270, which includes a data TLB hardware 1272 coupled to a data cache hardware 1274 coupled to a level 2 (L2) cache hardware 1276. In one exemplary embodiment, the memory access hardware 1264 may include a load hardware, a store address hardware, and a store data hardware, each of which is coupled to the data TLB hardware 1272 in the memory hardware 1270. The instruction cache hardware 1234 is further coupled to a level 2 (L2) cache hardware 1276 in the memory hardware 1270. The L2 cache hardware 1276 is coupled to one or more other levels of cache and eventually to a main memory.
By way of example, the exemplary register renaming, out-of-order issue/execution core architecture may implement the pipeline 1200 as follows: 1) the instruction fetch 1238 performs the fetch and length decoding stages 1202 and 1204; 2) the decode hardware 1240 performs the decode stage 1206; 3) the rename/allocator hardware 1252 performs the allocation stage 1208 and renaming stage 1210; 4) the scheduler hardware 1256 performs the schedule stage 1212; 5) the physical register file(s) hardware 1258 and the memory hardware 1270 perform the register read/memory read stage 1214; the execution cluster 1260 perform the execute stage 1216; 6) the memory hardware 1270 and the physical register file(s) hardware 1258 perform the write back/memory write stage 1218; 7) various hardware may be involved in the exception handling stage 1222; and 8) the retirement hardware 1254 and the physical register file(s) hardware 1258 perform the commit stage 1224.
The core 1290 may support one or more instructions sets (e.g., the x86 instruction set (with some extensions that have been added with newer versions); the MIPS instruction set of MIPS Technologies of Sunnyvale, Calif.; the ARM instruction set (with optional additional extensions such as NEON) of ARM Holdings of Sunnyvale, Calif.), including the instruction(s) described herein. In one embodiment, the core 1290 includes logic to support a packed data instruction set extension (e.g., AVX1, AVX2, and/or some form of the generic vector friendly instruction format (U=0 and/or U=1), described below), thereby allowing the operations used by many multimedia applications to be performed using packed data.
It should be understood that the core may support multithreading (executing two or more parallel sets of operations or threads), and may do so in a variety of ways including time sliced multithreading, simultaneous multithreading (where a single physical core provides a logical core for each of the threads that physical core is simultaneously multithreading), or a combination thereof (e.g., time sliced fetching and decoding and simultaneous multithreading thereafter such as in the Intel® Hyperthreading technology).
While register renaming is described in the context of out-of-order execution, it should be understood that register renaming may be used in an in-order architecture. While the illustrated embodiment of the processor also includes separate instruction and data cache hardware 1234/1274 and a shared L2 cache hardware 1276, alternative embodiments may have a single internal cache for both instructions and data, such as, for example, a Level 1 (L1) internal cache, or multiple levels of internal cache. In some embodiments, the system may include a combination of an internal cache and an external cache that is external to the core and/or the processor. Alternatively, all of the cache may be external to the core and/or the processor.
Thus, different implementations of the processor 1300 may include: 1) a CPU with the special purpose logic 1308 being integrated graphics and/or scientific (throughput) logic (which may include one or more cores), and the cores 1302A-N being one or more general purpose cores (e.g., general purpose in-order cores, general purpose out-of-order cores, a combination of the two); 2) a coprocessor with the cores 1302A-N being a large number of special purpose cores intended primarily for graphics and/or scientific (throughput); and 3) a coprocessor with the cores 1302A-N being a large number of general purpose in-order cores. Thus, the processor 1300 may be a general-purpose processor, coprocessor or special-purpose processor, such as, for example, a network or communication processor, compression engine, graphics processor, GPGPU (general purpose graphics processing unit), a high-throughput many integrated core (MIC) coprocessor (including 30 or more cores), embedded processor, or the like. The processor may be implemented on one or more chips. The processor 1300 may be a part of and/or may be implemented on one or more substrates using any of a number of process technologies, such as, for example, BiCMOS, CMOS, or NMOS.
The memory hierarchy includes one or more levels of cache within the cores, a set or one or more shared cache hardware 1306, and external memory (not shown) coupled to the set of integrated memory controller hardware 1314. The set of shared cache hardware 1306 may include one or more mid-level caches, such as level 2 (L2), level 3 (L3), level 4 (L4), or other levels of cache, a last level cache (LLC), and/or combinations thereof. While in one embodiment a ring based interconnect hardware 1312 interconnects the integrated graphics logic 1308, the set of shared cache hardware 1306, and the system agent hardware 1310/integrated memory controller hardware 1314, alternative embodiments may use any number of well-known techniques for interconnecting such hardware. In one embodiment, coherency is maintained between one or more cache hardware 1306 and cores 1302-A-N.
In some embodiments, one or more of the cores 1302A-N are capable of multi-threading. The system agent 1310 includes those components coordinating and operating cores 1302A-N. The system agent hardware 1310 may include for example a power control unit (PCU) and a display hardware. The PCU may be or include logic and components needed for regulating the power state of the cores 1302A-N and the integrated graphics logic 1308. The display hardware is for driving one or more externally connected displays.
The cores 1302A-N may be homogenous or heterogeneous in terms of architecture instruction set; that is, two or more of the cores 1302A-N may be capable of execution the same instruction set, while others may be capable of executing only a subset of that instruction set or a different instruction set. In one embodiment, the cores 1302A-N are heterogeneous and include both the “small” cores and “big” cores described below.
Referring now to
The optional nature of additional processors 1415 is denoted in
The memory 1440 may be, for example, dynamic random access memory (DRAM), phase change memory (PCM), or a combination of the two. For at least one embodiment, the controller hub 1420 communicates with the processor(s) 1410, 1415 via a multi-drop bus, such as a frontside bus (FSB), point-to-point interface, or similar connection 1495.
In one embodiment, the coprocessor 1445 is a special-purpose processor, such as, for example, a high-throughput MIC processor, a network or communication processor, compression engine, graphics processor, GPGPU, embedded processor, or the like. In one embodiment, controller hub 1420 may include an integrated graphics accelerator.
There can be a variety of differences between the physical resources 1410, 1415 in terms of a spectrum of metrics of merit including architectural, microarchitectural, thermal, power consumption characteristics, and the like.
In one embodiment, the processor 1410 executes instructions that control data processing operations of a general type. Embedded within the instructions may be coprocessor instructions. The processor 1410 recognizes these coprocessor instructions as being of a type that should be executed by the attached coprocessor 1445. Accordingly, the processor 1410 issues these coprocessor instructions (or control signals representing coprocessor instructions) on a coprocessor bus or other interconnect, to coprocessor 1445. Coprocessor(s) 1445 accept and execute the received coprocessor instructions.
Referring now to
Processors 1570 and 1580 are shown including integrated memory controller (IMC) hardware 1572 and 1582, respectively. Processor 1570 also includes as part of its bus controller hardware point-to-point (P-P) interfaces 1576 and 1578; similarly, second processor 1580 includes P-P interfaces 1586 and 1588. Processors 1570, 1580 may exchange information via a point-to-point (P-P) interface 1550 using P-P interface circuits 1578, 1588. As shown in
Processors 1570, 1580 may each exchange information with a chipset 1590 via individual P-P interfaces 1552, 1554 using point to point interface circuits 1576, 1594, 1586, 1598. Chipset 1590 may optionally exchange information with the coprocessor 1538 via a high-performance interface 1539. In one embodiment, the coprocessor 1538 is a special-purpose processor, such as, for example, a high-throughput MIC processor, a network or communication processor, compression engine, graphics processor, GPGPU, embedded processor, or the like.
A shared cache (not shown) may be included in either processor or outside of both processors, yet connected with the processors via P-P interconnect, such that either or both processors' local cache information may be stored in the shared cache if a processor is placed into a low power mode.
Chipset 1590 may be coupled to a first bus 1516 via an interface 1596. In one embodiment, first bus 1516 may be a Peripheral Component Interconnect (PCI) bus, or a bus such as a PCI Express bus or another third generation I/O interconnect bus, although the scope of the present invention is not so limited.
As shown in
Referring now to
Referring now to
Embodiments of the mechanisms disclosed herein may be implemented in hardware, software, firmware, or a combination of such implementation approaches. Embodiments of the invention may be implemented as computer programs or program code executing on programmable systems comprising at least one processor, a storage system (including volatile and non-volatile memory and/or storage elements), at least one input device, and at least one output device.
Program code, such as code 1530 illustrated in
The program code may be implemented in a high level procedural or object oriented programming language to communicate with a processing system. The program code may also be implemented in assembly or machine language, if desired. In fact, the mechanisms described herein are not limited in scope to any particular programming language. In any case, the language may be a compiled or interpreted language.
One or more aspects of at least one embodiment may be implemented by representative instructions stored on a machine-readable medium which represents various logic within the processor, which when read by a machine causes the machine to fabricate logic to perform the techniques described herein. Such representations, known as “IP cores” may be stored on a tangible, machine readable medium and supplied to various customers or manufacturing facilities to load into the fabrication machines that actually make the logic or processor.
Such machine-readable storage media may include, without limitation, non-transitory, tangible arrangements of articles manufactured or formed by a machine or device, including storage media such as hard disks, any other type of disk including floppy disks, optical disks, compact disk read-only memories (CD-ROMs), compact disk rewritable's (CD-RWs), and magneto-optical disks, semiconductor devices such as read-only memories (ROMs), random access memories (RAMs) such as dynamic random access memories (DRAMs), static random access memories (SRAMs), erasable programmable read-only memories (EPROMs), flash memories, electrically erasable programmable read-only memories (EEPROMs), phase change memory (PCM), magnetic or optical cards, or any other type of media suitable for storing electronic instructions.
Accordingly, embodiments of the invention also include non-transitory, tangible machine-readable media containing instructions or containing design data, such as Hardware Description Language (HDL), which defines structures, circuits, apparatuses, processors and/or system features described herein. Such embodiments may also be referred to as program products.
In some cases, an instruction converter may be used to convert an instruction from a source instruction set to a target instruction set. For example, the instruction converter may translate (e.g., using static binary translation, dynamic binary translation including dynamic compilation), morph, emulate, or otherwise convert an instruction to one or more other instructions to be processed by the core. The instruction converter may be implemented in software, hardware, firmware, or a combination thereof. The instruction converter may be on processor, off processor, or part on and part off processor.