From 6a9a0ec14d647ad3d73b65f9eb99a33fa1a14eb3 Mon Sep 17 00:00:00 2001
From: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Date: Tue, 22 Aug 2023 11:27:37 +0200
Subject: [PATCH] update(sinsp): implement suppressed tid cache in
 sinsp_suppress

As opposed to the scap_suppress implementation, we only cache
tids (not hash tabe entries), because iterators pointing
at individual entries can get invalidated.

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
---
 userspace/libsinsp/sinsp.cpp          |  4 ++--
 userspace/libsinsp/sinsp_suppress.cpp | 23 +++++++++++++++++++----
 userspace/libsinsp/sinsp_suppress.h   | 10 ++++++++--
 3 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/userspace/libsinsp/sinsp.cpp b/userspace/libsinsp/sinsp.cpp
index 3c18e217b8..45dc2b6e19 100644
--- a/userspace/libsinsp/sinsp.cpp
+++ b/userspace/libsinsp/sinsp.cpp
@@ -1299,7 +1299,7 @@ int32_t sinsp::next(OUT sinsp_evt **puevt)
 
 		if(res == SCAP_SUCCESS)
 		{
-			res = m_suppress.process_event(evt->m_pevt);
+			res = m_suppress.process_event(evt->m_pevt, evt->m_cpuid);
 		}
 
 		if(res != SCAP_SUCCESS)
@@ -1609,7 +1609,7 @@ bool sinsp::suppress_events_tid(int64_t tid)
 
 bool sinsp::check_suppressed(int64_t tid)
 {
-	return m_suppress.is_suppressed_tid(tid);
+	return m_suppress.is_suppressed_tid(tid, UINT16_MAX);
 }
 
 void sinsp::set_docker_socket_path(std::string socket_path)
diff --git a/userspace/libsinsp/sinsp_suppress.cpp b/userspace/libsinsp/sinsp_suppress.cpp
index dc7688313e..e21d9c78bf 100644
--- a/userspace/libsinsp/sinsp_suppress.cpp
+++ b/userspace/libsinsp/sinsp_suppress.cpp
@@ -43,7 +43,7 @@ bool libsinsp::sinsp_suppress::check_suppressed_comm(uint64_t tid, const std::st
 	return false;
 }
 
-int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
+int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e, uint16_t devid)
 {
 	if(m_suppressed_tids.empty() && m_suppressed_comms.empty())
 	{
@@ -100,7 +100,7 @@ int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
 
 		comm = valptr;
 
-		if(is_suppressed_tid(*ptid))
+		if(is_suppressed_tid(*ptid, devid))
 		{
 			m_suppressed_tids.insert(e->tid);
 			m_num_suppressed_events++;
@@ -119,6 +119,7 @@ int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
 		auto it = m_suppressed_tids.find(e->tid);
 		if (it != m_suppressed_tids.end())
 		{
+			cache_slot(devid) = 0;
 			m_suppressed_tids.erase(it);
 			m_num_suppressed_events++;
 			return SCAP_FILTERED_EVENT;
@@ -130,7 +131,7 @@ int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
 	}
 
 	default:
-		if (is_suppressed_tid(e->tid))
+		if (is_suppressed_tid(e->tid, devid))
 		{
 			m_num_suppressed_events++;
 			return SCAP_FILTERED_EVENT;
@@ -142,7 +143,21 @@ int32_t libsinsp::sinsp_suppress::process_event(scap_evt *e)
 	}
 }
 
-bool libsinsp::sinsp_suppress::is_suppressed_tid(uint64_t tid) const
+bool libsinsp::sinsp_suppress::is_suppressed_tid(uint64_t tid, uint16_t devid) const
 {
+	if(devid != UINT16_MAX && cache_slot(devid) == tid)
+	{
+		return true;
+	}
 	return m_suppressed_tids.find(tid) != m_suppressed_tids.end();
 }
+
+uint64_t& libsinsp::sinsp_suppress::cache_slot(uint16_t devid)
+{
+	return m_cache[devid % CACHE_SIZE];
+}
+
+uint64_t libsinsp::sinsp_suppress::cache_slot(uint16_t devid) const
+{
+	return m_cache[devid % CACHE_SIZE];
+}
diff --git a/userspace/libsinsp/sinsp_suppress.h b/userspace/libsinsp/sinsp_suppress.h
index 5f1526392b..6f1556add3 100644
--- a/userspace/libsinsp/sinsp_suppress.h
+++ b/userspace/libsinsp/sinsp_suppress.h
@@ -38,19 +38,25 @@ class sinsp_suppress
 
 	bool check_suppressed_comm(uint64_t tid, const std::string& comm);
 
-	int32_t process_event(scap_evt* e);
+	int32_t process_event(scap_evt* e, uint16_t devid);
 
-	bool is_suppressed_tid(uint64_t tid) const;
+	bool is_suppressed_tid(uint64_t tid, uint16_t devid) const;
 
 	uint64_t get_num_suppressed_events() const { return m_num_suppressed_events; }
 
 	uint64_t get_num_suppressed_tids() const { return m_suppressed_tids.size(); }
 
 protected:
+	inline uint64_t& cache_slot(uint16_t devid);
+	inline uint64_t cache_slot(uint16_t devid) const;
+
 	std::unordered_set<std::string> m_suppressed_comms;
 	std::unordered_set<uint64_t> m_suppressed_tids;
 
 	uint64_t m_num_suppressed_events = 0;
+
+	static constexpr size_t CACHE_SIZE = 1024;
+	uint64_t m_cache[CACHE_SIZE] {};
 };
 
 }
\ No newline at end of file