tests: runtime: Use nf_tables_newtable for module tests

nft_trans_alloc_gfp() is a static function that's called from multiple
locations. This means it can be partially inlined - inlined in some
places but not others. This makes the tests unreliable between different
kernel and compiler verisons.

Switch to nf_tables_newtable() which is used as a callback. The compiler
is forced to not inline this.

However, the offset on x86_64 needs to be adjusted. Dissassembly shows:

```
000000000000a7e0 <nf_tables_newtable>:
    a7e0:       f3 0f 1e fa             endbr64
    a7e4:       e8 00 00 00 00          call   a7e9 <nf_tables_newtable+0x9>
    a7e9:       41 57                   push   %r15
    a7eb:       41 56                   push   %r14
```

where 0xa7e4 is the first aligned instruction. 0xa7e4 - 0xa7e0 = 0x4, so
use that.

On aarch64, it seems 0x8 is still valid:

```
000000000000e080 <nf_tables_newtable>:
    e080: d503201f      nop
    e084: d503201f      nop
    e088: d503233f      paciasp
    e08c: d10283ff      sub     sp, sp, #0xa0
    e090: f800865e      str     x30, [x18], #0x8
```

where 0xe088 - 0xe080 = 0x8. So leave that alone.

Author: danobi

tests/runtime/btf

@@ -30,7 +30,7 @@ REQUIRES_FEATURE btf
 WILL_FAIL
 
 NAME kernel_module_attach
-RUN {{BPFTRACE}} -e 'fentry:nft_trans_alloc_gfp { printf("hit\n"); exit(); }'
+RUN {{BPFTRACE}} -e 'fentry:nf_tables_newtable { printf("hit\n"); exit(); }'
 AFTER nft add table bpftrace
 EXPECT hit
 REQUIRES_FEATURE fentry
@@ -39,7 +39,7 @@ REQUIRES nft --help
 CLEANUP nft delete table bpftrace
 
 NAME kernel_module_attach_wildcard
-RUN {{BPFTRACE}} -e 'fentry:nf_table*:nft_trans_alloc_gfp { printf("hit\n"); exit(); }'
+RUN {{BPFTRACE}} -e 'fentry:nf_table*:nf_tables_newtable { printf("hit\n"); exit(); }'
 AFTER nft add table bpftrace
 EXPECT hit
 REQUIRES_FEATURE fentry
@@ -48,18 +48,18 @@ REQUIRES nft --help
 CLEANUP nft delete table bpftrace
 
 NAME kernel_module_args
-RUN {{BPFTRACE}} -e 'fentry:nft_trans_alloc_gfp { printf("size: %d\n", args.size); exit(); }'
+RUN {{BPFTRACE}} -e 'fentry:nf_tables_newtable { printf("skb: %p\n", args.skb); exit(); }'
 AFTER nft add table bpftrace
-EXPECT_REGEX size: [0-9]+
+EXPECT_REGEX ^skb: 0x[a-f0-9]+$
 REQUIRES_FEATURE fentry
 REQUIRES lsmod | grep '^nf_tables'
 REQUIRES nft --help
 CLEANUP nft delete table bpftrace
 
 NAME kernel_module_types
-RUN {{BPFTRACE}} -e 'fentry:nft_trans_alloc_gfp { printf("portid: %d\n", args.ctx->portid); exit(); }'
+RUN {{BPFTRACE}} -e 'fentry:nf_tables_newtable { printf("skb len: %d\n", args.skb->len); exit(); }'
 AFTER nft add table bpftrace
-EXPECT_REGEX portid: [0-9]+
+EXPECT_REGEX ^skb len: [0-9]+$
 REQUIRES_FEATURE fentry
 REQUIRES lsmod | grep '^nf_tables'
 REQUIRES nft --help

tests/runtime/probe

@@ -179,17 +179,19 @@ EXPECT_REGEX progs: [1-9][0-9]+
 REQUIRES bpftool
 
 NAME kprobe_offset_module
-RUN {{BPFTRACE}} -e 'kprobe:nft_trans_alloc_gfp+0x5 { printf("hit\n"); exit(); }'
+RUN {{BPFTRACE}} -e 'kprobe:nf_tables_newtable+0x4 { printf("hit\n"); exit(); }'
 AFTER nft add table bpftrace
 EXPECT hit
 ARCH x86_64
 REQUIRES lsmod | grep '^nf_tables'
 REQUIRES nft --help
+# Proxy for testing if running virtualized. The offset is specific to our pre-built kernels.
+REQUIRES test -d /mnt/vmtest
 CLEANUP nft delete table bpftrace
 
-# Local entry point to nft_trans_alloc_gfp is located at offset of 8 bytes in ppc64 and aarch64.
+# Local entry point to nf_tables_newtable is located at offset of 8 bytes in ppc64 and aarch64.
 NAME kprobe_offset_module
-RUN {{BPFTRACE}} -e 'kprobe:nft_trans_alloc_gfp+0x8 { printf("hit\n"); exit(); }'
+RUN {{BPFTRACE}} -e 'kprobe:nf_tables_newtable+0x8 { printf("hit\n"); exit(); }'
 AFTER nft add table bpftrace
 EXPECT hit
 ARCH ppc64|ppc64le|aarch64