pkg/gadgets: Add ntfs3 to trace fsslower.

[eiffel-fl]

Hi.

This PR enables trace fsslower to trace ntfs3:

root@vm-amd64:~# ./share/kinvolk/inspektor-gadget/ig trace fsslower -m 0 -f ntfs3 --host > /tmp/foo &
[1] 225
root@vm-amd64:~# cd /mnt/
root@vm-amd64:~# dd if=./foo of=./bar count=3 oflag=sync
3+0 records in
3+0 records out
1536 bytes (1.5 kB, 1.5 KiB) copied, 0.0225191 s, 68.2 kB/s
root@vm-amd64:/mnt# dd if=./foo of=./bar count=3
3+0 records in
3+0 records out
1536 bytes (1.5 kB, 1.5 KiB) copied, 0.00380181 s, 404 kB/s
root@vm-amd64:/mnt# fg
./share/kinvolk/inspektor-gadget/ig trace fsslower -m 0 -f ntfs3 --host > /tmp/foo      (wd: ~)
^Croot@vm-amd64:/mnt# more /tmp/foo
RUNTIME.CONTAINERNAME          RUNTIME.CONTAIN… PID              COMM           
  T      BYTES     OFFSET        LAT FILE                    
                                                258              dd             
  O          0          0          9 foo                     
                                                258              dd             
  O          0          0          8 bar                     
                                                258              dd             
  R        512          0        105 foo                     
                                                258              dd             
  F        511          0       6190 bar                     
                                                258              dd             
  R        512        512        106 foo                     
                                                258              dd             
  F        511        512       5467 bar                     
                                                258              dd             
  R        512       1024         48 foo                     
                                                258              dd             
  F        511       1024       5669 bar                     
                                                260              dd             
  O          0          0          9 foo                     
                                                260              dd             
  O          0          0          7 bar                     
                                                260              dd             
  R        512          0         18 foo                     
                                                260              dd             
  W        512          0        158 bar                     
                                                260              dd             
  R        512        512         10 foo                     
                                                260              dd             
  W        512        512         13 bar                     
                                                260              dd             
  R        512       1024          9 foo                     
                                                260              dd             
  W        512       1024         14 bar

Best regards.

[eiffel-fl]

Note that, there is a bug when both NTFS modules are loaded or compiled, as cilium/ebpf does not install several probes when a name correspond to several symbols:

francis@pwmachine:/mnt$ grep ntfs_file_open /proc/kallsyms                    
0000000000000000 t ntfs_file_open       [ntfs]
0000000000000000 t ntfs_file_open       [ntfs3]
francis@pwmachine:/mnt$ mount | grep /mnt
/home/francis/Codes/kinvolk/foo.img on /mnt type ntfs3 (rw,relatime,uid=0,gid=0,iocharset=utf8)
...
RUNTIME.CONTAINERNAME                     RUNTIME.CONTAINERIMAG… PID        COMM             T          BYTES         OFFSET           LAT FILE
                                                                 235883     dd               R            512              0             4 foo                             
                                                                 235883     dd               W            512              0             9 bar                             
                                                                 235883     dd               R            512            512             0 foo                             
                                                                 235883     dd               W            512            512             1 bar                             
                                                                 235883     dd               R            512           1024             0 foo                             
                                                                 235883     dd               W            512           1024             0 bar
# Events for open are missing as the probe is installed for ntfs_file_open for ntfs module and not ntfs3.

I will discuss this with cilium/ebpf maintainers.

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[eiffel-fl]

@alban @mauriciovasquezbernal This PR is pretty straightforward to review and the upstream problem should now have been addressed. Can I get reviews?

[mauriciovasquezbernal]

LGTM from code inspection. I don't have any ntfs3 partition available to test it now.

[eiffel-fl]

Thank you for the review!