[PATCH] bpf: Track contents of read-only maps as scalars

[Rafael David Tinoco <rafaeldtinoco@gmail.com>]

During tracee-ebpf regression tests, it was discovered that a CO-RE capable
eBPF program, that relied on a kconfig BTF extern, could not be loaded with
the following error:

libbpf: prog 'tracepoint__raw_syscalls__sys_enter': failed to attach to raw
 tracepoint 'sys_enter': Invalid argument

That happened because the CONFIG_ARCH_HAS_SYSCALL_WRAPPER variable had the
wrong value, despite kconfig map existing, misleading the eBPF program
execution (which would then have different pointers, not accepted by the
verifier during load time).

I got the patch proposed here by bisecting upstream tree with the testcase
just described. I kindly ask you to include this patch in the LTS v5.4.x
series so CO-RE (Compile Once - Run Everywhere) eBPF programs, relying in
kconfig settings, can be correctly loaded in kernel series v5.4.

Link: https://github.com/aquasecurity/tracee/issues/851#issuecomment-903074596

I have tested latest 5.4 stable tree with this patch and it fixes the issue.

-rafaeldtinoco