ecapture: support non-core btf mode (#418733)

pkgs/by-name/ec/ecapture/package.nix

@@ -1,7 +1,6 @@
 {
   buildGoModule,
   fetchFromGitHub,
-  stdenv,
   bpftools,
   lib,
   nspr,
@@ -18,6 +17,9 @@
   bash,
   zsh,
   nix-update-script,
+  llvmPackages,
+  withNonBTF ? false,
+  kernel ? null,
 }:
 
 buildGoModule rec {
@@ -33,6 +35,7 @@ buildGoModule rec {
   };
 
   nativeBuildInputs = [
+    llvmPackages.libllvm
     clang
     fd
     bpftools
@@ -94,16 +97,23 @@ buildGoModule rec {
       --replace-fail '"errors"' ' '
   '';
 
-  postConfigure = ''
-    sed -i '/git/d' Makefile
-    sed -i '/git/d' variables.mk
+  postConfigure =
+    ''
+      sed -i '/git/d' Makefile
+      sed -i '/git/d' variables.mk
 
-    substituteInPlace Makefile \
-      --replace-fail '/bin/bash' '${lib.getExe bash}'
-
-    make ebpf
-    go-bindata -pkg assets -o "assets/ebpf_probe.go" $(find user/bytecode -name "*.o" -printf "./%p ")
-  '';
+      substituteInPlace Makefile \
+        --replace-fail '/bin/bash' '${lib.getExe bash}'
+    ''
+    + lib.optionalString withNonBTF ''
+      substituteInPlace variables.mk \
+        --replace-fail "-emit-llvm" "-emit-llvm -I${kernel.dev}/lib/modules/${kernel.modDirVersion}/build/include -Wno-error=implicit-function-declaration"
+      KERN_BUILD_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build KERN_SRC_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source make ebpf_noncore
+    ''
+    + ''
+      make ebpf
+      go-bindata -pkg assets -o "assets/ebpf_probe.go" $(find user/bytecode -name "*.o" -printf "./%p ")
+    '';
 
   checkFlags =
     let

pkgs/top-level/linux-kernels.nix

@@ -397,6 +397,11 @@ in
 
         dpdk-kmods = callPackage ../os-specific/linux/dpdk-kmods { };
 
+        ecapture = callPackage ../by-name/ec/ecapture/package.nix {
+          withNonBTF = true;
+          inherit kernel;
+        };
+
         exfat-nofuse =
           if lib.versionOlder kernel.version "5.8" then callPackage ../os-specific/linux/exfat { } else null;