feat(events): io_uring

[NDStrahilevitz]

1. Explain what the PR does

"Replace me with make check-pr output"

2. Explain how to test it

3. Other comments

Close #309

[codecov]

Codecov Report

❌ Patch coverage is 0% with 33 lines in your changes missing coverage. Please review.
✅ Project coverage is 30.09%. Comparing base (034cbab) to head (dcd9c12).
⚠️ Report is 31 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/events/parse_args.go	0.00%	22 Missing ⚠️
pkg/ebpf/probes/probe_group.go	0.00%	11 Missing ⚠️

❌ Your patch check has failed because the patch coverage (0.00%) is below the target coverage (60.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5069      +/-   ##
==========================================
+ Coverage   29.72%   30.09%   +0.36%     
==========================================
  Files         234      232       -2     
  Lines       26186    25895     -291     
==========================================
+ Hits         7785     7793       +8     
+ Misses      17864    17565     -299     
  Partials      537      537              

Flag	Coverage Δ
unit	30.09% <0.00%> (+0.36%)	⬆️

Files with missing lines	Coverage Δ
pkg/events/core.go	50.00% <ø> (ø)
pkg/events/definition_dependencies.go	9.17% <ø> (-2.60%)	⬇️
pkg/server/grpc/tracee.go	61.47% <ø> (ø)
pkg/ebpf/probes/probe_group.go	0.00% <0.00%> (ø)
pkg/events/parse_args.go	12.78% <0.00%> (-0.45%)	⬇️

... and 8 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[NDStrahilevitz]

5.4 status:

We need some probe to extract the context for write operations. The issue is that io_uring_create has no kernel symbol, and nor does the alternative from the original PR io_sq_offload_start. Both are not defined in any header and therefore do not appear as attachable symbols.

The solution is to use the wrapping io_uring_setup. This calls io_uring_create, so 5.5+ will have a slight timing advantage. But we should have fundamentally the same io_uring_params struct result if we attach to the return.

[NDStrahilevitz]

status: the io_uring_setup probe fails to attach on fallback because of lacking an FD. It lacks an FD because fallback programs are not autoloaded. Therefore we can either:

1. Implement runtime program loading (might be limited in libbpf)
2. Autoload fallbacks
3. Give up 5.4 support

I think that we must at least do 2 if we are to support fallbacks. Ideally we should give 1.