Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(events): add io_uring visibility #3603

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

roikol
Copy link
Contributor

@roikol roikol commented Oct 23, 2023

1. Explain what the PR does

Author: RoiKol <roi.kol@aquasec.com>
Date:   Mon Oct 23 16:52:27 2023 +0300

    feat(events): add io_uring visibility

    add events to allow visibility to io_uring operations in the system.
    the added events are:
    io_uring_create - creation of io_uring queue
    io_uring_submit_req - submission of io_uring request
    io_write - operation of write using io_uring

2. Explain how to test it

3. Other comments

close: #309

@roikol roikol force-pushed the add_io_uring_visiblity branch 2 times, most recently from 9227f5e to dba6b09 Compare November 9, 2023 10:39
add events to allow visibility to io_uring operations in the system.
the added events are:
io_uring_create - creation of io_uring queue
io_issue_sqe - submission of io_uring request
io_write - operation of write using io_uring
@roikol
Copy link
Contributor Author

roikol commented Nov 9, 2023

current status:

io_uring_create event doesn't work on kernels v5.1 - v5.4:
what should've solved it is was the probe io_sq_offload_start which exists in kernels v5.1 - v5.4, but for some reason this probe fails to load.
we need to find another alternative probe to get the information from.

the tests don't pass because of the context of the event:
io_uring mechanism in the kernel changes the context of the task -

  • if polling mode is used in io_uring_create syscall, then eveny io_uring operation is done under the context of a kernel polling thread.
  • if the operation that is being submitted to run in io_uring is blocking, then the kernel assigns a kernel worker thread to do the operation.
    in this PR - i attempted to "seat" where these context changes are happening, and override the current context (either kernel polling thread or kernel worker thread) with the original context of the issuer (the userspace process).
    currently i only override the p.event->context, but i believe that p.task_info should be taken care of as well.

missing probes warnings at tracee startup:
i've used different probes for different kernel versions to support those events. so some of them won't be available in all the kernel versions.
this is expected, but we may want the silent those warnings.

@rafaeldtinoco rafaeldtinoco removed their request for review January 5, 2024 16:22
@rafaeldtinoco rafaeldtinoco marked this pull request as draft January 5, 2024 16:22
@geyslan
Copy link
Member

geyslan commented Feb 21, 2024

We have this update #3875

Please rebase your PR against main to make use of the new workflow setup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add io_uring tracepoints
4 participants