Every probed kernel feature: its name, its bit in the scx_lib_features
rodata word or zero when only userspace consults it, and whether the
running kernel has it.
BPF_PROG_LOAD flag under which a load or store through a plain scalar is an
arena access, from 4c651a91bdfc in bpf-next. Not yet in the uapi header
libbpf-sys 1.7 ships.
Whether the kernel supports function tracing (CONFIG_FUNCTION_TRACER),
needed for fentry/fexit BPF programs to load or attach.
/proc/sys/kernel/ftrace_enabled only exists when it’s compiled in,
so its presence is a cheap proxy.
A fetching OR on arena memory, which the verifier rejects where the JIT has
no lowering for it. The JITs accept the fetching AND, OR and XOR as a
group, so one probe covers all three. The arena has to be mapped before
the load because the verifier requires its user address to be known.
Open a read-only descriptor on one of prog’s streams, stream_id being
BPF_STREAM_STDOUT or BPF_STREAM_STDERR. Reads block unless nonblock.
poll(2) reports POLLIN for data and POLLHUP once the program is freed, with
buffered data still readable. A kernel without the command fails with
EINVAL.