inline C in /tools

tools/pidpersec.c

-/*
- * pidpersec.c	Count new processes (via fork).
- *		For Linux, uses BCC, eBPF. See the Python front-end.
- *
- * USAGE: pidpersec.py
- *
- * Copyright (c) 2015 Brendan Gregg.
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of version 2 of the GNU General Public
- * License as published by the Free Software Foundation.
- *
- * 11-Aug-2015	Brendan Gregg	Created this.
- */
-
-#include <uapi/linux/ptrace.h>
-
-enum stat_types {
-	S_COUNT = 1,
-	S_MAXSTAT
-};
-
-BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
-
-void stats_increment(int key) {
-	u64 *leaf = stats.lookup(&key);
-	if (leaf) (*leaf)++;
-}
-
-void do_count(struct pt_regs *ctx) { stats_increment(S_COUNT); }

tools/pidpersec.py

@@ -18,7 +18,23 @@ from ctypes import c_int
 from time import sleep, strftime
 
 # load BPF program
-b = BPF(src_file="pidpersec.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+enum stat_types {
+    S_COUNT = 1,
+    S_MAXSTAT
+};
+
+BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
+
+void stats_increment(int key) {
+    u64 *leaf = stats.lookup(&key);
+    if (leaf) (*leaf)++;
+}
+
+void do_count(struct pt_regs *ctx) { stats_increment(S_COUNT); }
+""")
 b.attach_kprobe(event="sched_fork", fn_name="do_count")
 
 # stat indexes

tools/vfscount.c

-/*
- * vfscount.c	Count some VFS calls.
- *		For Linux, uses BCC, eBPF. See the Python front-end.
- *
- * USAGE: vfscount.py
- *
- * Copyright (c) 2015 Brendan Gregg.
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of version 2 of the GNU General Public
- * License as published by the Free Software Foundation.
- *
- * 14-Aug-2015	Brendan Gregg	Created this.
- */
-
-#include <uapi/linux/ptrace.h>
-
-struct key_t {
-	u64 ip;
-};
-
-BPF_TABLE("hash", struct key_t, u64, counts, 256);
-
-int do_count(struct pt_regs *ctx) {
-	struct key_t key = {};
-	u64 zero = 0, *val;
-	key.ip = ctx->ip;
-	val = counts.lookup_or_init(&key, &zero);
-	(*val)++;
-	return 0;
-}

tools/vfscount.py

@@ -16,7 +16,24 @@ from bcc import BPF
 from time import sleep
 
 # load BPF program
-b = BPF(src_file="vfscount.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+struct key_t {
+    u64 ip;
+};
+
+BPF_TABLE("hash", struct key_t, u64, counts, 256);
+
+    int do_count(struct pt_regs *ctx) {
+    struct key_t key = {};
+    u64 zero = 0, *val;
+    key.ip = ctx->ip;
+    val = counts.lookup_or_init(&key, &zero);
+    (*val)++;
+    return 0;
+}
+""")
 b.attach_kprobe(event_re="^vfs_.*", fn_name="do_count")
 
 # header

tools/vfsstat.c

-/*
- * vfsstat.c	Count some VFS calls.
- *		For Linux, uses BCC, eBPF. See the Python front-end.
- *
- * USAGE: vfsstat.py [interval [count]]
- *
- * Copyright (c) 2015 Brendan Gregg.
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of version 2 of the GNU General Public
- * License as published by the Free Software Foundation.
- *
- * 14-Aug-2015	Brendan Gregg	Created this.
- */
-
-#include <uapi/linux/ptrace.h>
-
-enum stat_types {
-	S_READ = 1,
-	S_WRITE,
-	S_FSYNC,
-	S_OPEN,
-	S_CREATE,
-	S_MAXSTAT
-};
-
-BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
-
-void stats_increment(int key) {
-	u64 *leaf = stats.lookup(&key);
-	if (leaf) (*leaf)++;
-}
-
-void do_read(struct pt_regs *ctx) { stats_increment(S_READ); }
-void do_write(struct pt_regs *ctx) { stats_increment(S_WRITE); }
-void do_fsync(struct pt_regs *ctx) { stats_increment(S_FSYNC); }
-void do_open(struct pt_regs *ctx) { stats_increment(S_OPEN); }
-void do_create(struct pt_regs *ctx) { stats_increment(S_CREATE); }

tools/vfsstat.py

@@ -37,7 +37,31 @@ if len(argv) > 1:
         usage()
 
 # load BPF program
-b = BPF(src_file="vfsstat.c")
+b = BPF(text="""
+#include <uapi/linux/ptrace.h>
+
+enum stat_types {
+    S_READ = 1,
+    S_WRITE,
+    S_FSYNC,
+    S_OPEN,
+    S_CREATE,
+    S_MAXSTAT
+};
+
+BPF_TABLE("array", int, u64, stats, S_MAXSTAT + 1);
+
+void stats_increment(int key) {
+    u64 *leaf = stats.lookup(&key);
+    if (leaf) (*leaf)++;
+}
+
+void do_read(struct pt_regs *ctx) { stats_increment(S_READ); }
+void do_write(struct pt_regs *ctx) { stats_increment(S_WRITE); }
+void do_fsync(struct pt_regs *ctx) { stats_increment(S_FSYNC); }
+void do_open(struct pt_regs *ctx) { stats_increment(S_OPEN); }
+void do_create(struct pt_regs *ctx) { stats_increment(S_CREATE); }
+""")
 b.attach_kprobe(event="vfs_read", fn_name="do_read")
 b.attach_kprobe(event="vfs_write", fn_name="do_write")
 b.attach_kprobe(event="vfs_fsync", fn_name="do_fsync")