Skip to content

Commit d2773bb

Browse files
niebowen666niebowen666
committed
This commit include the source code of the tool named ext4file, which is used to monitor the I/O patterns (buffer or direct) of each file in the target ext4 filesystem, as well as the hint used by each file.
ext4file is used to monitor the I/O patterns (buffer or direct) of each file in the target ext4 filesystem, as well as the hint used by each file. ext4file is a tool used to track file-level buffer or direct I/O. Currently, in the repository, there exist block-layer tools to monitor I/O patterns of whole disk (such as biopattern, biolatency, etc.) and VFS-layer tools to trace file lifecycle and I/O behavior of files throughout the entire VFS (such as filelife and vfsstat, etc.). Below is a comparative summary: | Tool Name | Layer | Main Function | Tracks Filename? | Differences | |---------------|---------------------|---------------------------------------------------------------------------------------------------------------|------------------|------------------------| | biopattern | Block | Measures the proportion of random vs. sequential I/O on a storage device | No | Can not achieve file-layer tracing(The other bio tools all have this problem) | | fsdist | VFS | Tracks latency distribution of operations like read, write, open, and sync | No | Focus on latency, not I/O pattern | | fsslower | VFS | Traces slow file operations (e.g., long-latency reads/writes), focuses on I/O size | Yes| Trace the I/O size and latency, not I/O pattern | | filelife | VFS | Monitors file lifecycle events (creation and deletion) | Yes| Only focus on file creation and deletion | | filetop | VFS | Shows real-time I/O activity of active files (displays only top entries to avoid verbosity) | Yes| There exists no distinction between buffer and direct I/O | | ext4file | ext4 Filesystem | Tracks **buffer vs. direct I/O patterns** per file, enables fine-grained file-level monitoring using inode | Yes| | Run ext4file before executing your test. You can refer to ./ext4file -h to get the usage of the tool Show I/O pattern for every file in ext4 filesystem. Usage: ./ext4file [-h] [-d DIR] [-o FILE] [interval] [count] Options: -h, --help Print this help message -d DIR, --dir=DIR Trace the ext4 filesystem mounted on the specified directory -o FILE, --output=FILE Write output to a file (optional; default: stdout) interval Time interval (in seconds) between reports (default: unlimited) count Number of reports to generate (default: unlimited) Examples: ./ext4file -d /mnt/ext4 # Trace I/O patterns of files on the ext4 filesystem mounted at /mnt/ext4 ./ext4file -d /mnt/ext4 1 10 # Generate 10 reports, one per second ./ext4file -d /mnt/ext4 -o output 1 10 # Generate 10 reports at 1-second intervals, saving output to ./output The output could be: root@server:/home/nbw/OpenSource/biohint/libbpf-tools# ./ext4file -d /mnt/ext4File/ EXT4 Filesystem Info: blocks_count=3750232064 blocks_per_group=32768 bg_cnt=114448 Tracing Ext4 read/write... Hit Ctrl-C to end. 2026-01-14 13:58:21 file_name inode pa_inode hint buffer_read direct_read buffer_write direct_write delete test3 83361794 83361793 0 0 0 0 0 False test2 34 2 2 8 0 1 0 False dir1 83361793 2 0 0 0 0 0 False dir2 440467457 2 0 0 0 0 0 True test3 33 2 3 8 0 1 0 False test1 33 2 5 8 0 1 0 True test3 440467458 440467457 0 0 0 0 0 True Below is the detailed explanation of each field in the ext4file output. This tool traces per-file I/O patterns (buffered vs. direct) on ext4 filesystems, providing fine-grained visibility into application behavior. | Field | Description | |---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | file_name | The name of the file (without full path). Note: multiple files may share the same name. | | inode | The inode number of the file. Inode is the unique identifier for a file within the filesystem, even across renames or hard links. This enables accurate tracking of I/O for specific files. | | pa_inode | The inode number of the file’s parent directory. | | hint | The FDP (Flexible Data Placement) hint value associated with the file. FDP is a new NVMe feature that enables the host to guide data placement on the SSD. | | buffer_read | Number of buffered read operations performed on the file. Buffered I/O goes through the kernel page cache. | | direct_read | Number of direct read operations performed on the file. Direct I/O bypasses the page cache. | | direct_write | Number of direct write operations performed on the file. Like direct read, it skips the page cache and writes data directly from user space to storage. | | buffer_write | Number of buffered write operations performed on the file. Data is first written to the page cache and later flushed to disk asynchronously by the kernel. | | delete | Indicates whether the file has been unlinked (deleted). If True, the file was removed from the directory but may still be accessible if held open by a process. I/O on such files can indicate resource leaks or long-running file handles. | This tool is intended for ext4 filesystem developers and performance engineers who need to analyze I/O behavior at the file level. Was there a specific reason for separating them into two maps? - ext4file tracks the deletion of files. We envision that users need to frequently create and delete files, and the file descriptor (fd) resources in the kernel are limited, so fd reuse may occur. In this case, an fd may not represent a specific file. Based on the idea, we believe that the existing method of uniquely representing a file is more reasonable.
1 parent ec8415b commit d2773bb

4 files changed

Lines changed: 547 additions & 0 deletions

File tree

‎libbpf-tools/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ APPS = \
5555
drsnoop \
5656
execsnoop \
5757
exitsnoop \
58+
ext4file \
5859
filelife \
5960
filetop \
6061
fsdist \

‎libbpf-tools/ext4file.bpf.c‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
2+
// Copyright (c) 2026 Samsung Electronics Co., Ltd.
3+
#include <vmlinux.h>
4+
#include <bpf/bpf_helpers.h>
5+
#include <bpf/bpf_tracing.h>
6+
#include <bpf/bpf_core_read.h>
7+
8+
#include "ext4file.h"
9+
10+
volatile __u64 dev_target = 0;
11+
volatile __u64 blocks_per_group = 0;
12+
13+
#define N 16
14+
#define GROUP 64
15+
16+
struct {
17+
__uint(type, BPF_MAP_TYPE_HASH);
18+
__uint(max_entries, 1000000);
19+
__type(key, u32);
20+
__type(value, struct file_info_key);
21+
} ino_name_map SEC(".maps");
22+
23+
struct {
24+
__uint(type, BPF_MAP_TYPE_HASH);
25+
__uint(max_entries, 1000000);
26+
__type(key, struct file_info_key);
27+
__type(value, struct file_info_val);
28+
} file_info_map SEC(".maps");
29+
30+
static __always_inline bool str_equal(const char *a, const char *b) {
31+
for (size_t i = 0; i < MAX_FILE_NAME; i++) {
32+
if (a[i] == '\0' && b[i] == '\0')
33+
return true;
34+
if (a[i] != b[i])
35+
return false;
36+
}
37+
return true;
38+
}
39+
40+
SEC("fexit/ext4_add_entry")
41+
int BPF_PROG(my_ext4_add_entry, handle_t *handle,
42+
struct dentry *dentry, struct inode *inode)
43+
{
44+
struct inode *pa_inode = dentry->d_parent->d_inode;
45+
dev_t dev_cur = pa_inode->i_sb->s_dev;
46+
u64 ino_id = inode->i_ino;
47+
struct file_info_key fik = {};
48+
struct file_info_val fiv = {};
49+
50+
if (dev_target && dev_target != dev_cur)
51+
return 0;
52+
53+
fik.fk_ino = ino_id;
54+
fik.fk_pa_ino = pa_inode->i_ino;
55+
bpf_probe_read_str(&fik.fk_name,
56+
sizeof(fik.fk_name), dentry->d_name.name);
57+
58+
if (bpf_map_update_elem(&file_info_map, &fik, &fiv, BPF_ANY))
59+
return 0;
60+
if (bpf_map_update_elem(&ino_name_map, &ino_id, &fik, BPF_ANY))
61+
return 0;
62+
return 0;
63+
}
64+
65+
SEC("tp_btf/ext4_unlink_enter")
66+
int BPF_PROG(my_ext4_unlink,
67+
struct inode *pa_inode, struct dentry *dentry)
68+
{
69+
struct inode *inode = dentry->d_inode;
70+
struct file_info_key fik = {}, *fikp;
71+
struct file_info_val *fivp = NULL;
72+
u64 ino_id = inode->i_ino;
73+
dev_t dev_cur = pa_inode->i_sb->s_dev;
74+
if (dev_target && dev_target != dev_cur)
75+
return 0;
76+
77+
fik.fk_ino = inode->i_ino;
78+
fik.fk_pa_ino = pa_inode->i_ino;
79+
bpf_probe_read_str(&fik.fk_name,
80+
sizeof(fik.fk_name), dentry->d_name.name);
81+
fivp = bpf_map_lookup_elem(&file_info_map, &fik);
82+
if (!fivp)
83+
return 0;
84+
fivp->fv_delete = true;
85+
fikp = bpf_map_lookup_elem(&ino_name_map, &ino_id);
86+
if (!fikp)
87+
return 0;
88+
if (str_equal(fikp->fk_name, fik.fk_name))
89+
bpf_map_delete_elem(&ino_name_map, &ino_id);
90+
return 0;
91+
}
92+
93+
SEC("fentry/ext4_rmdir")
94+
int BPF_PROG(my_ext4_rmdir,
95+
struct inode *dir, struct dentry *dentry)
96+
{
97+
struct inode *inode = dentry->d_inode;
98+
struct file_info_key fik = {}, *fikp;
99+
struct file_info_val *fivp = NULL;
100+
u64 ino_id = inode->i_ino;
101+
dev_t dev_cur = inode->i_sb->s_dev;
102+
if (dev_target && dev_target != dev_cur)
103+
return 0;
104+
105+
fik.fk_ino = inode->i_ino;
106+
fik.fk_pa_ino = dir->i_ino;
107+
bpf_probe_read_str(&fik.fk_name,
108+
sizeof(fik.fk_name), dentry->d_name.name);
109+
fivp = bpf_map_lookup_elem(&file_info_map, &fik);
110+
if (!fivp)
111+
return 0;
112+
fivp->fv_delete = true;
113+
114+
fikp = bpf_map_lookup_elem(&ino_name_map, &ino_id);
115+
if (!fikp)
116+
return 0;
117+
if (str_equal(fikp->fk_name, fik.fk_name))
118+
bpf_map_delete_elem(&ino_name_map, &ino_id);
119+
return 0;
120+
}
121+
122+
SEC("fentry/ext4_file_write_iter")
123+
int BPF_PROG(my_ext4_file_write_iter,
124+
struct kiocb *iocb, struct iov_iter *from)
125+
{
126+
struct inode *inode = iocb->ki_filp->f_inode;
127+
dev_t dev_cur = inode->i_sb->s_dev;
128+
struct file_info_key *fikp = NULL;
129+
struct file_info_val *fivp = NULL;
130+
u64 ino_id = inode->i_ino;
131+
132+
if (dev_target && dev_target != dev_cur)
133+
return 0;
134+
135+
fikp = bpf_map_lookup_elem(&ino_name_map, &ino_id);
136+
if (!fikp)
137+
return 0;
138+
fivp = bpf_map_lookup_elem(&file_info_map, fikp);
139+
if (!fivp)
140+
return 0;
141+
142+
fivp->fv_hint = inode->i_write_hint;
143+
if(iocb->ki_flags & IOCB_DIRECT)
144+
__sync_fetch_and_add(&fivp->fv_rw_cnt[RW_TYPE_DIRECT_WRITE], 1);
145+
else
146+
__sync_fetch_and_add(&fivp->fv_rw_cnt[RW_TYPE_BUFFER_WRITE], 1);
147+
return 0;
148+
}
149+
150+
SEC("fentry/ext4_file_read_iter")
151+
int BPF_PROG(my_ext4_file_read_iter,
152+
struct kiocb *iocb, struct iov_iter *to)
153+
{
154+
struct file *file = iocb->ki_filp;
155+
struct inode *inode = file->f_inode;
156+
dev_t dev_cur = inode->i_sb->s_dev;
157+
struct file_info_key *fikp = NULL;
158+
struct file_info_val *fivp = NULL;
159+
u64 ino_id = inode->i_ino;
160+
if (dev_target && dev_target != dev_cur)
161+
return 0;
162+
163+
fikp = bpf_map_lookup_elem(&ino_name_map, &ino_id);
164+
if (!fikp)
165+
return 0;
166+
fivp = bpf_map_lookup_elem(&file_info_map, fikp);
167+
if (!fivp)
168+
return 0;
169+
170+
if (iocb->ki_flags & IOCB_DIRECT)
171+
__sync_fetch_and_add(&fivp->fv_rw_cnt[RW_TYPE_DIRECT_READ], 1);
172+
else
173+
__sync_fetch_and_add(&fivp->fv_rw_cnt[RW_TYPE_BUFFER_READ], 1);
174+
return 0;
175+
}
176+
177+
char LICENSE[] SEC("license") = "Dual BSD/GPL";

0 commit comments

Comments
 (0)