{"record":{"id":"881ae975d8d830fe","repo":"cilium/cilium","slug":"require-support-for-the-ebpf-jit-config-have-ebpf","errorCode":null,"errorMessage":"Require support for the eBPF JIT (CONFIG_HAVE_EBPF_JIT=y and CONFIG_BPF_JIT=y)","messagePattern":"Require support for the eBPF JIT \\(CONFIG_HAVE_EBPF_JIT=y and CONFIG_BPF_JIT=y\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/linux/requirements.go","lineNumber":45,"sourceCode":"\t\tlog.Error(\"Policy routing:NOT OK. \"+\n\t\t\t\"Please enable kernel configuration item CONFIG_IP_MULTIPLE_TABLES\",\n\t\t\tlogfields.Error, err,\n\t\t)\n\t}\n\n\tif option.Config.EnableIPv6 {\n\t\tif _, err := os.Stat(\"/proc/net/if_inet6\"); os.IsNotExist(err) {\n\t\t\treturn errors.New(\"kernel: ipv6 is enabled in agent but ipv6 is either disabled or not compiled in the kernel\")\n\t\t}\n\t}\n\n\tif !option.Config.DryMode {\n\t\tif probes.HaveBPF() != nil {\n\t\t\treturn errors.New(\"Require support for bpf() (CONFIG_BPF_SYSCALL=y)\")\n\t\t}\n\n\t\tif probes.HaveBPFJIT() != nil {\n\t\t\treturn errors.New(\"Require support for the eBPF JIT (CONFIG_HAVE_EBPF_JIT=y and CONFIG_BPF_JIT=y)\")\n\t\t}\n\n\t\tif probes.HaveTCBPF() != nil {\n\t\t\t// If tcx is (explicitly) disabled and there's no tc-bpf fallback, suggest\n\t\t\t// a kernel with tc-bpf support.\n\t\t\tif !option.Config.EnableTCX {\n\t\t\t\treturn errors.New(\"Require support for the clsact qdisc (CONFIG_NET_CLS_ACT=y), ingress classes (CONFIG_NET_SCH_INGRESS=y) and the bpf filter (CONFIG_NET_CLS_BPF=y)\")\n\t\t\t}\n\n\t\t\t// If tcx is enabled but not supported, and there's no tc-bpf fallback,\n\t\t\t// suggest a kernel with tcx support.\n\t\t\tif probes.HaveTCX() != nil {\n\t\t\t\treturn errors.New(\"Require support for tcx links (Linux 6.6 or newer)\")\n\t\t\t}\n\t\t}\n\n\t\tif probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkbChangeTail) != nil {\n\t\t\treturn errors.New(\"Require support for bpf_skb_change_tail() (Linux 4.9.0 or newer)\")","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/linux/requirements.go#L27-L63","documentation":"CheckRequirements requires the eBPF JIT (CONFIG_HAVE_EBPF_JIT=y and CONFIG_BPF_JIT=y) when not in DryMode. Without JIT, eBPF programs are interpreted — too slow and, for Cilium, effectively unsupported — so probes.HaveBPFJIT() failing produces this startup-aborting error.","triggerScenarios":"Starting the agent on a kernel without BPF JIT support compiled in, or with JIT disabled via sysctl net.core.bpf_jit_enable=0 (HaveBPFJIT checks /proc/sys/net/core/bpf_jit_enable), typically on embedded or minimal kernel builds.","commonSituations":"Embedded/arm boards with non-JIT architectures; custom kernel configs missing CONFIG_BPF_JIT; distributions where bpf_jit_enable defaults to 0; hardened setups that disable JIT intentionally.","solutions":["Enable the JIT at runtime: 'sysctl -w net.core.bpf_jit_enable=1' (and persist it in /etc/sysctl.d/)","If the kernel lacks CONFIG_BPF_JIT/CONFIG_HAVE_EBPF_JIT, boot a standard distribution kernel with JIT support","For hardened environments requiring JIT hardening, enable CONFIG_BPF_JIT_ALWAYS_ON instead of disabling JIT","If only validating configuration, use --dry-mode to bypass the check (datapath will still be slow without JIT)"],"exampleFix":"// before\ncat /proc/sys/net/core/bpf_jit_enable  # 0\n// after\nsysctl -w net.core.bpf_jit_enable=1\necho 'net.core.bpf_jit_enable=1' >> /etc/sysctl.d/99-bpf.conf","handlingStrategy":"validation","validationCode":"b, err := os.ReadFile(\"/proc/sys/net/core/bpf_jit_enable\")\nif err != nil || strings.TrimSpace(string(b)) == \"0\" {\n    return errors.New(\"BPF JIT disabled; run: sysctl -w net.core.bpf_jit_enable=1\")\n}","typeGuard":"func bpfJITEnabled() bool {\n    b, err := os.ReadFile(\"/proc/sys/net/core/bpf_jit_enable\")\n    return err == nil && strings.TrimSpace(string(b)) == \"1\"\n}","tryCatchPattern":"if err := dp.CheckRequirements(); err != nil {\n    if strings.Contains(err.Error(), \"eBPF JIT\") {\n        _ = exec.Command(\"sysctl\", \"-w\", \"net.core.bpf_jit_enable=1\").Run()\n        return dp.CheckRequirements() // re-check after enabling\n    }\n    return err\n}","preventionTips":["Persist net.core.bpf_jit_enable=1 in /etc/sysctl.d/ on all nodes","Choose kernels with CONFIG_BPF_JIT=y (and ideally CONFIG_BPF_JIT_ALWAYS_ON)","Include JIT status in node readiness checks before starting the agent","Avoid hardened images that disable the BPF JIT"],"tags":["ebpf","jit","kernel","sysctl"],"backgroundTag":"bpf-jit-disabled","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}