fix(capture): remove CONFIG_KALLSYMS_ALL dependency (#3381)

Change symbols used to identify a pipe to be from the text section
instead of data section.
This way, kernels compiled with CONFIG_KALLSYMS but without
CONFIG_KALLSYMS_ALL will be supported by the capture programs.

pkg/ebpf/c/common/ksymbols.h

@@ -41,9 +41,10 @@ statfunc void *get_etext_addr()
 statfunc struct pipe_inode_info *get_file_pipe_info(struct file *file)
 {
     struct pipe_inode_info *pipe = BPF_CORE_READ(file, private_data);
-    char pipe_fops_sym[14] = "pipefifo_fops";
+    char pipe_write_sym[11] = "pipe_write";
+    void *file_write_iter_op = BPF_CORE_READ(file, f_op, write_iter);
 
-    if (BPF_CORE_READ(file, f_op) != get_symbol_addr(pipe_fops_sym))
+    if (file_write_iter_op != get_symbol_addr(pipe_write_sym))
         return NULL;
 
     return pipe;

pkg/ebpf/c/vmlinux.h

@@ -423,9 +423,15 @@ typedef unsigned int fmode_t;
 
 struct dir_context {
 };
+struct iov_iter {
+};
+struct kiocb {
+};
+
 struct file_operations {
     int (*iterate_shared)(struct file *, struct dir_context *);
     int (*iterate)(struct file *, struct dir_context *);
+    long (*write_iter)(struct kiocb *, struct iov_iter *);
 };
 
 struct file {

pkg/events/core.go

@@ -9629,7 +9629,7 @@ var CoreEvents = map[ID]Definition{
 				{handle: probes.DoSpliceRet, required: true},
 			},
 			kSymbols: []KSymbol{
-				{symbol: "pipefifo_fops", required: true},
+				{symbol: "pipe_write", required: true},
 			},
 		},
 		params: []trace.ArgMeta{
@@ -9982,7 +9982,7 @@ var CoreEvents = map[ID]Definition{
 				{"prog_array", "send_bin", []uint32{TailSendBin}},
 			},
 			kSymbols: []KSymbol{
-				{symbol: "pipefifo_fops", required: true},
+				{symbol: "pipe_write", required: true},
 			},
 		},
 	},
@@ -10004,7 +10004,7 @@ var CoreEvents = map[ID]Definition{
 				{"prog_array", "send_bin", []uint32{TailSendBin}},
 			},
 			kSymbols: []KSymbol{
-				{symbol: "pipefifo_fops", required: true},
+				{symbol: "pipe_write", required: true},
 			},
 		},
 	},