From a0d2c04ef4a3b733a9e2aed9488e937edd39e507 Mon Sep 17 00:00:00 2001 From: wubijie Date: Mon, 26 Jun 2023 17:28:42 +0800 Subject: [PATCH] Track and capture device I/O operations --- observation/src/biosnoop/biosnoop.bpf.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/observation/src/biosnoop/biosnoop.bpf.c b/observation/src/biosnoop/biosnoop.bpf.c index b95cd0ea..56d3ee4f 100644 --- a/observation/src/biosnoop/biosnoop.bpf.c +++ b/observation/src/biosnoop/biosnoop.bpf.c @@ -71,4 +71,26 @@ int BPF_PROG(blk_account_io_start, struct request *rq) return 0; return trace_pid(rq); -} \ No newline at end of file +<<<<<<< Updated upstream +} +======= +} + +SEC("kprobe/blk_account_io_start") +int BPF_KPROBE(kprobe_blk_account_io_start, struct request *rq) +{ + if (filter_memcg && !bpf_current_task_under_cgroup(&cgroup_map, 0)) + return 0; + + return trace_pid(rq); +} + +SEC("kprobe/blk_account_io_merge_bio") +int BPF_KPROBE(blk_account_io_merge_bio, struct request *rq) +{ + if (filter_memcg && !bpf_current_task_under_cgroup(&cgroup_map, 0)) + return 0; + + return trace_pid(rq); +} +>>>>>>> Stashed changes -- Gitee