Merge pull request #883 from sf1999817/test

fs_watcher:将disk_io_visit合并到fs_watcher里面，添加block_rq_issue挂载点

eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/block_rq_issue.bpf.c

@@ -0,0 +1,41 @@
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
+#include "block_rq_issue.h"
+
+char LICENSE[] SEC("license") = "Dual BSD/GPL";
+
+// 定义 ringbuf，用于传输事件信息
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 256 * 1024);
+} rb SEC(".maps");
+
+// 这里挂载点必须是struct trace_event_raw_block_rq_completion *ctx
+SEC("tracepoint/block/block_rq_issue")
+int tracepoint_block_rq_issue(struct trace_event_raw_block_rq_completion *ctx) {
+    struct event *e;
+    char comm[TASK_COMM_LEN];
+
+    // 分配 ringbuf 空间
+    e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
+    if (!e) {
+        return 0;  // 如果分配失败，提前返回
+    }
+
+    // 填充事件数据
+    e->timestamp = bpf_ktime_get_ns();
+    e->dev = ctx->dev;  // 读取设备号
+    e->sector = ctx->sector;  // 读取扇区号
+    e->nr_sectors = ctx->nr_sector;  // 读取扇区数
+
+    // 获取进程名
+    bpf_get_current_comm(comm, sizeof(comm));
+    __builtin_memcpy(e->comm, comm, sizeof(comm));
+
+    // 提交事件
+    bpf_ringbuf_submit(e, 0);
+
+    return 0;
+}

eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/block_rq_issue.c

@@ -0,0 +1,92 @@
+#include <stdio.h>
+#include <signal.h>
+#include <time.h>
+#include <bpf/libbpf.h>
+#include "block_rq_issue.h"
+#include "block_rq_issue.skel.h"
+
+static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
+{
+    return vfprintf(stderr, format, args);
+}
+
+static volatile bool exiting = false;
+
+static void sig_handler(int sig)
+{
+    exiting = true;
+}
+
+static int handle_event_block_rq_issue(void *ctx, void *data,unsigned long data_sz) {
+    const struct event *e = data;
+
+    printf("%-10llu %-9d %-7d %-4d %-16s\n",
+           e->timestamp, e->dev, e->sector, e->nr_sectors,e->comm);
+
+    return 0;
+}
+
+int main(int argc, char **argv)
+{
+    struct ring_buffer *rb = NULL;
+    struct block_rq_issue_bpf *skel;
+    int err;
+
+    /* Set up libbpf errors and debug info callback */
+    libbpf_set_print(libbpf_print_fn);
+
+    /* Cleaner handling of Ctrl-C */
+    signal(SIGINT, sig_handler);
+    signal(SIGTERM, sig_handler);
+
+    /* Open BPF application */
+    skel = block_rq_issue_bpf__open();
+    if (!skel) {
+        fprintf(stderr, "Failed to open BPF skeleton\n");
+        return 1;
+    }
+
+    /* Load & verify BPF programs */
+    err = block_rq_issue_bpf__load(skel);
+    if (err) {
+        fprintf(stderr, "Failed to load and verify BPF skeleton\n");
+        goto cleanup;
+    }
+
+    /* Attach tracepoints */
+    err = block_rq_issue_bpf__attach(skel);
+    if (err) {
+        fprintf(stderr, "Failed to attach BPF skeleton\n");
+        goto cleanup;
+    }
+
+    /* Set up ring buffer polling */
+    rb = ring_buffer__new(bpf_map__fd(skel->maps.rb), handle_event_block_rq_issue, NULL, NULL);
+    if (!rb) {
+        err = -1;
+        fprintf(stderr, "Failed to create ring buffer\n");
+        goto cleanup;
+    }
+
+    printf("%-18s %-7s %-7s %-4s %-7s %-16s\n","TIME", "DEV", "SECTOR", "RWBS", "COUNT", "COMM");
+    while (!exiting) {
+        err = ring_buffer__poll(rb, 100 /* timeout, ms */);
+        /* Ctrl-C will cause -EINTR */
+        if (err == -EINTR) {
+            err = 0;
+            break;
+        }
+
+        if (err < 0) {
+            printf("Error polling ring buffer: %d\n", err);
+            break;
+        } 
+    }
+
+cleanup:
+    /* Clean up */
+    ring_buffer__free(rb);
+    block_rq_issue_bpf__destroy(skel);
+
+    return err < 0 ? -err : 0;
+}

eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/block_rq_issue.h

@@ -0,0 +1,14 @@
+#ifndef BLOCK_RQ_ISSUE_H
+#define BLOCK_RQ_ISSUE_H
+
+#define TASK_COMM_LEN 256
+
+struct event {
+    long timestamp;       // 时间戳
+    int dev;           // 设备号
+    int sector;         // 扇区号
+    int nr_sectors;     // 扇区数
+    char comm[TASK_COMM_LEN]; // 进程名
+};
+
+#endif // BLOCK_RQ_ISSUE

eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/disk_io_visit.bpf.c

@@ -0,0 +1,71 @@
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
+#include "disk_io_visit.h"
+
+char LICENSE[] SEC("license") = "Dual BSD/GPL";
+
+// 定义 ringbuf，用于传输事件信息
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 256 * 1024);
+} rb SEC(".maps");
+
+// 进程名与 I/O 计数映射
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 1024);
+    __type(key, char[TASK_COMM_LEN]);
+    __type(value, u32);
+} io_count_map SEC(".maps");
+
+// 这里挂载点得是这个struct trace_event_raw_block_rq_completion *ctx
+SEC("tracepoint/block/block_rq_complete")
+int tracepoint_block_visit(struct trace_event_raw_block_rq_completion *ctx) {
+    struct event *e;
+    u32 *count, new_count;
+    char comm[TASK_COMM_LEN];
+
+    // 获取当前进程名
+    bpf_get_current_comm(comm, sizeof(comm));
+
+    // 查找或初始化该进程的I/O计数
+    count = bpf_map_lookup_elem(&io_count_map, comm);
+    if (count) {
+        new_count = *count + 1;
+    } else {
+        new_count = 1;
+    }
+    bpf_map_update_elem(&io_count_map, comm, &new_count, BPF_ANY);
+
+    // 分配 ringbuf 空间
+    e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
+    if (!e) {
+        return 0;  // 如果分配失败，提前返回
+    }
+
+    // 填充事件数据
+    e->timestamp = bpf_ktime_get_ns();
+    e->blk_dev = ctx->dev;  // 直接读取块设备号
+    e->sectors = ctx->nr_sector;  // 读取操作的扇区数
+
+    // 判断读写标识符 (检查 rwbs 数组的内容)
+    if (ctx->rwbs[0] == 'R') {
+        e->rwbs = 1;  // 1 表示读操作
+    } else {
+        e->rwbs = 0;  // 0 表示写操作
+    }
+
+    // 更新 I/O 操作计数
+    e->count = new_count;
+
+    // 复制进程名
+    __builtin_memcpy(e->comm, comm, sizeof(comm));
+    bpf_printk("comm : %s\n",e->comm);
+
+    // 提交事件
+    bpf_ringbuf_submit(e, 0);
+
+    return 0;
+}

eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/disk_io_visit.c

@@ -0,0 +1,93 @@
+#include <stdio.h>
+#include <signal.h>
+#include <time.h>
+#include <bpf/libbpf.h>
+#include "disk_io_visit.h"
+#include "disk_io_visit.skel.h"
+#include <inttypes.h> // For PRIu64
+
+static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
+{
+    return vfprintf(stderr, format, args);
+}
+
+static volatile bool exiting = false;
+
+static void sig_handler(int sig)
+{
+    exiting = true;
+}
+
+static int handle_event_disk_io_visit(void *ctx, void *data,unsigned long data_sz) {
+    const struct event *e = data;
+
+    printf("%-10llu %-9d %-7d %-4d %-7d %-16s\n",
+           e->timestamp, e->blk_dev, e->sectors, e->rwbs, e->count, e->comm);
+
+    return 0;
+}
+
+int main(int argc, char **argv)
+{
+    struct ring_buffer *rb = NULL;
+    struct disk_io_visit_bpf *skel;
+    int err;
+
+    /* Set up libbpf errors and debug info callback */
+    libbpf_set_print(libbpf_print_fn);
+
+    /* Cleaner handling of Ctrl-C */
+    signal(SIGINT, sig_handler);
+    signal(SIGTERM, sig_handler);
+
+    /* Open BPF application */
+    skel = disk_io_visit_bpf__open();
+    if (!skel) {
+        fprintf(stderr, "Failed to open BPF skeleton\n");
+        return 1;
+    }
+
+    /* Load & verify BPF programs */
+    err = disk_io_visit_bpf__load(skel);
+    if (err) {
+        fprintf(stderr, "Failed to load and verify BPF skeleton\n");
+        goto cleanup;
+    }
+
+    /* Attach tracepoints */
+    err = disk_io_visit_bpf__attach(skel);
+    if (err) {
+        fprintf(stderr, "Failed to attach BPF skeleton\n");
+        goto cleanup;
+    }
+
+    /* Set up ring buffer polling */
+    rb = ring_buffer__new(bpf_map__fd(skel->maps.rb), handle_event_disk_io_visit, NULL, NULL);
+    if (!rb) {
+        err = -1;
+        fprintf(stderr, "Failed to create ring buffer\n");
+        goto cleanup;
+    }
+
+    printf("%-18s %-7s %-7s %-4s %-7s %-16s\n","TIME", "DEV", "SECTOR", "RWBS", "COUNT", "COMM");
+    while (!exiting) {
+        err = ring_buffer__poll(rb, 100 /* timeout, ms */);
+        /* Ctrl-C will cause -EINTR */
+        if (err == -EINTR) {
+            err = 0;
+            break;
+        }
+
+        if (err < 0) {
+            printf("Error polling ring buffer: %d\n", err);
+            break;
+        } 
+    }
+
+cleanup:
+    /* Clean up */
+    ring_buffer__free(rb);
+    disk_io_visit_bpf__destroy(skel);
+
+    return err < 0 ? -err : 0;
+}

eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/disk_io_visit.h

@@ -0,0 +1,15 @@
+#ifndef DISK_IO_VISIT_H
+#define DISK_IO_VISIT_H
+
+#define TASK_COMM_LEN 256
+
+struct event {
+    long timestamp; // 时间戳
+    int blk_dev; // 块设备号
+    int sectors; // 访问的扇区数
+    int rwbs; // 读写标识符，1表示读操作，0表示写操作
+    int count; // I/O 操作计数
+    char comm[TASK_COMM_LEN]; // 进程名
+};
+
+#endif // DISK_IO_VISIT_H