feat: agent - eBPF Add data retrieval related to mounts

Adjustments made for obtaining mount information:

* Some file read/write operations may occur within nested mount namespaces. Using
  `/proc/<pid>/ns/mnt` to get the `mntns_id` only retrieves the first-level mount
  namespace ID and cannot determine the `mntns_id` of the namespace where the file
  actually resides. Therefore, we removed the method of obtaining `mntns_id` from
  `/proc` and instead retrieve the `mntns_id` of a file directly from kernel structures.
  This value is then passed to the upper-level program, which queries the mount
  information (`mountinfo`) based on the `mntns_id` obtained via eBPF.

* Mount points were previously identified using device numbers (`major:minor`). However,
  when the same device is mounted at multiple mount points, the device number is identical
  for all of them, making it impossible to distinguish which mount point a file belongs to.
  To solve this, we now obtain the `mountID` from kernel structures. Each mount point has
  a unique `mountID`, which we use for accurate differentiation.

* We need to obtain field offsets from kernel structures. Since these offsets may vary
  across different kernel versions, we implemented an automatic offset inference mechanism
  to handle this issue. Moreover, if BTF is supported, this problem does not exist.

Author: yinjiping

agent/src/ebpf/kernel/files_rw.bpf.c

@@ -21,7 +21,7 @@
 
 // Default value set when file read/write latency timestamp rollback occurs.
 #define TIME_ROLLBACK_DEFAULT_LATENCY_NS 50000
- 
+
 static __inline bool is_regular_file(int fd,
 				     struct member_fields_offset *off_ptr)
 {
@@ -35,12 +35,153 @@ static __inline bool is_regular_file(int fd,
 	return S_ISREG(i_mode);
 }
 
+static __inline void *get_mount_ptr(void *file,
+				    struct member_fields_offset *off_ptr)
+{
+	void *vfsmount = NULL;
+
+	/*
+	 * struct_file_f_path_offset: Starting from Linux 6.5, this offset has
+	 * undergone significant changes and automatic inference is not supported.
+	 */
+
+	// file -> path -> vfsmount
+	bpf_probe_read_kernel(&vfsmount, sizeof(vfsmount),
+			      file + off_ptr->struct_file_f_path_offset +
+			      off_ptr->struct_path_mnt_offset);
+	if (vfsmount == NULL)
+		return NULL;
+
+	// `vfsmount` is embedded in `struct mount`
+	return (vfsmount - off_ptr->struct_mount_mnt_offset);
+}
+
+static __inline void get_mount_ids(void *file,
+				   struct __io_event_buffer *buffer,
+				   struct member_fields_offset *off_ptr)
+{
+	void *mount, *mnt_ns = NULL;
+	buffer->mntns_id = 0;
+	buffer->mnt_id = -1;
+	mount = get_mount_ptr(file, off_ptr);
+	if (mount == NULL)
+		return;
+
+	//bpf_debug("mount_mnt_id_offset 0x%x\n", off_ptr->struct_mount_mnt_id_offset);
+	if (off_ptr->struct_mount_mnt_id_offset != INVALID_OFFSET) {
+		bpf_probe_read_kernel(&buffer->mnt_id, sizeof(buffer->mnt_id),
+				      mount +
+				      off_ptr->struct_mount_mnt_id_offset);
+	}
+
+	if (off_ptr->struct_mount_mnt_ns_offset == INVALID_OFFSET)
+		return;
+
+	bpf_probe_read_kernel(&mnt_ns, sizeof(mnt_ns),
+			      mount + off_ptr->struct_mount_mnt_ns_offset);
+	if (mnt_ns == NULL)
+		return;
+
+	// mnt_namespace -> ns_common -> inum
+	bpf_probe_read_kernel(&buffer->mntns_id, sizeof(buffer->mntns_id),
+			      mnt_ns + off_ptr->struct_mnt_namespace_ns_offset +
+			      off_ptr->struct_ns_common_inum_offset);
+}
+
+static __inline int infer_mount_offset(int fd,
+				       struct member_fields_offset *off_ptr)
+{
+	// The inference has been completed.
+	if (off_ptr->files_infer_done)
+		return 0;
+
+	__u32 k0 = 0;
+	struct adapt_kern_data *adapt_data;
+	adapt_data = adapt_kern_data_map__lookup(&k0);
+	if (!adapt_data)
+		goto error;
+
+	// The inference is limited to the threads we have designated.
+	if (adapt_data->id != bpf_get_current_pid_tgid())
+		return -1;
+
+	void *file = fd_to_file(fd, off_ptr);
+	if (file == NULL)
+		goto error;
+
+	void *mount = get_mount_ptr(file, off_ptr);
+	if (mount == NULL)
+		goto error;
+
+	int i, mnt_id = 0;
+	bool found = false;
+	__u16 mnt_id_offsets[] = { 0x10c, 0x114, 0x11c, 0x124 };
+#pragma unroll
+	for (i = 0; i < ARRAY_SIZE(mnt_id_offsets); i++) {
+		bpf_probe_read_kernel(&mnt_id, sizeof(mnt_id),
+				      mount + mnt_id_offsets[i]);
+		if (mnt_id == adapt_data->mnt_id) {
+			found = true;
+			break;
+		}
+	}
+
+	if (found) {
+		off_ptr->struct_mount_mnt_id_offset = mnt_id_offsets[i];
+	} else {
+		off_ptr->struct_mount_mnt_id_offset = INVALID_OFFSET;
+	}
+
+	__u32 mntns_id = 0;
+	void *mnt_ns = NULL;
+	__u16 mnt_ns_offset[] = { 0xe0, 0xe8 };
+	off_ptr->struct_mount_mnt_ns_offset = INVALID_OFFSET;
+	off_ptr->struct_mnt_namespace_ns_offset = INVALID_OFFSET;
+#pragma unroll
+	for (i = 0; i < ARRAY_SIZE(mnt_ns_offset); i++) {
+		bpf_probe_read_kernel(&mnt_ns, sizeof(mnt_ns),
+				      mount + mnt_ns_offset[i]);
+		if (mnt_ns == NULL)
+			continue;
+		// mnt_namespace -> ns_common -> inum
+		bpf_probe_read_kernel(&mntns_id, sizeof(mntns_id),
+				      mnt_ns +
+				      off_ptr->struct_ns_common_inum_offset);
+		if (mntns_id == adapt_data->mntns_id) {
+			found = true;
+			off_ptr->struct_mount_mnt_ns_offset = mnt_ns_offset[i];
+			off_ptr->struct_mnt_namespace_ns_offset = 0;
+			off_ptr->files_infer_done = 1;
+			return 0;
+		}
+		bpf_probe_read_kernel(&mntns_id, sizeof(mntns_id),
+				      mnt_ns + 0x8 +
+				      off_ptr->struct_ns_common_inum_offset);
+		if (mntns_id == adapt_data->mntns_id) {
+			off_ptr->struct_mount_mnt_ns_offset = mnt_ns_offset[i];
+			off_ptr->struct_mnt_namespace_ns_offset = 0x8;
+			off_ptr->files_infer_done = 1;
+			return 0;
+		}
+	}
+
+	off_ptr->files_infer_done = 1;
+	return -1;
+
+error:
+	off_ptr->struct_mount_mnt_id_offset = INVALID_OFFSET;
+	off_ptr->struct_mount_mnt_ns_offset = INVALID_OFFSET;
+	off_ptr->struct_mnt_namespace_ns_offset = INVALID_OFFSET;
+	off_ptr->files_infer_done = 1;
+	return -1;
+}
+
 static __inline void set_file_metric_data(struct __io_event_buffer *buffer,
 					  struct __socket_data *v,
 					  int fd,
 					  struct member_fields_offset *off_ptr)
 {
-#define MAX_DIRECTORY_DEPTH 19
+#define MAX_DIRECTORY_DEPTH 18
 
 	struct member_fields_offset *offset = off_ptr;
 	if (offset == NULL) {
@@ -90,6 +231,8 @@ static __inline void set_file_metric_data(struct __io_event_buffer *buffer,
 	void *dentry = NULL, *parent;
 	bpf_probe_read_kernel(&dentry, sizeof(dentry),
 			      file + offset->struct_file_dentry_offset);
+	get_mount_ids(file, buffer, offset);
+	//bpf_debug("buffer->mnt_id %d\n", buffer->mnt_id);
 	buffer->len = 0;
 #pragma unroll
 	for (int i = 0; i < MAX_DIRECTORY_DEPTH; i++) {
@@ -239,6 +382,9 @@ static __inline int do_sys_enter_pread(int fd, enum syscall_src_func fn)
 	if (!offset)
 		return 0;
 
+	// Attempt to infer file-related structure offsets.
+	infer_mount_offset(fd, offset);
+
 	__u64 id = bpf_get_current_pid_tgid();
 	// Stash arguments.
 	struct data_args_t read_args = {};
@@ -252,7 +398,7 @@ static __inline int do_sys_enter_pread(int fd, enum syscall_src_func fn)
 #ifdef SUPPORTS_KPROBE_ONLY
 //ssize_t ksys_pread64(unsigned int fd, char __user *buf, size_t count,
 //                     loff_t pos)
-KPROG(ksys_pread64) (struct pt_regs *ctx) {
+KPROG(ksys_pread64) (struct pt_regs * ctx) {
 	int fd = (unsigned int)PT_REGS_PARM1(ctx);
 	return do_sys_enter_pread(fd, SYSCALL_FUNC_PREAD64);
 }
@@ -262,25 +408,25 @@ KPROG(ksys_pread64) (struct pt_regs *ctx) {
  * static ssize_t do_preadv(unsigned long fd, const struct iovec __user *vec,
  *			    unsigned long vlen, loff_t pos, rwf_t flags);
  */
-KPROG(do_preadv) (struct pt_regs *ctx) {
+KPROG(do_preadv) (struct pt_regs * ctx) {
 	int fd = (unsigned int)PT_REGS_PARM1(ctx);
 	return do_sys_enter_pread(fd, SYSCALL_FUNC_PREADV);
 }
 #else
 // /sys/kernel/debug/tracing/events/syscalls/sys_enter_pread64/format
-TP_SYSCALL_PROG(enter_pread64) (struct syscall_comm_enter_ctx *ctx) {
+TP_SYSCALL_PROG(enter_pread64) (struct syscall_comm_enter_ctx * ctx) {
 	int fd = ctx->fd;
 	return do_sys_enter_pread(fd, SYSCALL_FUNC_PREAD64);
 }
 
 // /sys/kernel/debug/tracing/events/syscalls/sys_enter_preadv/format
-TP_SYSCALL_PROG(enter_preadv) (struct syscall_comm_enter_ctx *ctx) {
+TP_SYSCALL_PROG(enter_preadv) (struct syscall_comm_enter_ctx * ctx) {
 	int fd = ctx->fd;
 	return do_sys_enter_pread(fd, SYSCALL_FUNC_PREADV);
 }
 
 // /sys/kernel/debug/tracing/events/syscalls/sys_enter_preadv2/format
-TP_SYSCALL_PROG(enter_preadv2) (struct syscall_comm_enter_ctx *ctx) {
+TP_SYSCALL_PROG(enter_preadv2) (struct syscall_comm_enter_ctx * ctx) {
 	int fd = ctx->fd;
 	return do_sys_enter_pread(fd, SYSCALL_FUNC_PREADV2);
 }
@@ -306,28 +452,28 @@ static __inline int do_sys_exit_pread(void *ctx, ssize_t bytes_count)
 }
 
 #ifdef SUPPORTS_KPROBE_ONLY
-KRETPROG(ksys_pread64) (struct pt_regs *ctx) {
+KRETPROG(ksys_pread64) (struct pt_regs * ctx) {
 	ssize_t bytes_count = PT_REGS_RC(ctx);
 	return do_sys_exit_pread((void *)ctx, bytes_count);
 }
 
-KRETPROG(do_preadv) (struct pt_regs *ctx) {
+KRETPROG(do_preadv) (struct pt_regs * ctx) {
 	ssize_t bytes_count = PT_REGS_RC(ctx);
 	return do_sys_exit_pread((void *)ctx, bytes_count);
 }
 #else
 // /sys/kernel/debug/tracing/events/syscalls/sys_exit_pwrite64/format
-TP_SYSCALL_PROG(exit_pread64) (struct syscall_comm_exit_ctx *ctx) {
+TP_SYSCALL_PROG(exit_pread64) (struct syscall_comm_exit_ctx * ctx) {
 	return do_sys_exit_pread((void *)ctx, (ssize_t) ctx->ret);
 }
 
 // /sys/kernel/debug/tracing/events/syscalls/sys_exit_pwritev/format
-TP_SYSCALL_PROG(exit_preadv) (struct syscall_comm_exit_ctx *ctx) {
+TP_SYSCALL_PROG(exit_preadv) (struct syscall_comm_exit_ctx * ctx) {
 	return do_sys_exit_pread((void *)ctx, (ssize_t) ctx->ret);
 }
 
 // /sys/kernel/debug/tracing/events/syscalls/sys_exit_pwritev2/format
-TP_SYSCALL_PROG(exit_preadv2) (struct syscall_comm_exit_ctx *ctx) {
+TP_SYSCALL_PROG(exit_preadv2) (struct syscall_comm_exit_ctx * ctx) {
 	return do_sys_exit_pread((void *)ctx, (ssize_t) ctx->ret);
 }
 #endif /* SUPPORTS_KPROBE_ONLY */
@@ -352,7 +498,7 @@ static __inline int do_sys_enter_pwrite(int fd, enum syscall_src_func fn)
 //ssize_t ksys_pwrite64(unsigned int fd, const char __user *buf,
 //                      size_t count, loff_t pos);
 #ifdef SUPPORTS_KPROBE_ONLY
-KPROG(ksys_pwrite64) (struct pt_regs *ctx) {
+KPROG(ksys_pwrite64) (struct pt_regs * ctx) {
 	int fd = (int)PT_REGS_PARM1(ctx);
 	return do_sys_enter_pwrite(fd, SYSCALL_FUNC_PWRITE64);
 }
@@ -362,25 +508,25 @@ KPROG(ksys_pwrite64) (struct pt_regs *ctx) {
  * static ssize_t do_pwritev(unsigned long fd, const struct iovec __user *vec,
  *                           unsigned long vlen, loff_t pos, rwf_t flags);
  */
-KPROG(do_pwritev) (struct pt_regs *ctx) {
+KPROG(do_pwritev) (struct pt_regs * ctx) {
 	int fd = (int)PT_REGS_PARM1(ctx);
 	return do_sys_enter_pwrite(fd, SYSCALL_FUNC_PWRITEV);
 }
 #else
 // /sys/kernel/debug/tracing/events/syscalls/sys_enter_pwrite64/format
-TP_SYSCALL_PROG(enter_pwrite64) (struct syscall_comm_enter_ctx *ctx) {
+TP_SYSCALL_PROG(enter_pwrite64) (struct syscall_comm_enter_ctx * ctx) {
 	int fd = ctx->fd;
 	return do_sys_enter_pwrite(fd, SYSCALL_FUNC_PWRITE64);
 }
 
 // /sys/kernel/debug/tracing/events/syscalls/sys_enter_pwritev/format
-TP_SYSCALL_PROG(enter_pwritev) (struct syscall_comm_enter_ctx *ctx) {
+TP_SYSCALL_PROG(enter_pwritev) (struct syscall_comm_enter_ctx * ctx) {
 	int fd = ctx->fd;
 	return do_sys_enter_pwrite(fd, SYSCALL_FUNC_PWRITEV);
 }
 
 // /sys/kernel/debug/tracing/events/syscalls/sys_enter_pwritev2/format
-TP_SYSCALL_PROG(enter_pwritev2) (struct syscall_comm_enter_ctx *ctx) {
+TP_SYSCALL_PROG(enter_pwritev2) (struct syscall_comm_enter_ctx * ctx) {
 	int fd = ctx->fd;
 	return do_sys_enter_pwrite(fd, SYSCALL_FUNC_PWRITEV2);
 }
@@ -407,28 +553,28 @@ static __inline int do_sys_exit_pwrite(void *ctx, ssize_t bytes_count)
 }
 
 #ifdef SUPPORTS_KPROBE_ONLY
-KRETPROG(ksys_pwrite64) (struct pt_regs *ctx) {
+KRETPROG(ksys_pwrite64) (struct pt_regs * ctx) {
 	ssize_t bytes_count = PT_REGS_RC(ctx);
 	return do_sys_exit_pwrite((void *)ctx, bytes_count);
 }
 
-KRETPROG(do_pwritev) (struct pt_regs *ctx) {
+KRETPROG(do_pwritev) (struct pt_regs * ctx) {
 	ssize_t bytes_count = PT_REGS_RC(ctx);
 	return do_sys_exit_pwrite((void *)ctx, bytes_count);
 }
 #else
 // /sys/kernel/debug/tracing/events/syscalls/sys_exit_pwrite64/format
-TP_SYSCALL_PROG(exit_pwrite64) (struct syscall_comm_exit_ctx *ctx) {
+TP_SYSCALL_PROG(exit_pwrite64) (struct syscall_comm_exit_ctx * ctx) {
 	return do_sys_exit_pwrite((void *)ctx, (ssize_t) ctx->ret);
 }
 
 // /sys/kernel/debug/tracing/events/syscalls/sys_exit_pwritev/format
-TP_SYSCALL_PROG(exit_pwritev) (struct syscall_comm_exit_ctx *ctx) {
+TP_SYSCALL_PROG(exit_pwritev) (struct syscall_comm_exit_ctx * ctx) {
 	return do_sys_exit_pwrite((void *)ctx, (ssize_t) ctx->ret);
 }
 
 // /sys/kernel/debug/tracing/events/syscalls/sys_exit_pwritev2/format
-TP_SYSCALL_PROG(exit_pwritev2) (struct syscall_comm_exit_ctx *ctx) {
+TP_SYSCALL_PROG(exit_pwritev2) (struct syscall_comm_exit_ctx * ctx) {
 	return do_sys_exit_pwrite((void *)ctx, (ssize_t) ctx->ret);
 }
 #endif /* SUPPORTS_KPROBE_ONLY */

agent/src/ebpf/kernel/include/socket_trace_common.h

@@ -26,6 +26,16 @@
 
 #include "../config.h"
 
+#define INVALID_OFFSET 0xFFFF
+
+// Structure used to store kernel mount information for adaptation purposes.
+// Helps to infer kernel structure offsets for different kernel versions.
+struct adapt_kern_data {
+	__u64 id;       // Combined identifier, e.g., {tgid, pid} of the process
+	int mnt_id;     // Mount ID corresponding to the file
+	__u32 mntns_id; // Mount namespace ID corresponding to the file
+};
+
 enum endpoint_role {
 	ROLE_UNKNOWN,
 	ROLE_CLIENT,
@@ -234,6 +244,11 @@ struct __io_event_buffer {
 	// The number of bytes of offset within the file content
 	__u64 offset;
 
+	// Mount ID of the file’s mount
+	int mnt_id;
+	// Mount namespace ID of the file’s mount
+	__u32 mntns_id;
+
 	// filename length
 	__u32 len;
 
@@ -260,6 +275,8 @@ struct user_io_event_buffer {
 	char mount_source[MOUNT_SOURCE_SZ];
 	char mount_point[MOUNT_POINT_SZ];
 	char file_dir[FILE_PATH_SZ];
+	int mnt_id;
+	__u32 mntns_id;
 } __attribute__ ((packed));
 
 // struct ebpf_proc_info -> offsets[]  arrays index.
@@ -344,7 +361,9 @@ struct member_fields_offset {
 	__u8 ready;
 	__u8 kprobe_invalid:1;			// This indicates that the KPROBE feature has been disabled.
 	__u8 enable_unix_socket:1;		// Enable flag for Unix socket tracing
-	__u8 reserved:6;
+	__u8 files_infer_done:1;		// 0: file-related structure offset inference not completed
+						// 1: file-related structure offset inference completed
+	__u8 reserved:5;
 	__u16 struct_dentry_d_parent_offset;    // offsetof(struct dentry, d_parent)
 	__u32 task__files_offset;
 	__u32 sock__flags_offset;
@@ -369,6 +388,17 @@ struct member_fields_offset {
 	__u32 struct_sock_sport_offset;	// offsetof(struct sock_common, skc_num)
 	__u32 struct_sock_skc_state_offset;	// offsetof(struct sock_common, skc_state)
 	__u32 struct_sock_common_ipv6only_offset;	// offsetof(struct sock_common, skc_flags)
+
+	/*
+ 	 * Mount information related offsets
+ 	 */
+	__u16 struct_file_f_path_offset;      // offsetof(struct file, f_path)
+	__u16 struct_path_mnt_offset;         // offsetof(struct path, mnt)
+	__u16 struct_mount_mnt_offset;	      // offsetof(struct mount, mnt)
+	__u16 struct_mount_mnt_ns_offset;     // offsetof(struct mount, mnt_ns)
+	__u16 struct_mnt_namespace_ns_offset; // offsetof(struct mnt_namespace, ns)
+	__u16 struct_ns_common_inum_offset;   // offsetof(struct mnt_common, inum)
+	__u16 struct_mount_mnt_id_offset;     // offsetof(struct mount, mnt_id)
 };
 
 typedef struct member_fields_offset bpf_offset_param_t;