Custom syscalls and io_uring subsystem calls by Avgor46 · Pull Request #52 · stackrox/berserker

Avgor46 · 2025-12-26T13:36:16Z

Hi!

We have implemented custom, user-parametrized syscall generation. Providing arguments to system calls allows them to complete successfully and makes the workload more “real.” We have also added initial support for generating io_uring subsystem events.

erthalion · 2026-01-05T11:26:35Z

@Avgor46 wow, thanks. It will take some time for me to review, stay tuned.

erthalion · 2026-01-15T15:24:31Z

src/worker/syscalls/connect.rs

+
+impl Drop for ConnectCall {
+    fn drop(&mut self) {
+        unsafe { File::from_raw_fd(self.sockfd as i32) };


@Avgor46 can you clarify why it's done this way? I assume it will make the file descriptor go away when leaving the scope, but why not just close it explicitly?

replaced all from_raw_fd to raw close syscall

Molter73

Thanks for this PR, it is quite extensive!

I'm leaving a few comments, I've gone through about half the syscalls. Still need to go through the io_uring stuff and the toml files, hopefully I can do that tomorrow morning.

Molter73 · 2026-01-15T15:59:07Z

src/lib.rs

+    let s = String::deserialize(deserializer)?;
+    let mut map = HashMap::new();
+    for arg in s.split(',').filter(|x| !x.is_empty()) {
+        let parts = arg.split_once('=');
+        let Some((key, value)) = parts else {
+            return Err(serde::de::Error::custom(
+                "invalid syscall arguments format",
+            ));
+        };
+        map.insert(key.to_string(), value.to_string());
+    }
+    Ok(map)


This might make the code a bit too dense, but how about doing this all in a single functional operation?

Suggested change

let s = String::deserialize(deserializer)?;

let mut map = HashMap::new();

for arg in s.split(',').filter(|x| !x.is_empty()) {

let parts = arg.split_once('=');

let Some((key, value)) = parts else {

return Err(serde::de::Error::custom(

"invalid syscall arguments format",

));

};

map.insert(key.to_string(), value.to_string());

}

Ok(map)

String::deserialize(deserializer)?

.split(',')

.filter(|x| !x.is_empty())

.map(|arg| match arg.split_once('=') {

Some((key, value)) => Ok((key.to_string(), value.to_string())),

None => Err(serde::de::Error::custom(

"invalid syscall arguments format",

)),

})

.collect::<Result<HashMap<_, _>, _>>()

Molter73 · 2026-01-15T16:00:24Z

src/lib.rs

+        let parts = arg.split_once('=');
+        let Some((key, value)) = parts else {
+            return Err(serde::de::Error::custom(
+                "invalid syscall arguments format",


We might want to consider adding the offending argument to this string to help debug the error.

Molter73 · 2026-01-15T16:06:40Z

Cargo.toml

 name = "berserker"
 version = "0.1.0"
-edition = "2021"
+edition = "2024"


Not a huge deal but do we need to update the edition? Is this a requirement from one of the new dependencies added?

I used 'let chains' feature, which is available in the 2024 edition

Oh cool, I missed that, thanks!

Molter73 · 2026-01-15T16:13:04Z

src/worker/syscalls/mod.rs

+        let rng = thread_rng();
+        let mut rng_iter = rng.sample_iter(exp);
+
+        let syscall = Sysno::from(*syscall_nr);


[nit] This same operation is being done in line 87, we can probably move this line above that and re-use syscall, since it seems Sysno is represented as an i32, so it shouldn't be a big deal to copy it.

Molter73 · 2026-01-15T16:28:18Z

src/worker/syscalls/listen.rs

+
+impl SysCaller for ListenCall {
+    fn init(&mut self) -> Result<usize, Errno> {
+        // Create socket directly instead of calling socket_call.call()


Suggested change

// Create socket directly instead of calling socket_call.call()

// Create socket directly instead of calling socket_call.call()

// since that would immediately close the fd.

Molter73 · 2026-01-15T16:38:51Z

src/worker/syscalls/mod.rs

+    } else {
+        default
+    }
+}


This might be a bit of overkill, but do we maybe want to have a wrapper type around HashMap<String, String> and make this the get method for that type? Something like this:

struct SyscallArgs(HashMap<String, String>); impl SyscallArgs { fn get<T: FromStr>(&self, name: &str, default: T) -> T { if let Some(arg) = self.0.get(name) { arg.parse().unwrap_or(default) } else { default } } }

It would make it clearer at call sites IMO, going from:

pub fn new(chmod_args: &HashMap<String, String>) -> Self { let pathname = get_argument(chmod_args, "pathname", CString::new("/tmp").unwrap()); // ...

To something like:

pub fn new(chmod_args: &SyscallArgs) -> Self { let pathname = chmod_args.get("pathname", CString::new("/tmp").unwrap());

Molter73 · 2026-01-15T16:40:10Z

src/worker/syscalls/chmod.rs

+}
+
+impl ChmodCall {
+    pub fn new(chmod_args: &HashMap<String, String>) -> Self {


[nit] I find it a bit redundant to have <syscall>_args on every new method when we are already in the syscall caller implementation block, any reason to not name the argument args directly?

yeah, args is nice

Molter73 · 2026-01-15T16:44:47Z

src/worker/syscalls/ioctl.rs

+#[derive(Debug)]
+pub struct IoctlCall {
+    pub fd: usize,
+    pub op: usize,
+    pub argp: usize,
+}
+
+impl IoctlCall {
+    pub fn new(_: &HashMap<String, String>) -> Self {
+        let fd = 0; // Will be initialized in init()
+        let op = 0; // Default value, can be overridden if needed
+        let argp = 0; // Default value, can be overridden if needed
+
+        Self { fd, op, argp }
+    }
+}


[nit]

Suggested change

#[derive(Debug)]

pub struct IoctlCall {

pub fd: usize,

pub op: usize,

pub argp: usize,

}

impl IoctlCall {

pub fn new(_: &HashMap<String, String>) -> Self {

let fd = 0; // Will be initialized in init()

let op = 0; // Default value, can be overridden if needed

let argp = 0; // Default value, can be overridden if needed

Self { fd, op, argp }

}

}

#[derive(Debug, Default)]

pub struct IoctlCall {

pub fd: usize,

pub op: usize,

pub argp: usize,

}

impl IoctlCall {

pub fn new(_: &HashMap<String, String>) -> Self {

// Zero initialize all fields, fd will be initialized in `Syscaller::init`.

// All other fields can be overridden as needed

Default::default()

}

}

Molter73 · 2026-01-15T16:54:37Z

src/worker/syscalls/mount.rs

+}
+
+impl SysCaller for MountCall {
+    fn call(&self) -> Result<usize, Errno> {


I know mount is probably only used with bogus inputs but, just in case it is not, do we want to umount if we successfully mounted the volume?

Molter73 · 2026-01-16T12:08:48Z

src/worker/io_uring/mod.rs

+                ),
+            }
+
+            // Otherwise calculate waiting time


Are we missing a tight loop check here?

Molter73 · 2026-01-16T12:11:46Z

src/worker/io_uring/mod.rs

+fn get_argument<T: FromStr>(
+    args: &HashMap<String, String>,
+    name: &str,
+    default: T,
+) -> T {
+    if let Some(arg) = args.get(name) {
+        arg.parse().unwrap_or(default)
+    } else {
+        default
+    }
+}


Similar comment about the SyscallArgs wrapper type here, maybe a IOUringArgs type? Or maybe an ArgsMap that we can use for both syscalls and io_uring? WDYT?

replaced SyscallArgs and IOUringArgs with ArgsMap

Molter73 · 2026-01-16T12:17:19Z

src/worker/io_uring/openat.rs

+            ring.submission()
+                .push(&self.openat)
+                .expect("submission queue is full");


Maybe we can be a bit more graceful here, unless we actually want to fully crash, but we probably don't.

Suggested change

ring.submission()

.push(&self.openat)

.expect("submission queue is full");

if ring.submission().push(&self.openat).is_err() {

return Err(Errno::ENOSPC);

}

Molter73 · 2026-01-16T12:24:06Z

src/worker/io_uring/openat.rs

+        ring.submit_and_wait(1).expect("submission failed");
+
+        let cqe = ring.completion().next().expect("completion queue is empty");


Similar comment about not panicking here, though these might be a bit harder.

I see this same error handling is done on other io_uring operations, we should change those as well of we change them here.

It was intended to indicate an error with the io_uring subsystem, and there is no reason to continue execution. However, classic error handling with Result has its own advantages. I don't know what the best choice is here. Nevertheless, replaced with Result.

Molter73 · 2026-01-16T12:31:12Z

workloads/syscalls/syscall.toml

+# How often to invoke a syscall. Parameter of exponential distribution.
+arrival_rate = 10.0
+# Syscall number to invoke.
+syscall_nr = 162


Not something to do here but, in the interest of being a bit more user friendly, we might want to allow specifying the syscall by name in the future.

erthalion · 2026-02-03T15:39:49Z

Did some testing, I think all looks good, thanks @Avgor46.

erthalion reviewed Jan 15, 2026

View reviewed changes

Molter73 reviewed Jan 15, 2026

View reviewed changes

Molter73 reviewed Jan 16, 2026

View reviewed changes

Avgor46 force-pushed the main branch from 744d540 to 0b4b937 Compare January 19, 2026 14:26

Avgor46 added 3 commits January 19, 2026 17:32

feat: Added custom syscalls

5c7d3e6

feat: Added custom io_uring calls

d68dc37

fix: Clippy and format

b0525ec

Avgor46 force-pushed the main branch from 0b4b937 to b0525ec Compare January 19, 2026 14:32

Avgor46 requested review from Molter73 and erthalion January 19, 2026 14:52

erthalion merged commit 82c7d22 into stackrox:main Feb 3, 2026
1 of 2 checks passed

	// Create socket directly instead of calling socket_call.call()
	// Create socket directly instead of calling socket_call.call()
	// since that would immediately close the fd.

		ring.submit_and_wait(1).expect("submission failed");

		let cqe = ring.completion().next().expect("completion queue is empty");

Conversation

Avgor46 commented Dec 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erthalion commented Jan 5, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Molter73 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Avgor46 Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

erthalion commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Avgor46 commented Dec 26, 2025 •

edited

Loading

Avgor46 Jan 19, 2026 •

edited

Loading