Added new probe to read the previously extracted params and overwrite user memory. Still now fully working, just a backup

src/user/include/modules/fs.h

@@ -8,18 +8,30 @@
 #include "xdp_filter.skel.h"
 
 //Connections
-int attach_kprobe__64_sys_read(struct xdp_filter_bpf *skel){
-    skel->links.kprobe__64_sys_read = bpf_program__attach(skel->progs.kprobe__64_sys_read);
-	return libbpf_get_error(skel->links.kprobe__64_sys_read);
+int attach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
+    skel->links.kprobe_ksys_read = bpf_program__attach(skel->progs.kprobe_ksys_read);
+	return libbpf_get_error(skel->links.kprobe_ksys_read);
+}
+int attach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
+    skel->links.kretprobe_vfs_read = bpf_program__attach(skel->progs.kretprobe_vfs_read);
+	return libbpf_get_error(skel->links.kretprobe_vfs_read);
 }
 
 int attach_fs_all(struct xdp_filter_bpf *skel){
-    return attach_kprobe__64_sys_read(skel);
+    return attach_kprobe_ksys_read(skel) || attach_kretprobe_vfs_read(skel);
 }
 
 
-int detach_kprobe__64_sys_read(struct xdp_filter_bpf *skel){
-    int err = detach_link_generic(skel->links.kprobe__64_sys_read);
+int detach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
+    int err = detach_link_generic(skel->links.kprobe_ksys_read);
+    if(err<0){
+        fprintf(stderr, "Failed to detach fs link\n");
+        return -1;
+    }
+    return 0;
+}
+int detach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
+    int err = detach_link_generic(skel->links.kretprobe_vfs_read);
     if(err<0){
         fprintf(stderr, "Failed to detach fs link\n");
         return -1;
@@ -28,7 +40,7 @@ int detach_kprobe__64_sys_read(struct xdp_filter_bpf *skel){
 }
 
 int detach_fs_all(struct xdp_filter_bpf *skel){
-    return detach_kprobe__64_sys_read(skel);
+    return detach_kprobe_ksys_read(skel) || detach_kretprobe_vfs_read(skel);
 }
 
 #endif

src/user/include/modules/module_manager.c

@@ -14,8 +14,8 @@ module_config_t module_config = {
     },
     .fs_module = {
         .all = ON,
-        .kprobe__64_compat_sys_read = OFF,
-        .kprobe__64_sys_read = OFF
+        .kprobe_ksys_read = OFF,
+        .kretprobe_vfs_read = OFF
     }
 
 };
@@ -26,7 +26,8 @@ module_config_attr_t module_config_attr = {
         .ifindex = -1,
         .flags = -1
     },
-    .sched_module = {}
+    .sched_module = {},
+    .fs_module = {}
 };
 
 
@@ -56,7 +57,8 @@ int setup_all_modules(){
     if(config.fs_module.all == ON){
         ret = attach_fs_all(attr.skel);
     }else{
-        if(config.fs_module.kprobe__64_sys_read == ON) ret = attach_kprobe__64_sys_read(attr.skel);
+        if(config.fs_module.kprobe_ksys_read == ON) ret = attach_kprobe_ksys_read(attr.skel);
+        if(config.fs_module.kretprobe_vfs_read == ON) ret = attach_kretprobe_vfs_read(attr.skel);
     }
     if(ret!=0) return -1;
 

src/user/include/modules/module_manager.h

@@ -25,8 +25,8 @@ typedef struct module_config_t{
 
     struct fs_module {
         char all;
-        char kprobe__64_compat_sys_read;
-        char kprobe__64_sys_read;
+        char kprobe_ksys_read;
+        char kretprobe_vfs_read;
     }fs_module;
 
 } module_config_t;