eBPF feature support in Alibaba Cloud Linux

Check the eBPF features supported by the ANCK kernel

• (Recommended) Check the official documentation

  You can check the eBPF features for different versions in the ANCK ReleaseNotes.

• Bpftool detection

  1. (Optional) Run the following command to install the bpftool tool.

     sudo yum install bpftool 

  2. Run the following commands to check the runtime environment.

     • Run the following command to view the exact kernel version.

       uname -r

     • Run the following command to probe for eBPF feature support.

       sudo bpftool feature probe

     • Run the following command to view the kernel's BPF Type Format (BTF) information.

       bpftool btf dump file /sys/kernel/btf/vmlinux

• Manual testing

  To confirm the availability of a specific feature, write a minimal unit test program. Then, test whether the program can pass the kernel verifier and run successfully after it is loaded.

Write standardized code

• Use compatibility-focused constructs such as BPF_CORE_READ.

• Refer to examples from the libbpf standard library and the upstream kernel's test programs.

Long-term maintenance

• Continuously follow the ANCK ReleaseNotes.

• Establish a test environment and mechanism. Run your test case suite when a new kernel is released.

• Use eBPF CO-RE (Compile Once – Run Everywhere) and BTF symbol detection to improve compatibility.

Scenario 1: A program that loaded correctly suddenly fails to load

Symptoms

The program fails to load and returns an error message similar to the following:

libbpf: prog 'xxx': BPF program load failed: xxx
libbpf: prog 'xxx': -- BEGIN PROG LOAD LOG --
  [verifier output ...]
-- END PROG LOAD LOG --

Cause

The verifier in a new version of ANCK has stricter security requirements for BPF programs.

• The code uses an operation with security risks.

• The upstream community adjusted the behavior of certain operations, marking them as no longer safe or valid.

  For example, the upstream community patch bpf: Allow delete from sockmap/sockhash only if update is allowed narrows the scope of bpf_map_delete_elem(). Because some scenarios are now considered unsafe, an eBPF program that could previously call this helper function might be rejected by the new kernel.

Solution

Test your program on the latest upstream Linux kernel.

• If the upstream kernel also reports an error, check and modify your program code.

• If the upstream kernel runs correctly, contact us to report the issue.

Scenario 2: Confusion about feature support

Symptoms

Other Linux distributions with a 5.10 kernel do not support certain features, but ANCK 5.10 supports them.

Cause

Support for the 5.10 kernel varies among different communities and distributions. They typically support the eBPF features from the upstream 5.10 kernel and earlier versions. Support for features from version 5.11 and later must be evaluated on a case-by-case basis.