Check kernel configuration for known requirements

[ti-mo]

During the ARM porting effort, I ran into inexplicable behaviour of
BPF_PROG_LOAD on alarm kernel 5.5.10 and up. (when I switched to linux-armv7)
It would constantly return -EINVAL, which the manpage describes as follows:

For BPF_PROG_LOAD, indicates an attempt to load an invalid
program. eBPF programs can be deemed invalid due to
unrecognized instructions, the use of reserved fields, jumps
out of range, infinite loops or calls of unknown functions.

All cases were ruled out. All jumps were removed from the program, I could not
spot any unrecognized instructions (cilium/ebpf could dump the assembly
perfectly), I could not validate the usage of reserved fields, nor what
'reserved field' really meant. It did not contain any loops or function calls.

Eventually, I stumbled upon the CONFIG_BPF_EVENTS kernel config. This config
was missing on the armv7 kernel I was running, but it was present on the
kernel running on my RPi. This setting registers the BPF_PROG_TYPE_KPROBE
program type in the kernel. Since the kernel did not know the type, the syscall
would return -EINVAL.

I dug into this and found the following critical kernel configs:

• CONFIG_BPF: the BPF VM needs to be present
• CONFIG_BPF_SYSCALL: the bpf() syscall needs to be present
• CONFIG_BPF_EVENTS: bpf(BPF_PROG_LOAD... will return -EINVAL since BPF_PROG_TYPE_KPROBE is not registered.
• CONFIG_KPROBE_EVENTS: kprobes cannot be attached to perf events

After realizing this, I built and ran bpftool, and sure enough..

# strace ./bpftool feature
...
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_KPROBE, insn_cnt=2, insns=0xbefc7974, license="GPL", ...}, 120) = -1 EINVAL (Invalid argument)

With the tool's output, as a result:

CONFIG_BPF_EVENTS is not set
CONFIG_KPROBE_EVENTS is not set
CONFIG_UPROBE_EVENTS is not set

...
eBPF program_type kprobe is NOT available

---

Inspect /proc/config.gz or equivalent in /boot/ for kernel flags that are known to impact the functionality of the tool.

The ELF build system contains a list of kernel configs that are set on the kernel trees during probe build time. Those could also be checked.