Skip to content

Commit

Permalink
fixup! fixup! fixup! feat(events): add io_uring visibility
Browse files Browse the repository at this point in the history
  • Loading branch information
@roikol
roikol committed Nov 8, 2023
1 parent 7ac0b2c commit 9227f5e
Showing 1 changed file with 55 additions and 58 deletions.
113 changes: 55 additions & 58 deletions pkg/ebpf/c/tracee.bpf.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5111,12 +5111,12 @@ common_submit_io_issue_sqe(program_data_t *p, struct io_kiocb *req, u8 opcode, u
u32 ctx_flags = BPF_CORE_READ(uring_ctx, flags);
bool sq_thread = ctx_flags & IORING_SETUP_SQPOLL;
struct file *file = BPF_CORE_READ(req, file);
if (file == NULL) {
// file is null in first invocation of io_issue_sqe.
// in the second invocation, file is valid, but context is of async worker.
// we take care of the context below.
return 0;
}
// if (file == NULL) {
// // file is null in first invocation of io_issue_sqe.
// // in the second invocation, file is valid, but context is of async worker.
// // we take care of the context below.
// return 0;
// }
file_info_t file_info = get_file_info(file);

u32 host_tid = p->task_info->context.host_tid;
Expand Down Expand Up @@ -5146,17 +5146,17 @@ int BPF_KPROBE(trace_io_issue_sqe)
if (!init_program_data(&p, ctx))
return 0;

if (!should_trace((&p)))
return 0;
// if (!should_trace((&p)))
// return 0;

// io_uring was introduced in kernel v5.1.
// this check is to satisfy the verifier in older kernels.
if (!bpf_core_type_exists(struct io_kiocb)) {
return 0;
}

if (!should_submit(IO_ISSUE_SQE, p.event))
return 0;
// if (!should_submit(IO_ISSUE_SQE, p.event))
// return 0;

struct io_kiocb___io_issue_sqe *req = (struct io_kiocb___io_issue_sqe *) PT_REGS_PARM1(ctx);

Expand Down Expand Up @@ -5209,18 +5209,15 @@ int BPF_KPROBE(trace__io_submit_sqe)
if (!init_program_data(&p, ctx))
return 0;

if (!should_trace(&p))
return 0;
// if (!should_trace(&p))
// return 0;

// io_uring was introduced in kernel v5.1.
// this check is to satisfy the verifier in older kernels.
if (!bpf_core_type_exists(struct io_kiocb)) {
return 0;
}

if (!should_submit(IO_ISSUE_SQE, p.event) || !should_submit(IO_WRITE, p.event))
return 0;

struct io_kiocb___older_v55 *req = (struct io_kiocb___older_v55 *) PT_REGS_PARM2(ctx);

if (!bpf_core_field_exists(req->submit)) { // Version >= v5.5
Expand All @@ -5231,51 +5228,51 @@ int BPF_KPROBE(trace__io_submit_sqe)
u32 host_tid = p.task_info->context.host_tid;
struct sqe_submit submit = BPF_CORE_READ(req, submit);

if (should_submit(IO_ISSUE_SQE, p.event)) {
// v5.1 - v5.4: handled in trace__io_submit_sqe
// v5.5 - v5.16: handled in trace_io_issue_sqe
// v5.17 - v6.6: handled in trace_ret_io_assign_file
// args:
// - opcode
// v5.1 - v5.4: req->submit.opcode
// v5.5 - v6.6: req->opcode
// - user_data
// v5.1 - v5.18: req->user_data
// v5.19 - v6.6: req->cqe.user_data
// - flags
// v5.1 - v6.6: req->flags
// - file
// v5.1 - v6.6: req->file
// - sq_thread
// v5.1 - v6.6: req->ctx->flags & IORING_SETUP_SQPOLL

// v5.1 - v5.4:
// bpf_core_field_exists(req->submit)
// v5.19 - v6.6:
// bpf_core_field_exists(req->cqe)

// extract args for the event
u8 opcode = submit.opcode;
u64 user_data = BPF_CORE_READ(req, user_data);

// submit io_issue_sqe
common_submit_io_issue_sqe(&p, (struct io_kiocb *) req, opcode, &user_data);

// Do not corrupt the buffer for the io_write event
reset_event_args(&p);
}
// if (should_submit(IO_ISSUE_SQE, p.event)) {
// v5.1 - v5.4: handled in trace__io_submit_sqe
// v5.5 - v5.16: handled in trace_io_issue_sqe
// v5.17 - v6.6: handled in trace_ret_io_assign_file
// args:
// - opcode
// v5.1 - v5.4: req->submit.opcode
// v5.5 - v6.6: req->opcode
// - user_data
// v5.1 - v5.18: req->user_data
// v5.19 - v6.6: req->cqe.user_data
// - flags
// v5.1 - v6.6: req->flags
// - file
// v5.1 - v6.6: req->file
// - sq_thread
// v5.1 - v6.6: req->ctx->flags & IORING_SETUP_SQPOLL

// v5.1 - v5.4:
// bpf_core_field_exists(req->submit)
// v5.19 - v6.6:
// bpf_core_field_exists(req->cqe)

if (should_submit(IO_WRITE, p.event)) {
// get write info from req
struct kiocb kiocb = BPF_CORE_READ(req, rw);
const struct io_uring_sqe *sqe = submit.sqe;
u64 addr = BPF_CORE_READ(sqe, addr);
void *buf = (void *) addr;
u32 len = BPF_CORE_READ(sqe, len);
// extract args for the event
u8 opcode = submit.opcode;
u64 user_data = BPF_CORE_READ(req, user_data);

// submit io_write
common_submit_io_write(&p, (struct io_kiocb *) req, &kiocb, host_tid, buf, len, 0);
}
// submit io_issue_sqe
common_submit_io_issue_sqe(&p, (struct io_kiocb *) req, opcode, &user_data);

// Do not corrupt the buffer for the io_write event
reset_event_args(&p);
// }

// if (should_submit(IO_WRITE, p.event)) {
// get write info from req
struct kiocb kiocb = BPF_CORE_READ(req, rw);
const struct io_uring_sqe *sqe = submit.sqe;
u64 addr = BPF_CORE_READ(sqe, addr);
void *buf = (void *) addr;
u32 len = BPF_CORE_READ(sqe, len);

// submit io_write
common_submit_io_write(&p, (struct io_kiocb *) req, &kiocb, host_tid, buf, len, 0);
// }

return 0;
}
Expand Down

0 comments on commit 9227f5e

Please sign in to comment.