cilium/cilium · error

Require support for the eBPF JIT (CONFIG_HAVE_EBPF_JIT=y and

Error message

Require support for the eBPF JIT (CONFIG_HAVE_EBPF_JIT=y and CONFIG_BPF_JIT=y)

What it means

CheckRequirements requires the eBPF JIT (CONFIG_HAVE_EBPF_JIT=y and CONFIG_BPF_JIT=y) when not in DryMode. Without JIT, eBPF programs are interpreted — too slow and, for Cilium, effectively unsupported — so probes.HaveBPFJIT() failing produces this startup-aborting error.

Source

Thrown at pkg/datapath/linux/requirements.go:45

		log.Error("Policy routing:NOT OK. "+
			"Please enable kernel configuration item CONFIG_IP_MULTIPLE_TABLES",
			logfields.Error, err,
		)
	}

	if option.Config.EnableIPv6 {
		if _, err := os.Stat("/proc/net/if_inet6"); os.IsNotExist(err) {
			return errors.New("kernel: ipv6 is enabled in agent but ipv6 is either disabled or not compiled in the kernel")
		}
	}

	if !option.Config.DryMode {
		if probes.HaveBPF() != nil {
			return errors.New("Require support for bpf() (CONFIG_BPF_SYSCALL=y)")
		}

		if probes.HaveBPFJIT() != nil {
			return errors.New("Require support for the eBPF JIT (CONFIG_HAVE_EBPF_JIT=y and CONFIG_BPF_JIT=y)")
		}

		if probes.HaveTCBPF() != nil {
			// If tcx is (explicitly) disabled and there's no tc-bpf fallback, suggest
			// a kernel with tc-bpf support.
			if !option.Config.EnableTCX {
				return errors.New("Require support for the clsact qdisc (CONFIG_NET_CLS_ACT=y), ingress classes (CONFIG_NET_SCH_INGRESS=y) and the bpf filter (CONFIG_NET_CLS_BPF=y)")
			}

			// If tcx is enabled but not supported, and there's no tc-bpf fallback,
			// suggest a kernel with tcx support.
			if probes.HaveTCX() != nil {
				return errors.New("Require support for tcx links (Linux 6.6 or newer)")
			}
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkbChangeTail) != nil {
			return errors.New("Require support for bpf_skb_change_tail() (Linux 4.9.0 or newer)")

View on GitHub (pinned to ac7b90affa)

Solutions

1. Enable the JIT at runtime: 'sysctl -w net.core.bpf_jit_enable=1' (and persist it in /etc/sysctl.d/)
2. If the kernel lacks CONFIG_BPF_JIT/CONFIG_HAVE_EBPF_JIT, boot a standard distribution kernel with JIT support
3. For hardened environments requiring JIT hardening, enable CONFIG_BPF_JIT_ALWAYS_ON instead of disabling JIT
4. If only validating configuration, use --dry-mode to bypass the check (datapath will still be slow without JIT)

Example fix

// before
cat /proc/sys/net/core/bpf_jit_enable  # 0
// after
sysctl -w net.core.bpf_jit_enable=1
echo 'net.core.bpf_jit_enable=1' >> /etc/sysctl.d/99-bpf.conf

b, err := os.ReadFile("/proc/sys/net/core/bpf_jit_enable")
if err != nil || strings.TrimSpace(string(b)) == "0" {
    return errors.New("BPF JIT disabled; run: sysctl -w net.core.bpf_jit_enable=1")
}

func bpfJITEnabled() bool {
    b, err := os.ReadFile("/proc/sys/net/core/bpf_jit_enable")
    return err == nil && strings.TrimSpace(string(b)) == "1"
}

if err := dp.CheckRequirements(); err != nil {
    if strings.Contains(err.Error(), "eBPF JIT") {
        _ = exec.Command("sysctl", "-w", "net.core.bpf_jit_enable=1").Run()
        return dp.CheckRequirements() // re-check after enabling
    }
    return err
}

When it happens

Trigger: Starting the agent on a kernel without BPF JIT support compiled in, or with JIT disabled via sysctl net.core.bpf_jit_enable=0 (HaveBPFJIT checks /proc/sys/net/core/bpf_jit_enable), typically on embedded or minimal kernel builds.

Common situations: Embedded/arm boards with non-JIT architectures; custom kernel configs missing CONFIG_BPF_JIT; distributions where bpf_jit_enable defaults to 0; hardened setups that disable JIT intentionally.

Related errors

• Require support for bpf() (CONFIG_BPF_SYSCALL=y)
• loading eBPF collection into the kernel: %w
• update map %s: %w
• unable to delete element %s from map %s: %w
• collecting %s programs: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/881ae975d8d830fe. Report an issue: GitHub.