new(driver): unify support for io_uring syscall family between drivers

driver/bpf/fillers.h

@@ -3295,190 +3295,134 @@ FILLER(sys_open_by_handle_at_x, true)
 
 FILLER(sys_io_uring_setup_x, true)
 {
-	long retval;
-	int res;
-	unsigned long val;
-	unsigned long sq_entries;
-	unsigned long cq_entries;
-	unsigned long flags;
-	unsigned long sq_thread_cpu;
-	unsigned long sq_thread_idle;
-	unsigned long features = 0;
-
-#ifdef __NR_io_uring_setup
-	struct io_uring_params params;
-#endif
-	retval = bpf_syscall_get_retval(data->ctx);
-	res = bpf_val_to_ring(data, retval);
-	if (res != PPM_SUCCESS)
-		return res;
-	/*
-	 * entries
+	/* All these params are sent equal to `0` if `__NR_io_uring_setup`
+	 * syscall is not defined.
 	 */
-	val = bpf_syscall_get_argument(data, 0);
-	res = bpf_val_to_ring(data, val);
-	if (res != PPM_SUCCESS)
-		return res;
+	u32 sq_entries = 0;
+	u32 cq_entries = 0;
+	u32 flags = 0;
+	u32 sq_thread_cpu = 0;
+	u32 sq_thread_idle = 0;
+	u32 features = 0;
 
+	/* If the syscall is defined use the syscall data */
 #ifdef __NR_io_uring_setup
-	/*
-	 * io_uring_params: we get the data structure, and put its fields in the buffer one by one
+	struct io_uring_params params = {0};
+	unsigned long params_pointer = bpf_syscall_get_argument(data, 1);
+	/* if the call fails we don't care since `bpf_probe_read` under the hood memsets
+	 * the destination memory to `0`
 	 */
-	val = bpf_syscall_get_argument(data, 1);
-	if (bpf_probe_read(&params, sizeof(struct io_uring_params), (void *)val)) {
-		return PPM_FAILURE_INVALID_USER_MEMORY;
-	}
+	bpf_probe_read(&params, sizeof(struct io_uring_params), (void *)params_pointer);
 
 	sq_entries = params.sq_entries;
 	cq_entries = params.cq_entries;
 	flags = io_uring_setup_flags_to_scap(params.flags);
 	sq_thread_cpu = params.sq_thread_cpu;
 	sq_thread_idle = params.sq_thread_idle;
+
+	/* We need this ifdef because `features` field is defined into the 
+	 * `struct io_uring_params` only if the `IORING_FEAT_SINGLE_MMAP` is
+	 * defined.
+	 */
 #ifdef IORING_FEAT_SINGLE_MMAP	
 	features = io_uring_setup_feats_to_scap(params.features);
-#endif	
-#else
-	sq_entries = 0;
-	cq_entries = 0;
-	flags = 0;
-	sq_thread_cpu = 0;
-	sq_thread_idle = 0;
-	features = 0;
 #endif
+#endif /* __NR_io_uring_setup */
 
-	/*
-	 * sq_entries (extracted from io_uring_params structure)
-	 */
+	/* Parameter 1: res (type: PT_ERRNO) */
+	long retval = bpf_syscall_get_retval(data->ctx);
+	int res = bpf_val_to_ring(data, retval);
+	CHECK_RES(res);
+
+	/* Parameter 2: entries (type: PT_UINT32) */
+	u32 entries = (u32)bpf_syscall_get_argument(data, 0);
+	res = bpf_val_to_ring(data, entries);
+	CHECK_RES(res);
+
+	/* Parameter 3: sq_entries (type: PT_UINT32) */
 	res = bpf_val_to_ring(data, sq_entries);
-	if (res != PPM_SUCCESS)
-		return res;
-	/*
-	 * cq_entries (extracted from io_uring_params structure)
-	 */
+	CHECK_RES(res);
+
+	/* Parameter 4: cq_entries (type: PT_UINT32) */
 	res = bpf_val_to_ring(data, cq_entries);
-	if (res != PPM_SUCCESS)
-		return res;
-	/*
-	 * flags (extracted from io_uring_params structure)
-	 * Already converted in ppm portable representation
-	 */
+	CHECK_RES(res);
+
+	/* Parameter 5: flags (type: PT_FLAGS32) */
 	res = bpf_val_to_ring(data, flags);
-	if (res != PPM_SUCCESS)
-		return res;
-	/*
-	 * sq_thread_cpu (extracted from io_uring_params structure)
-	 */
+	CHECK_RES(res);
+
+	/* Parameter 6: sq_thread_cpu (type: PT_UINT32) */
 	res = bpf_val_to_ring(data, sq_thread_cpu);
-	if (res != PPM_SUCCESS)
-		return res;
-	/*
-	 * sq_thread_idle (extracted from io_uring_params structure)
-	 */
+	CHECK_RES(res);
+
+	/* Parameter 7: sq_thread_idle (type: PT_UINT32) */
 	res = bpf_val_to_ring(data, sq_thread_idle);
-	if (res != PPM_SUCCESS)
-		return res;
-	/*
-	 * features (extracted from io_uring_params structure)
-	 * Already converted in ppm portable representation
-	 */
-	res = bpf_val_to_ring(data, features);
-	return res;
+	CHECK_RES(res);
+
+	/* Parameter 8: features (type: PT_FLAGS32) */
+	return bpf_val_to_ring(data, features);
 }
 
 FILLER(sys_io_uring_enter_x, true)
 {
-	long retval;
-	int res;
-	unsigned long val;
-
-	retval = bpf_syscall_get_retval(data->ctx);
-	res = bpf_val_to_ring(data, retval);
-	if (res != PPM_SUCCESS)
-		return res;
+	/* Parameter 1: res (type: PT_ERRNO) */
+	long retval = bpf_syscall_get_retval(data->ctx);
+	int res = bpf_val_to_ring(data, retval);
+	CHECK_RES(res);
 
-	/*
-	 * fd
-	 */
-	val = bpf_syscall_get_argument(data, 0);
-	res = bpf_val_to_ring(data, val);
-	if (res != PPM_SUCCESS)
-		return res;
+	/* Parameter 2: fd (type: PT_FD) */
+	s32 fd = (s32)bpf_syscall_get_argument(data, 0);
+	res = bpf_val_to_ring(data, (s64)fd);
+	CHECK_RES(res);
 
-	/*
-	 * to_submit
-	 */
-	val = bpf_syscall_get_argument(data, 1);
-	res = bpf_val_to_ring(data, val);
-	if (res != PPM_SUCCESS)
-		return res;
+	/* Parameter 3: to_submit (type: PT_UINT32) */
+	u32 to_submit = (u32)bpf_syscall_get_argument(data, 1);
+	res = bpf_val_to_ring(data, to_submit);
+	CHECK_RES(res);
 
-	/*
-	 * min_complete
-	 */
-	val = bpf_syscall_get_argument(data, 2);
-	res = bpf_val_to_ring(data, val);
-	if (res != PPM_SUCCESS)
-		return res;
+	/* Parameter 4: min_complete (type: PT_UINT32) */
+	u32 min_complete = (u32)bpf_syscall_get_argument(data, 2);
+	res = bpf_val_to_ring(data, min_complete);
+	CHECK_RES(res);
 
-	/*
-	 * flags
-	 */
-	val = bpf_syscall_get_argument(data, 3);
-	res = bpf_val_to_ring(data, io_uring_enter_flags_to_scap(val));
-	if (res != PPM_SUCCESS)
-		return res;
+	/* Parameter 5: flags (type: PT_FLAGS32) */
+	u32 flags = (u32)bpf_syscall_get_argument(data, 3);
+	res = bpf_val_to_ring(data, io_uring_enter_flags_to_scap(flags));
+	CHECK_RES(res);
 
-	/*
-	 * min_complete
-	 */
-	val = bpf_syscall_get_argument(data, 4);
-	res = bpf_val_to_ring(data, val);
+	/* Parameter 6: sig (type: PT_SIGSET) */
+	u32 sig = (u32)bpf_syscall_get_argument(data, 4);
+	return bpf_val_to_ring(data, sig);
 
-	return res;
+	/// TODO: We miss the last parameter `size_t argsz`
+	/// we need to implement it in all our drivers
 }
 
 FILLER(sys_io_uring_register_x, true)
 {
-	long retval;
-	int res;
-	unsigned long val;
-
-	retval = bpf_syscall_get_retval(data->ctx);
-	res = bpf_val_to_ring(data, retval);
-	if (res != PPM_SUCCESS)
-		return res;
-
-	/*
-	 * fd
-	 */
-	val = bpf_syscall_get_argument(data, 0);
-	res = bpf_val_to_ring(data, val);
-	if (res != PPM_SUCCESS)
-		return res;
+	/* Parameter 1: res (type: PT_ERRNO) */
+	long retval = bpf_syscall_get_retval(data->ctx);
+	int res = bpf_val_to_ring(data, retval);
+	CHECK_RES(res);
 
-	/*
-	 * opcode
-	 */
-	val = bpf_syscall_get_argument(data, 1);
-	res = bpf_val_to_ring(data, io_uring_register_opcodes_to_scap(val));
-	if (res != PPM_SUCCESS)
-		return res;
+	/* Parameter 2: fd (type: PT_FD) */
+	s32 fd = (s32)bpf_syscall_get_argument(data, 0);
+	res = bpf_val_to_ring(data, (s64)fd);
+	CHECK_RES(res);
 
-	/*
-	 * args
-	 */
-	val = bpf_syscall_get_argument(data, 2);
-	res = bpf_val_to_ring(data, val);
-	if (res != PPM_SUCCESS)
-		return res;
+	/* Parameter 3: opcode (type: PT_ENUMFLAGS16) */
+	u32 opcode = (u32)bpf_syscall_get_argument(data, 1);
+	res = bpf_val_to_ring(data, io_uring_register_opcodes_to_scap(opcode));
+	CHECK_RES(res);
 
-	/*
-	 * nr_args
-	 */
-	val = bpf_syscall_get_argument(data, 3);
-	res = bpf_val_to_ring(data, val);
+	/* Parameter 4: arg (type: PT_UINT64) */
+	unsigned long arg = bpf_syscall_get_argument(data, 2);
+	res = bpf_val_to_ring(data, arg);
+	CHECK_RES(res);
 
-	return res;
+	/* Parameter 5: nr_args (type: PT_UINT32) */
+	u32 nr_args = (u32)bpf_syscall_get_argument(data, 3);
+	return bpf_val_to_ring(data, nr_args);
 }
 
 FILLER(sys_mlock_x, true)

driver/modern_bpf/definitions/events_dimensions.h

@@ -152,6 +152,12 @@
 #define MLOCKALL_X_SIZE HEADER_LEN + sizeof(int64_t) + sizeof(uint32_t) + PARAM_LEN * 2
 #define MUNLOCKALL_E_SIZE HEADER_LEN
 #define MUNLOCKALL_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
+#define IO_URING_ENTER_E_SIZE HEADER_LEN
+#define IO_URING_ENTER_X_SIZE HEADER_LEN + sizeof(int64_t) * 2 + sizeof(uint32_t) * 4 + PARAM_LEN * 6
+#define IO_URING_REGISTER_E_SIZE HEADER_LEN
+#define IO_URING_REGISTER_X_SIZE HEADER_LEN + sizeof(int64_t) * 2 + sizeof(uint16_t) + sizeof(uint64_t) + sizeof(uint32_t) + PARAM_LEN * 5
+#define IO_URING_SETUP_E_SIZE HEADER_LEN
+#define IO_URING_SETUP_X_SIZE HEADER_LEN + sizeof(int64_t) + sizeof(uint32_t) * 7 + PARAM_LEN * 8
 
 /* Generic tracepoints events. */
 #define PROC_EXIT_SIZE HEADER_LEN + sizeof(int64_t) * 2 + sizeof(uint8_t) * 2 + PARAM_LEN * 4

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_enter.bpf.c

@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2023 The Falco Authors.
+ *
+ * This file is dual licensed under either the MIT or GPL 2. See MIT.txt
+ * or GPL2.txt for full copies of the license.
+ */
+
+#include <helpers/interfaces/fixed_size_event.h>
+
+/*=============================== ENTER EVENT ===========================*/
+
+SEC("tp_btf/sys_enter")
+int BPF_PROG(io_uring_enter_e,
+	     struct pt_regs *regs,
+	     long id)
+{
+	struct ringbuf_struct ringbuf;
+	if(!ringbuf__reserve_space(&ringbuf, IO_URING_ENTER_E_SIZE))
+	{
+		return 0;
+	}
+
+	ringbuf__store_event_header(&ringbuf, PPME_SYSCALL_IO_URING_ENTER_E);
+
+	/*=============================== COLLECT PARAMETERS  ===========================*/
+
+	// Here we have no parameters to collect.
+
+	/*=============================== COLLECT PARAMETERS  ===========================*/
+
+	ringbuf__submit_event(&ringbuf);
+
+	return 0;
+}
+
+/*=============================== ENTER EVENT ===========================*/
+
+/*=============================== EXIT EVENT ===========================*/
+
+SEC("tp_btf/sys_exit")
+int BPF_PROG(io_uring_enter_x,
+	     struct pt_regs *regs,
+	     long ret)
+{
+	struct ringbuf_struct ringbuf;
+	if(!ringbuf__reserve_space(&ringbuf, IO_URING_ENTER_X_SIZE))
+	{
+		return 0;
+	}
+
+	ringbuf__store_event_header(&ringbuf, PPME_SYSCALL_IO_URING_ENTER_X);
+
+	/*=============================== COLLECT PARAMETERS  ===========================*/
+
+	/* Parameter 1: res (type: PT_ERRNO) */
+	ringbuf__store_s64(&ringbuf, ret);
+
+	/* Parameter 2: fd (type: PT_FD) */
+	s32 fd = (s32)extract__syscall_argument(regs, 0);
+	ringbuf__store_s64(&ringbuf, (s64)fd);
+
+	/* Parameter 3: to_submit (type: PT_UINT32) */
+	u32 to_submit = (u32)extract__syscall_argument(regs, 1);
+	ringbuf__store_u32(&ringbuf, to_submit);
+
+	/* Parameter 4: min_complete (type: PT_UINT32) */
+	u32 min_complete = (u32)extract__syscall_argument(regs, 2);
+	ringbuf__store_u32(&ringbuf, min_complete);
+
+	/* Parameter 5: flags (type: PT_FLAGS32) */
+	u32 flags = (u32)extract__syscall_argument(regs, 3);
+	ringbuf__store_u32(&ringbuf, io_uring_enter_flags_to_scap(flags));
+
+	/* Parameter 6: sig (type: PT_SIGSET) */
+	/* This is unclear, why we store only the first 32 bit? this is a pointer!
+	 * It could be also a pointer to a `struct io_uring_getevents_args`.
+	 */
+	u32 sig = (u32)extract__syscall_argument(regs, 4);
+	ringbuf__store_u32(&ringbuf, sig);
+
+	/// TODO: We miss the last parameter `size_t argsz`
+	/// we need to implement it in all our drivers
+
+	/*=============================== COLLECT PARAMETERS  ===========================*/
+
+	ringbuf__submit_event(&ringbuf);
+
+	return 0;
+}
+
+/*=============================== EXIT EVENT ===========================*/