Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Minor optimizations/v1 #12398

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

victorjulien
Copy link
Member

Misc optimizations from running vtune.

Until now the implementation would scan the stream, fallback to the
packet payload, then keep track of where the match was and in the
flow match logic reject the match if it was in the wrong buffer.

This patch simplifies this logic, by refusing to inspect the packet
payload when `only_stream` is set.
To assist branch prediction, which showed a 100% miss rate, assume pstate
is non-NULL. Code review suggests all paths leading to the function actually
check pstate first, or alstate which can only be non-NULL if pstate was first
initialized. For now add a debug check.
Copy link

codecov bot commented Jan 15, 2025

Codecov Report

Attention: Patch coverage is 87.17949% with 5 lines in your changes missing coverage. Please review.

Project coverage is 80.63%. Comparing base (078c646) to head (35afa8f).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #12398      +/-   ##
==========================================
- Coverage   80.63%   80.63%   -0.01%     
==========================================
  Files         917      917              
  Lines      258687   258696       +9     
==========================================
+ Hits       208601   208608       +7     
- Misses      50086    50088       +2     
Flag Coverage Δ
fuzzcorpus 56.81% <48.71%> (-0.01%) ⬇️
livemode 19.39% <0.00%> (-0.01%) ⬇️
pcap 44.30% <87.17%> (+0.03%) ⬆️
suricata-verify 63.24% <84.61%> (+0.01%) ⬆️
unittests 58.50% <46.15%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

// Failed to allocate larger memory for all the SIDS, but
// keep as many as we can.
sids_size = pmq->rule_id_array_size - pmq->rule_id_array_cnt;
if (sids_size > 0) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not following why is an extra indentation preferable over return if base condition doesn't match.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The logic I think is that it assumes the first branch (so sids_size == 0 leading to return) to be the most likely.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 24219

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants