[OPTIMIZE]optimize hyperscan callback performance

2 files changed, 10 insertions, 18 deletions

diff --git a/scanner/expr_matcher/adapter_hs/adapter_hs.cpp b/scanner/expr_matcher/adapter_hs/adapter_hs.cpp
index 4d57dcf..11df9cf 100644
--- a/scanner/expr_matcher/adapter_hs/adapter_hs.cpp
+++ b/scanner/expr_matcher/adapter_hs/adapter_hs.cpp
@@ -22,9 +22,9 @@
 #include "maat_utils.h"
 #include "../../bool_matcher/bool_matcher.h"
 
-#define MAX_HIT_PATTERN_NUM  512
+#define MAX_HIT_PATTERN_NUM  1024
 
-pid_t hs_gettid() 
+pid_t hs_gettid()
 {
 	return syscall(SYS_gettid);
 }
@@ -584,11 +584,6 @@ static int matched_event_cb(unsigned int id, unsigned long long from,
     if (utarray_len(matched_pat->pattern_ids) >= MAX_HIT_PATTERN_NUM) {
         return 0;
     }
-
-    // duplicate pattern_id
-    if (utarray_find(matched_pat->pattern_ids, &pattern_id, compare_pattern_id)) {
-        return 0;
-    }
     
     int ret = 0;
     struct pattern_attribute pat_attr = matched_pat->ref_hs_attr[id];
@@ -640,7 +635,6 @@ static int matched_event_cb(unsigned int id, unsigned long long from,
    
     if (1 == ret) {
         utarray_push_back(matched_pat->pattern_ids, &pattern_id);
-        utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
     }
     
     return 0;
@@ -834,8 +828,9 @@ int adapter_hs_scan_stream(void *hs_stream, const char *data, size_t data_len,
         return 0;
     }
 
-    unsigned long long pattern_ids[n_pattern_id];
+    utarray_sort(stream->matched_pat->pattern_ids, compare_pattern_id);
 
+    unsigned long long pattern_ids[n_pattern_id];
     for (size_t i = 0; i < n_pattern_id; i++) {
         pattern_ids[i] = *(unsigned long long *)utarray_eltptr(stream->matched_pat->pattern_ids, i);
     }
diff --git a/scanner/expr_matcher/adapter_rs/adapter_rs.cpp b/scanner/expr_matcher/adapter_rs/adapter_rs.cpp
index 1459ab1..1489dca 100644
--- a/scanner/expr_matcher/adapter_rs/adapter_rs.cpp
+++ b/scanner/expr_matcher/adapter_rs/adapter_rs.cpp
@@ -22,9 +22,9 @@
 #include "maat_utils.h"
 #include "../../bool_matcher/bool_matcher.h"
 
-#define MAX_HIT_PATTERN_NUM  512
+#define MAX_HIT_PATTERN_NUM  1024
 
-pid_t rs_gettid() 
+pid_t rs_gettid()
 {
 	return syscall(SYS_gettid);
 }
@@ -430,11 +430,6 @@ static int matched_event_cb(unsigned int id, int pos_offset, int from, int to,
     if (utarray_len(matched_pat->pattern_ids) >= MAX_HIT_PATTERN_NUM) {
         return 0;
     }
-
-    // duplicate pattern_id
-    if (utarray_find(matched_pat->pattern_ids, &pattern_id, compare_pattern_id)) {
-        return 0;
-    }
     
     int ret = 0;
     struct pattern_attribute pat_attr = matched_pat->ref_rs_attr[id];
@@ -487,7 +482,6 @@ static int matched_event_cb(unsigned int id, int pos_offset, int from, int to,
    
     if (1 == ret) {
         utarray_push_back(matched_pat->pattern_ids, &pattern_id);
-        utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
     }
 
     return 0;
@@ -609,8 +603,9 @@ int adapter_rs_scan_stream(void *rs_stream, const char *data, size_t data_len,
         return 0;
     }
 
-    unsigned long long pattern_ids[n_pattern_id];
+    utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
 
+    unsigned long long pattern_ids[n_pattern_id];
     for (size_t i = 0; i < n_pattern_id; i++) {
         pattern_ids[i] = *(unsigned long long *)utarray_eltptr(matched_pat->pattern_ids, i);
     }
@@ -678,6 +673,8 @@ int adapter_rs_scan(void *rs_instance, int thread_id, const char *data, size_t d
         return 0;
     }
 
+    utarray_sort(matched_pat->pattern_ids, compare_pattern_id);
+    
     unsigned long long pattern_ids[n_pattern_id];
     for (size_t i = 0; i < n_pattern_id; i++) {
         pattern_ids[i] = *(unsigned long long *)utarray_eltptr(matched_pat->pattern_ids, i);