update(sinsp): implement suppressed tid cache in sinsp_suppress

As opposed to the scap_suppress implementation, we only cache tids (not hash tabe entries), because iterators pointing at individual entries can get invalidated. Signed-off-by: Grzegorz Nosek <[email protected]>
falcosecurity · Oct 20, 2023 · 6a9a0ec · 6a9a0ec
1 parent 1054418
commit 6a9a0ec
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 8 deletions.
diff --git a/userspace/libsinsp/sinsp.cpp b/userspace/libsinsp/sinsp.cpp
@@ -1299,7 +1299,7 @@ int32_t sinsp::next(OUT sinsp_evt **puevt)
 
 		if(res == SCAP_SUCCESS)
 		{
-			res = m_suppress.process_event(evt->m_pevt);
+			res = m_suppress.process_event(evt->m_pevt, evt->m_cpuid);
 		}
 
 		if(res != SCAP_SUCCESS)
@@ -1609,7 +1609,7 @@ bool sinsp::suppress_events_tid(int64_t tid)
 
 bool sinsp::check_suppressed(int64_t tid)
 {
-	return m_suppress.is_suppressed_tid(tid);
+	return m_suppress.is_suppressed_tid(tid, UINT16_MAX);
 }
 
 void sinsp::set_docker_socket_path(std::string socket_path)

diff --git a/userspace/libsinsp/sinsp_suppress.cpp b/userspace/libsinsp/sinsp_suppress.cpp
@@ -43,7 +43,7 @@ bool libsinsp::sinsp_suppress::check_suppressed_comm(uint64_t tid, const std::st
 	return false;
 }
 
-int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
+int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e, uint16_t devid)
 {
 	if(m_suppressed_tids.empty() && m_suppressed_comms.empty())
 	{
@@ -100,7 +100,7 @@ int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
 
 		comm = valptr;
 
-		if(is_suppressed_tid(*ptid))
+		if(is_suppressed_tid(*ptid, devid))
 		{
 			m_suppressed_tids.insert(e->tid);
 			m_num_suppressed_events++;
@@ -119,6 +119,7 @@ int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
 		auto it = m_suppressed_tids.find(e->tid);
 		if (it != m_suppressed_tids.end())
 		{
+			cache_slot(devid) = 0;
 			m_suppressed_tids.erase(it);
 			m_num_suppressed_events++;
 			return SCAP_FILTERED_EVENT;
@@ -130,7 +131,7 @@ int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
 	}
 
 	default:
-		if (is_suppressed_tid(e->tid))
+		if (is_suppressed_tid(e->tid, devid))
 		{
 			m_num_suppressed_events++;
 			return SCAP_FILTERED_EVENT;
@@ -142,7 +143,21 @@ int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
 	}
 }
 
-bool libsinsp::sinsp_suppress::is_suppressed_tid(uint64_t tid) const
+bool libsinsp::sinsp_suppress::is_suppressed_tid(uint64_t tid, uint16_t devid) const
 {
+	if(devid != UINT16_MAX && cache_slot(devid) == tid)
+	{
+		return true;
+	}
 	return m_suppressed_tids.find(tid) != m_suppressed_tids.end();
 }
+
+uint64_t& libsinsp::sinsp_suppress::cache_slot(uint16_t devid)
+{
+	return m_cache[devid % CACHE_SIZE];
+}
+
+uint64_t libsinsp::sinsp_suppress::cache_slot(uint16_t devid) const
+{
+	return m_cache[devid % CACHE_SIZE];
+}
diff --git a/userspace/libsinsp/sinsp_suppress.h b/userspace/libsinsp/sinsp_suppress.h
@@ -38,19 +38,25 @@ class sinsp_suppress
 
 	bool check_suppressed_comm(uint64_t tid, const std::string& comm);
 
-	int32_t process_event(scap_evt* e);
+	int32_t process_event(scap_evt* e, uint16_t devid);
 
-	bool is_suppressed_tid(uint64_t tid) const;
+	bool is_suppressed_tid(uint64_t tid, uint16_t devid) const;
 
 	uint64_t get_num_suppressed_events() const { return m_num_suppressed_events; }
 
 	uint64_t get_num_suppressed_tids() const { return m_suppressed_tids.size(); }
 
 protected:
+	inline uint64_t& cache_slot(uint16_t devid);
+	inline uint64_t cache_slot(uint16_t devid) const;
+
 	std::unordered_set<std::string> m_suppressed_comms;
 	std::unordered_set<uint64_t> m_suppressed_tids;
 
 	uint64_t m_num_suppressed_events = 0;
+
+	static constexpr size_t CACHE_SIZE = 1024;
+	uint64_t m_cache[CACHE_SIZE] {};
 };
 
 }