1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /* Copyright (c) 2021 Sartura */
3 #include "vmlinux.h"
4 #include <bpf/bpf_helpers.h>
5 #include <bpf/bpf_tracing.h>
6 #include <bpf/bpf_core_read.h>
7
8
9 struct {
10 __uint(type, BPF_MAP_TYPE_ARRAY);
11 __uint(max_entries, 256);
12 __type(key, u32);
13 __type(value, unsigned long long);
14 __uint(pinning, LIBBPF_PIN_BY_NAME);
15 } ksysread_stats SEC(".maps");
16
17 SEC("kprobe/ksys_read")
BPF_KPROBE(ksys_read,unsigned int fd,char * buf,size_t count)18 int BPF_KPROBE(ksys_read, unsigned int fd, char *buf, size_t count)
19 {
20 int i;
21 #pragma unroll
22 for(i=30; i>=0; i--) {
23 if (count&(1<<i)) {
24 unsigned long long* counter = bpf_map_lookup_elem(&ksysread_stats, &i);
25 if (counter) (*counter)++;
26 break;
27 }
28 }
29 return 0;
30 }
31
32 char LICENSE[] SEC("license") = "Dual BSD/GPL";
33