Skip to content

feat!: add PPME_SYSCALL_CLOSE_E fd param to PPME_SYSCALL_CLOSE_X#2475

Merged
poiana merged 1 commit intomasterfrom
ekoops/convert-close
Jun 17, 2025
Merged

feat!: add PPME_SYSCALL_CLOSE_E fd param to PPME_SYSCALL_CLOSE_X#2475
poiana merged 1 commit intomasterfrom
ekoops/convert-close

Conversation

@ekoops
Copy link
Copy Markdown
Contributor

@ekoops ekoops commented Jun 12, 2025

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR is part of #2427.

It extends PPME_SYSCALL_CLOSE_X event by adding the fd parameter to its definition and aligning all 3 kernel drivers and gvisor engine to it. It retains the sinsp parser logic associating the fdinfo to the close enter event, but removes any additional logic for it: this means that the notion of "close in progress" and "close canceled" have no meaning anymore and the corresponding code has been pruned.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

feat!: add `PPME_SYSCALL_CLOSE_E` fd param to `PPME_SYSCALL_CLOSE_X`

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Jun 12, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana requested review from gnosek and hbrueckner June 12, 2025 13:16
@github-actions
Copy link
Copy Markdown

github-actions bot commented Jun 12, 2025 •
edited
Loading

Perf diff from master - unit tests

    22.78%     -1.22%  [.] sinsp_thread_manager::create_thread_dependencies
     3.24%     -0.56%  [.] gzfile_read
     5.07%     -0.43%  [.] sinsp_thread_manager::find_thread
     7.03%     +0.41%  [.] sinsp::next
     5.43%     +0.35%  [.] sinsp_evt::get_type
     2.68%     -0.32%  [.] sinsp_thread_manager::get_thread_ref
     5.31%     -0.31%  [.] sinsp_parser::reset
     1.60%     +0.31%  [.] can_query_os_for_thread_info
     3.56%     +0.31%  [.] next_event_from_file
     0.72%     +0.28%  [.] sinsp_evt::get_ts

Heap diff from master - unit tests

peak heap memory consumption: -1.50K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: -114B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0076         -0.0076           147           146           147           146
BM_sinsp_split_median                                          -0.0090         -0.0090           147           146           147           146
BM_sinsp_split_stddev                                          +0.3661         +0.3659             1             1             1             1
BM_sinsp_split_cv                                              +0.3765         +0.3763             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  +0.0114         +0.0114            58            59            58            59
BM_sinsp_concatenate_paths_relative_path_median                +0.0347         +0.0347            57            59            57            59
BM_sinsp_concatenate_paths_relative_path_stddev                -0.0695         -0.0694             1             1             1             1
BM_sinsp_concatenate_paths_relative_path_cv                    -0.0800         -0.0799             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     +0.0315         +0.0315            24            25            24            25
BM_sinsp_concatenate_paths_empty_path_median                   +0.0269         +0.0269            24            24            24            24
BM_sinsp_concatenate_paths_empty_path_stddev                  +10.3320        +10.2633             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       +9.9858         +9.9192             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.0373         -0.0373            60            58            60            58
BM_sinsp_concatenate_paths_absolute_path_median                -0.0428         -0.0428            60            58            60            58
BM_sinsp_concatenate_paths_absolute_path_stddev                +1.1734         +1.1705             0             1             0             1
BM_sinsp_concatenate_paths_absolute_path_cv                    +1.2576         +1.2546             0             0             0             0

@ekoops ekoops mentioned this pull request Jun 12, 2025
Closed
@ekoops ekoops force-pushed the ekoops/convert-close branch from 4698a12 to 0a773a0 Compare June 12, 2025 13:36
@github-actions
Copy link
Copy Markdown

github-actions bot commented Jun 12, 2025 •
edited
Loading

X64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-4.19 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2-5.10 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2023-6.1 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.0 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.7 🟢 🟢 🟢 🟢 🟢 🟢
centos-3.10 🟢 🟢 🟢 🟡 🟡 🟡
centos-4.18 🟢 🟢 🟢 🟢 🟢 🟢
centos-5.14 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.17 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.8 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-3.10 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-4.14 🟢 🟢 🟢 🟢 ❌ 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-5.4 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-4.15 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-5.8 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

ARM64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

@codecov
Copy link
Copy Markdown

codecov bot commented Jun 12, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 98.21429% with 1 line in your changes missing coverage. Please review.

Project coverage is 77.94%. Comparing base (8aad951) to head (121c148).
Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
userspace/libsinsp/parsers.cpp 85.71% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #2475      +/-   ##
==========================================
+ Coverage   77.88%   77.94%   +0.05%     
==========================================
  Files         251      252       +1     
  Lines       31071    31085      +14     
  Branches     4653     4645       -8     
==========================================
+ Hits        24201    24229      +28     
+ Misses       6870     6856      -14
Flag Coverage Δ
libsinsp 77.94% <98.21%> (+0.05%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ekoops ekoops force-pushed the ekoops/convert-close branch from 0a773a0 to 3034fd5 Compare June 12, 2025 13:59
mstemm
mstemm requested changes Jun 12, 2025
View reviewed changes
@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Jun 12, 2025
@ekoops ekoops force-pushed the ekoops/convert-close branch from 3034fd5 to 2b49d4c Compare June 13, 2025 11:56
@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Jun 13, 2025

Notice: the kernel testing CI failure is due to an error which we are trying to address in #2477 and is not related to this PR.

@ekoops ekoops requested a review from mstemm June 13, 2025 12:01
@ekoops ekoops force-pushed the ekoops/convert-close branch from 2b49d4c to 4050f0e Compare June 13, 2025 12:10
@ekoops
feat!: add PPME_SYSCALL_CLOSE_E fd param to PPME_SYSCALL_CLOSE_X
121c148 
Extend `PPME_SYSCALL_CLOSE_X` event by adding the fd parameter to its
definition. Keep the sinsp parser logic associating the fdinfo to the
`close` enter event, but don't apply anymore any additional logic
for it: in other words, remove any code associated to the notion of
"close in progress" or "close canceled" as they have no meaning
anymore.

BREAKING CHANGE: remove `FLAGS_CLOSE_IN_PROGRESS` and
  `FLAGS_CLOSE_CANCELED` `sinsp_fdinfo::flags`

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
@ekoops ekoops force-pushed the ekoops/convert-close branch from 4050f0e to 121c148 Compare June 16, 2025 14:41
mstemm
mstemm approved these changes Jun 16, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@mstemm mstemm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the changes!

@poiana poiana added the lgtm label Jun 16, 2025
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Jun 16, 2025

LGTM label has been added.

DetailsGit tree hash: 7bd5e4d5fe6c51ee1ef24d88cbcfa28bb18972b4

@poiana poiana merged commit da0f8f0 into master Jun 17, 2025
69 of 70 checks passed
@poiana poiana deleted the ekoops/convert-close branch June 17, 2025 11:20
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Jun 17, 2025
@leogr leogr modified the milestones: 0.22.0, 9.0.0+driver Oct 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leogr leogr leogr approved these changes

@mstemm mstemm mstemm approved these changes

@gnosek gnosek Awaiting requested review from gnosek

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

Assignees

@leogr leogr

@mstemm mstemm

Labels

approved area/driver-bpf area/driver-kmod area/driver-modern-bpf area/libscap area/libscap-engine-gvisor area/libscap-engine-savefile area/libsinsp area/tests dco-signoff: yes kind/cleanup kind/feature New feature or request kind/test PRs increasing the test coverage without fixing any failing test lgtm release-note size/XL

Projects

Falco Roadmap
Archived in project

Milestone

9.0.0+driver

Development

Successfully merging this pull request may close these issues.

4 participants

@ekoops @poiana @leogr @mstemm