inline C in /tools

tools/pidpersec.py

@@ -18,7 +18,23 @@
 from time import sleep, strftime
 
 # load BPF program
-b = BPF(src_file="pidpersec.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+enum stat_types {
+ S_COUNT = 1,
+ S_MAXSTAT
+};
+
+BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
+
+void stats_increment(int key) {
+ u64 *leaf = stats.lookup(&key);
+ if (leaf) (*leaf)++;
+}
+
+void do_count(struct pt_regs *ctx) { stats_increment(S_COUNT); }
+""")
 b.attach_kprobe(event="sched_fork", fn_name="do_count")
 
 # stat indexes

tools/vfscount.py

@@ -16,7 +16,24 @@
 from time import sleep
 
 # load BPF program
-b = BPF(src_file="vfscount.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+struct key_t {
+ u64 ip;
+};
+
+BPF_TABLE("hash", struct key_t, u64, counts, 256);
+
+ int do_count(struct pt_regs *ctx) {
+ struct key_t key = {};
+ u64 zero = 0, *val;
+ key.ip = ctx->ip;
+ val = counts.lookup_or_init(&key, &zero);
+ (*val)++;
+ return 0;
+}
+""")
 b.attach_kprobe(event_re="^vfs_.*", fn_name="do_count")
 
 # header

tools/vfsstat.py

@@ -37,7 +37,31 @@ def usage():
  usage()
 
 # load BPF program
-b = BPF(src_file="vfsstat.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+enum stat_types {
+ S_READ = 1,
+ S_WRITE,
+ S_FSYNC,
+ S_OPEN,
+ S_CREATE,
+ S_MAXSTAT
+};
+
+BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
+
+void stats_increment(int key) {
+ u64 *leaf = stats.lookup(&key);
+ if (leaf) (*leaf)++;
+}
+
+void do_read(struct pt_regs *ctx) { stats_increment(S_READ); }
+void do_write(struct pt_regs *ctx) { stats_increment(S_WRITE); }
+void do_fsync(struct pt_regs *ctx) { stats_increment(S_FSYNC); }
+void do_open(struct pt_regs *ctx) { stats_increment(S_OPEN); }
+void do_create(struct pt_regs *ctx) { stats_increment(S_CREATE); }
+""")
 b.attach_kprobe(event="vfs_read", fn_name="do_read")
 b.attach_kprobe(event="vfs_write", fn_name="do_write")
 b.attach_kprobe(event="vfs_fsync", fn_name="do_fsync")