Fix memfd probes offset. Fixes #214

[haesbaert]

We should get args from BTF, not hardcode them, RHEL9 for instance stashes a common_preempt_lazy_count which pushes the probe specific data.

        field:unsigned short common_type;       offset:0;       size:2; signed:0;
        field:unsigned char common_flags;       offset:2;       size:1; signed:0;
        field:unsigned char common_preempt_count;       offset:3;       size:1; signed:0;
        field:int common_pid;   offset:4;       size:4; signed:1;
--->    field:unsigned char common_preempt_lazy_count;  offset:8;       size:1; signed:0;
        field:__data_loc char[] filename;       offset:12;      size:4; signed:1;
        field:pid_t pid;        offset:16;      size:4; signed:1;
        field:pid_t old_pid;    offset:20;      size:4; signed:1;

[nicholasberlin]

Have you seen this? inspektor-gadget/inspektor-gadget#2444 (comment)

(From this PR: #209)

[haesbaert]

Ack, I'm withdrawing this PR after our meeting yesterday.

I hadn't realized there were two different structures, and using CORE on the ctx's zero len array is not trivial, we need to get btf_size_type and do an ugly dance.

*ON* RHEL9
struct trace_entry {
	short unsigned int type;
	unsigned char flags;
	unsigned char preempt_count;
	int pid;
	char common_preempt;
};

struct syscall_trace_enter {
	struct trace_entry ent;        [0  - 12[
	int nr;                        [12 - 16[
	long unsigned int args[0];     [16 - ..[
};

struct trace_event_raw_sys_enter {
	struct trace_entry ent;        [0  - 12[
	PAD0                           [12 - 16[
	long int id;                   [16 - 24[
	long unsigned int args[6];     [24 - (24 + 6 * 8)[
	char __data[0];                [32 - ..[
};

*NOT* RHEL9
struct syscall_trace_enter {
	struct trace_entry ent;        [0  -  8[
	int nr;                        [8  - 12[
	PAD0                           [12 - 16[ 
	long unsigned int args[0];     [16 - 16[
};

struct trace_event_raw_sys_enter {
	struct trace_entry ent;        [0  -  8[
	long int id;                   [8  - 16[
	long unsigned int args[6];     [16 - ..[
	char __data[0];                [.. - ..[
};

You can see that the args offset on both structures on both RHEL9 and not RHEL9 ends up at 16.
It's all a bit of sheer luck since since only one structure gets padded, so the trace_enter version still works. It's still a bit "wrong" since we use hard coded offsets.