1*387f9dfdSAndroid Build Coastguard Worker /* SPDX-License-Identifier: GPL-2.0 */
2*387f9dfdSAndroid Build Coastguard Worker /* Copyright (c) 2021 Facebook */
3*387f9dfdSAndroid Build Coastguard Worker #include <vmlinux.h>
4*387f9dfdSAndroid Build Coastguard Worker #include <bpf/bpf_helpers.h>
5*387f9dfdSAndroid Build Coastguard Worker #include <bpf/bpf_tracing.h>
6*387f9dfdSAndroid Build Coastguard Worker #include "bashreadline.h"
7*387f9dfdSAndroid Build Coastguard Worker
8*387f9dfdSAndroid Build Coastguard Worker #define TASK_COMM_LEN 16
9*387f9dfdSAndroid Build Coastguard Worker
10*387f9dfdSAndroid Build Coastguard Worker struct {
11*387f9dfdSAndroid Build Coastguard Worker __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
12*387f9dfdSAndroid Build Coastguard Worker __uint(key_size, sizeof(__u32));
13*387f9dfdSAndroid Build Coastguard Worker __uint(value_size, sizeof(__u32));
14*387f9dfdSAndroid Build Coastguard Worker } events SEC(".maps");
15*387f9dfdSAndroid Build Coastguard Worker
16*387f9dfdSAndroid Build Coastguard Worker SEC("uretprobe/readline")
BPF_KRETPROBE(printret,const void * ret)17*387f9dfdSAndroid Build Coastguard Worker int BPF_KRETPROBE(printret, const void *ret) {
18*387f9dfdSAndroid Build Coastguard Worker struct str_t data;
19*387f9dfdSAndroid Build Coastguard Worker char comm[TASK_COMM_LEN];
20*387f9dfdSAndroid Build Coastguard Worker u32 pid;
21*387f9dfdSAndroid Build Coastguard Worker
22*387f9dfdSAndroid Build Coastguard Worker if (!ret)
23*387f9dfdSAndroid Build Coastguard Worker return 0;
24*387f9dfdSAndroid Build Coastguard Worker
25*387f9dfdSAndroid Build Coastguard Worker bpf_get_current_comm(&comm, sizeof(comm));
26*387f9dfdSAndroid Build Coastguard Worker if (comm[0] != 'b' || comm[1] != 'a' || comm[2] != 's' || comm[3] != 'h' || comm[4] != 0 )
27*387f9dfdSAndroid Build Coastguard Worker return 0;
28*387f9dfdSAndroid Build Coastguard Worker
29*387f9dfdSAndroid Build Coastguard Worker pid = bpf_get_current_pid_tgid() >> 32;
30*387f9dfdSAndroid Build Coastguard Worker data.pid = pid;
31*387f9dfdSAndroid Build Coastguard Worker bpf_probe_read_user_str(&data.str, sizeof(data.str), ret);
32*387f9dfdSAndroid Build Coastguard Worker
33*387f9dfdSAndroid Build Coastguard Worker bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &data, sizeof(data));
34*387f9dfdSAndroid Build Coastguard Worker
35*387f9dfdSAndroid Build Coastguard Worker return 0;
36*387f9dfdSAndroid Build Coastguard Worker };
37*387f9dfdSAndroid Build Coastguard Worker
38*387f9dfdSAndroid Build Coastguard Worker char LICENSE[] SEC("license") = "GPL";
39