Skip to content

feat!: drop some syscalls enter events gen, testing and parsing code (part 2)#2591

Merged
poiana merged 9 commits intomasterfrom
ekoops/drop-syscalls-e
Aug 22, 2025
Merged

feat!: drop some syscalls enter events gen, testing and parsing code (part 2)#2591
poiana merged 9 commits intomasterfrom
ekoops/drop-syscalls-e

Conversation

@ekoops
Copy link
Copy Markdown
Contributor

@ekoops ekoops commented Aug 22, 2025

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR is part of #2588.

Specifically, this addresses the following system calls:

  • fstat
  • stat64
  • lstat64
  • fstat64
  • epoll_wait
  • poll
  • select
  • lseek
  • llseek

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

/milestone 0.22.0

Does this PR introduce a user-facing change?:

feat!: drop `llseek` enter events gen, testing and parsing code
feat!: drop `lseek` enter events gen, testing and parsing code
feat!: drop `select` enter events gen, testing and parsing code
feat!: drop `poll` enter events gen, testing and parsing code
feat!: drop `epoll_wait` enter events gen, testing and parsing code
feat!: drop `fstat64` enter events gen, testing and parsing code
feat!: drop `lstat64` enter events gen, testing and parsing code
feat!: drop `stat64` enter events gen, testing and parsing code
feat!: drop `fstat` enter events gen, testing and parsing code

ekoops added 9 commits August 22, 2025 15:47
As the `fstat` exit events contain all the information needed, drop
`fstat` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `fstat` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the `stat64` exit events contain all the information needed, drop
`stat64` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `stat64` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the `lstat64` exit events contain all the information needed, drop
`lstat64` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `lstat64` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the `fstat64` exit events contain all the information needed, drop
`fstat64` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `fstat64` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the `epoll_wait` exit events contain all the information needed,
drop `epoll_wait` enter events generation from all drivers, and all
related testing and parsing code.

BREAKING CHANGE: drop `epoll_wait` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the `poll` exit events contain all the information needed, drop
`poll` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `poll` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the `select` exit events contain all the information needed, drop
`select` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `select` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the `lseek` exit events contain all the information needed, drop
`lseek` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `lseek` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the `llseek` exit events contain all the information needed, drop
`llseek` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `llseek` enter events generation and parsing

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
@github-actions
Copy link
Copy Markdown

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Aug 22, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Aug 22, 2025

Not bumping the driver schema version is currently a practice we are following as we will bump it in a single shot once we are done with the #2068 proposal.
/hold cancel

@codecov
Copy link
Copy Markdown

codecov bot commented Aug 22, 2025

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 78.17%. Comparing base (a5fb0fb) to head (02c74d2).
⚠️ Report is 9 commits behind head on master.

Files with missing lines Patch % Lines
userspace/libsinsp/sinsp_filtercheck_fdlist.cpp 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2591      +/-   ##
==========================================
- Coverage   78.17%   78.17%   -0.01%     
==========================================
  Files         298      298              
  Lines       32088    32087       -1     
  Branches     4691     4691              
==========================================
- Hits        25084    25083       -1     
  Misses       7004     7004              
Flag Coverage Δ
libsinsp 78.17% <50.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ekoops ekoops force-pushed the ekoops/drop-syscalls-e branch from 576d549 to 5ce7df4 Compare August 22, 2025 14:17
@github-actions
Copy link
Copy Markdown

github-actions bot commented Aug 22, 2025

X64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-4.19 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2-5.10 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2023-6.1 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.0 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.7 🟢 🟢 🟢 🟢 🟢 🟢
centos-3.10 🟢 🟢 🟢 🟡 🟡 🟡
centos-4.18 🟢 🟢 🟢 🟢 🟢 🟢
centos-5.14 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.17 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.8 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-3.10 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-4.14 🟢 🟢 🟢 🟢 🟢 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-5.4 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-4.15 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-5.8 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

ARM64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

@poiana poiana added size/L and removed size/XXL labels Aug 22, 2025
@ekoops ekoops changed the title feat!: drop some syscalls enter events gen, testing and parsing code (part 2) wip: feat!: drop some syscalls enter events gen, testing and parsing code (part 2) Aug 22, 2025
@github-actions
Copy link
Copy Markdown

Perf diff from master - unit tests

   100.00%    -99.59%  [.] 0x000000000007ee90

Heap diff from master - unit tests

peak heap memory consumption: -110.26K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 373.52K

Heap diff from master - scap file

peak heap memory consumption: 7.90K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0159         -0.0158           146           144           146           144
BM_sinsp_split_median                                          -0.0168         -0.0169           147           144           147           144
BM_sinsp_split_stddev                                          -0.0071         -0.0173             1             1             1             1
BM_sinsp_split_cv                                              +0.0089         -0.0015             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0698         -0.0697            64            59            64            59
BM_sinsp_concatenate_paths_relative_path_median                -0.0482         -0.0483            64            61            64            61
BM_sinsp_concatenate_paths_relative_path_stddev               +11.1621        +11.1888             0             3             0             3
BM_sinsp_concatenate_paths_relative_path_cv                   +12.0747        +12.1022             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0270         -0.0269            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_median                   -0.0268         -0.0267            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_stddev                   +0.0395         +0.0394             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       +0.0683         +0.0680             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.0204         -0.0203            64            63            64            63
BM_sinsp_concatenate_paths_absolute_path_median                +0.0116         +0.0117            62            63            62            63
BM_sinsp_concatenate_paths_absolute_path_stddev                +0.0186         +0.0181             2             2             2             2
BM_sinsp_concatenate_paths_absolute_path_cv                    +0.0398         +0.0392             0             0             0             0

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Aug 22, 2025

LGTM label has been added.

DetailsGit tree hash: 5407de3cffcb59e4d2331c6db2aee0d52d53cd26

@ekoops ekoops changed the title wip: feat!: drop some syscalls enter events gen, testing and parsing code (part 2) feat!: drop some syscalls enter events gen, testing and parsing code (part 2) Aug 22, 2025
@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Aug 22, 2025
@poiana poiana merged commit e9f4896 into master Aug 22, 2025
106 of 112 checks passed
@poiana poiana deleted the ekoops/drop-syscalls-e branch August 22, 2025 20:36
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Aug 22, 2025
@leogr leogr modified the milestones: 0.22.0, 9.0.0+driver Oct 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

4 participants