1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2 /* Copyright (c) 2021 Sartura */ 3 #include "vmlinux.h" 4 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_tracing.h> 6 #include <bpf/bpf_core_read.h> 7 8 9 struct { 10 __uint(type, BPF_MAP_TYPE_ARRAY); 11 __uint(max_entries, 256); 12 __type(key, u32); 13 __type(value, unsigned long long); 14 __uint(pinning, LIBBPF_PIN_BY_NAME); 15 } ksysread_stats SEC(".maps"); 16 17 SEC("kprobe/ksys_read") 18 int BPF_KPROBE(ksys_read, unsigned int fd, char *buf, size_t count) 19 { 20 int i; 21 #pragma unroll 22 for(i=30; i>=0; i--) { 23 if (count&(1<<i)) { 24 unsigned long long* counter = bpf_map_lookup_elem(&ksysread_stats, &i); 25 if (counter) (*counter)++; 26 break; 27 } 28 } 29 return 0; 30 } 31 32 char LICENSE[] SEC("license") = "Dual BSD/GPL"; 33