ci: Fix bpf-linker installation on macOS

LLVM 19 is not packaged in brew or any other package repository for
macOS. Use LLVM tarball from Rust CI instead, to make sure we use the
newest LLVM.

Also, install LLVM 19 on Linux for consistency.

Co-authored-by: tyrone-wu <wudevelops@gmail.com>

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  LLVM_VERSION: 18
+  LLVM_VERSION: 19
 
 jobs:
   lint:
@@ -220,15 +220,19 @@ jobs:
         if: runner.os == 'Linux'
         run: cargo install bpf-linker --git https://github.com/aya-rs/bpf-linker.git
 
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: nightly
+          components: rust-src
+          targets: aarch64-unknown-linux-musl,x86_64-unknown-linux-musl
+
       - name: Install prerequisites
         if: runner.os == 'macOS'
         # The xargs shipped on macOS always exits 0 with -P0, so we need GNU findutils.
         #
         # The tar shipped on macOS doesn't support --wildcards, so we need GNU tar.
         #
         # The clang shipped on macOS doesn't support BPF, so we need LLVM from brew.
-        #
-        # We also need LLVM for bpf-linker, see comment below.
         run: |
           set -euxo pipefail
           brew update
@@ -237,22 +241,33 @@ jobs:
           | grep -q ^/Library/Frameworks/Python.framework/Versions/' _ {} \; -exec rm -v {} \;
           HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1 \
           brew install dpkg findutils gnu-tar llvm pkg-config qemu
+
+          # LLVM packaged in brew or any other package repository for macOS is usually too old for bpf-linker.
+          # Use LLVM tarball from Rust CI.
+
+          # Get the partial SHA from Rust nightly.
+          rustc_sha=$(rustc +nightly --version | grep -oE '[a-f0-9]{7,40}')
+          # Get the full SHA from GitHub.
+          rustc_sha=$(curl -s https://api.github.com/repos/rust-lang/rust/commits/$rustc_sha \
+            --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' \
+            --header 'content-type: application/json' \
+            | jq -r '.sha')
+          mkdir -p /usr/local/lib/rustc-llvm
+          wget -q -O - https://ci-artifacts.rust-lang.org/rustc-builds/$rustc_sha/rust-dev-nightly-x86_64-apple-darwin.tar.xz | \
+            tar -xJ --strip-components 2 -C /usr/local/lib/rustc-llvm
+
+          echo /usr/local/lib/rust-llvm >> $GITHUB_PATH
           echo $(brew --prefix)/opt/findutils/libexec/gnubin >> $GITHUB_PATH
           echo $(brew --prefix)/opt/gnu-tar/libexec/gnubin >> $GITHUB_PATH
           echo $(brew --prefix)/opt/llvm/bin >> $GITHUB_PATH
 
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: nightly
-          components: rust-src
-          targets: aarch64-unknown-linux-musl,x86_64-unknown-linux-musl
-
       - uses: Swatinem/rust-cache@v2
 
       - name: bpf-linker
         if: runner.os == 'macOS'
         # NB: rustc doesn't ship libLLVM.so on macOS, so disable proxying (default feature). We also
-        # --force so that bpf-linker gets always relinked against the latest LLVM installed by brew.
+        # --force so that bpf-linker gets always relinked against the latest LLVM from the latest
+        # LLVM downloaded above.
         run: cargo install --force bpf-linker --git https://github.com/aya-rs/bpf-linker.git --no-default-features
 
       - name: Download debian kernels

test/integration-ebpf/src/test.rs

@@ -3,8 +3,10 @@
 
 use aya_ebpf::{
     bindings::xdp_action,
+    bpf_printk,
     macros::{kprobe, kretprobe, tracepoint, uprobe, uretprobe, xdp},
     programs::{ProbeContext, RetProbeContext, TracePointContext, XdpContext},
+    EbpfContext,
 };
 
 #[xdp]
@@ -30,8 +32,20 @@ pub fn test_kretprobe(_ctx: RetProbeContext) -> u32 {
 }
 
 #[tracepoint]
-pub fn test_tracepoint(_ctx: TracePointContext) -> u32 {
-    0
+pub fn test_tracepoint(ctx: TracePointContext) -> u32 {
+    // Some arbitrary work, to make the program running for some time and have
+    // a real `run_time` in `test_program_info`.
+    let mut res = ctx.uid().wrapping_add(ctx.pid());
+    for _ in 0..10_000 {
+        res = res.wrapping_mul(123);
+        res ^= (ctx.pid() << 3) ^ (ctx.uid() << 4);
+        res = res.rotate_left(2);
+        res = res.reverse_bits();
+        res = res.swap_bytes();
+        res = res.count_ones();
+        unsafe { bpf_printk!(b"number %u", res) };
+    }
+    res
 }
 
 #[uprobe]

test/integration-test/src/tests/info.rs

@@ -214,6 +214,12 @@ fn test_prog_stats() {
         .unwrap();
     prog.load().unwrap();
     prog.attach("syscalls", "sys_enter_bpf").unwrap();
+
+    // Executing bpf syscalls to trigger `sys_enter_bpf`
+    for _ in 0..5 {
+        let _ = loaded_programs().collect::<Vec<_>>();
+    }
+
     let test_prog = prog.info().unwrap();
 
     kernel_assert!(