Hello, I'm using BPF to do NFS operation accounting for user-space processes. I'd like to include the number of bytes read and written to each file any processes open over NFS. For write operations, I'm currently using an fexit probe on the nfs_writeback_done function, and my program appears to be getting the information I'm hoping for. But I can see that under some circumstances the actual operations are being done by kworker threads, and so the PID reported by the BPF program is for that kworker instead of the user-space process that requested the write. Is there a more appropriate function to probe for this information if I only want it triggered in context of the user-space process that performed the write? If not, I'm wondering if there's enough information in a probe triggered in the kworker context to track down the user-space PID that initiated the writes. I didn't find anything related in the kernel's Documentation directory, and I'm not yet proficient enough with the vfs, nfs, and sunrpc code to find an appropriate function myself. If it matters, our infrastructure is all based on NFSv3. Thanks for any leads or documentation pointers! Lars
