merge disksnoop example
diff --git a/examples/tracing/disksnoop.py b/examples/tracing/disksnoop.py
index 206b618..ed3dd81 100755
--- a/examples/tracing/disksnoop.py
+++ b/examples/tracing/disksnoop.py
@@ -1,7 +1,7 @@
#!/usr/bin/python
#
# disksnoop.py Trace block device I/O: basic version of iosnoop.
-# For Linux, uses BCC, eBPF. See .c file.
+# For Linux, uses BCC, eBPF. Embedded C.
#
# Written as a basic example of tracing latency.
#
@@ -16,7 +16,32 @@
REQ_WRITE = 1 # from include/linux/blk_types.h
# load BPF program
-b = BPF(src_file="disksnoop.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+#include <linux/blkdev.h>
+
+BPF_HASH(start, struct request *);
+
+void trace_start(struct pt_regs *ctx, struct request *req) {
+ // stash start timestamp by request ptr
+ u64 ts = bpf_ktime_get_ns();
+
+ start.update(&req, &ts);
+}
+
+void trace_completion(struct pt_regs *ctx, struct request *req) {
+ u64 *tsp, delta;
+
+ tsp = start.lookup(&req);
+ if (tsp != 0) {
+ delta = bpf_ktime_get_ns() - *tsp;
+ bpf_trace_printk("%d %x %d\\n", req->__data_len,
+ req->cmd_flags, delta / 1000);
+ start.delete(&req);
+ }
+}
+""")
+
b.attach_kprobe(event="blk_start_request", fn_name="trace_start")
b.attach_kprobe(event="blk_mq_start_request", fn_name="trace_start")
b.attach_kprobe(event="blk_account_io_completion", fn_name="trace_completion")