# Check basic kernel BPF configuration
grep CONFIG_BPF=y /boot/config-$(uname -r)
# Expected output: CONFIG_BPF=y

grep CONFIG_BPF_SYSCALL=y /boot/config-$(uname -r)
# Expected output: CONFIG_BPF_SYSCALL=y

grep CONFIG_BPF_JIT=y /boot/config-$(uname -r)
# Expected output: CONFIG_BPF_JIT=y

grep CONFIG_XDP_SOCKETS=y /boot/config-$(uname -r)
# Expected output: CONFIG_XDP_SOCKETS=y

# Check BTF support (required for BPF CO-RE)
grep CONFIG_DEBUG_INFO_BTF=y /boot/config-$(uname -r)
# Expected output: CONFIG_DEBUG_INFO_BTF=y

# Check LSM BPF support (see step 7 if security policy features are required)
grep CONFIG_BPF_LSM=y /boot/config-$(uname -r)
# Expected output: CONFIG_BPF_LSM=y

# View BPF program limits (loading policy for unprivileged users)
cat /proc/sys/kernel/unprivileged_bpf_disabled
# Expected output: TencentOS Server 4 outputs 0 by default. Value meanings: 0=Allow unprivileged users to load BPF programs, 1=Prohibit and can be changed back, 2=Prohibit and cannot be changed back.

# If bpftool is not installed yet, run the following command to install it.
dnf install bpftool

# View all loaded BPF programs and their instruction counts
bpftool prog show
# Expected output: List all loaded programs, with each line containing:
# <prog_id>: <type>  name <name>  tag <tag>  gpl
#     loaded_at <time>  uid 0
#     xlated <instruction count> insns  limit 1000000 insns  jited <JIT instruction count> bytes  memlock <byte count>

# View detailed information of a specific program (JSON + verbose mode, replace <prog_id> with the actual ID)
bpftool prog show id <prog_id> -j -d
# Expected output: Program details in JSON format, including the xlated_insns field, which indicates the instruction count.

# Install the BCC toolkit.
dnf install bcc-tools
# Expected output: Dependencies resolved and installed successfully with no errors.

# Verify that the tool is installed.
ls /usr/share/bcc/tools/ | head -10
# Expected output: List tools such as opensnoop, execsnoop, biolatency, tcptop, and profile.

# Example: Trace file opens.
/usr/share/bcc/tools/opensnoop -d 5
# Expected output: Records of open() calls from all processes within 5 seconds, including the PID, COMM, FD, ERR, and PATH columns.

# Install bpftrace.
dnf install bpftrace
# Expected output: Dependencies resolved and installed successfully with no errors.

# Confirm the version.
bpftrace --version
# Expected output: bpftrace v0.x.x or later.

# List available tracepoints.
bpftrace -l 'tracepoint:syscalls:sys_enter_*' | head -10
# Expected output: List the sys_enter_* series of system call tracepoints.

# Trace all openat() system calls, counted by process.
bpftrace -e 'tracepoint:syscalls:sys_enter_openat { @[comm] = count(); }'
# Expected output: A table of openat call counts aggregated by process name, with statistics printed after pressing Ctrl+C.

# Function latency tracing (vfs_read latency histogram)
bpftrace -e 'kprobe:vfs_read { @start[tid] = nsecs; } kretprobe:vfs_read /@start[tid]/ { @us = hist((nsecs - @start[tid]) / 1000); delete(@start[tid]); }'
# Expected output: A histogram of vfs_read latency in microseconds, printed after pressing Ctrl+C.

# If bpftool is not installed yet, run the following command to install it.
dnf install bpftool
# Expected output: Installation succeeded with no errors.

# View all loaded BPF programs.
bpftool prog show
# Expected output: List all loaded programs along with their types, names, and instruction counts.

# View all BPF maps.
bpftool map show
# Expected output: List all BPF maps along with their types and sizes.

# View BPF programs attached to the network interface (replace <NIC name> with the actual NIC name).
bpftool net show dev <NIC name>
# Expected output: List the XDP/TC programs attached to the NIC. If no programs are attached, the output is empty.

# Install the libbpf development package.
dnf install libbpf-devel
# Expected output: Installation succeeded.

# Verify that BTF information is available.
ls /sys/kernel/btf/vmlinux
# Expected output: /sys/kernel/btf/vmlinux (the existence of this file indicates that BTF is available)

# Clone the libbpf-bootstrap template (requires network access to GitHub).
git clone https://github.com/libbpf/libbpf-bootstrap
# Expected output: Clone succeeded.

# Verify that the kernel supports BPF LSM.
grep CONFIG_BPF_LSM=y /boot/config-$(uname -r)
# Expected output: CONFIG_BPF_LSM=y

# View the currently enabled LSM list.
cat /sys/kernel/security/lsm
# Expected output: lsm list (TencentOS Server 4 defaults to capability,yama,selinux,bpf, with bpf enabled by default)

# If bpf is not in the list, add lsm=tee,bpf as a kernel boot parameter (a reboot is required for the change to take effect).
# A restart will cause service interruption, so perform it within a maintenance window. Modifying the LSM list affects system security policy behavior, so verify the change in a test environment first.
grubby --update-kernel=ALL --args="lsm=tee,bpf"
# Expected output: No errors.
# Restart to take effect
reboot

# Confirm after reboot.
cat /sys/kernel/security/lsm
# Expected output: An LSM list that includes bpf.

# CPU off-cpu analysis (5-second sampling)
/usr/share/bcc/tools/offcputime 5
# Expected output: A histogram of off-cpu time aggregated by kernel stack, used to identify blocking hotspots.

# Memory allocation tracing
/usr/share/bcc/tools/memleak
# Expected output: Statistics of memory allocation and deallocation aggregated by call stack, where unreleased memory indicates a leak.

# System call latency statistics
/usr/share/bcc/tools/syscount
# Expected output: A latency statistics table aggregated by system call.

# Method 1: Run as the root user
sudo <bpf command>

# Method 2: Add capabilities to the container runtime
docker run --cap-add CAP_BPF --cap-add CAP_SYS_ADMIN ...

# Method 3: Confirm that loading by unprivileged users is disabled (normal state)
cat /proc/sys/kernel/unprivileged_bpf_disabled
# Expected output: 0, 1, or 2 (1 or 2 indicates that loading BPF programs by unprivileged users is prohibited)

# View the current kernel version
uname -r
# Expected output: for example, 6.6.0-xxx.el4.x86_64

# Install the matching kernel-devel and kernel-headers packages.
dnf install "kernel-devel-$(uname -r)" "kernel-headers-$(uname -r)"
# Expected output: Installation succeeded.

# Confirm that the header file path exists
ls /lib/modules/$(uname -r)/build
# Expected output: The path exists and is a symbolic link pointing to the source code directory.

# Check the kernel BTF configuration
grep CONFIG_DEBUG_INFO_BTF=y /boot/config-$(uname -r)
# Expected output: CONFIG_DEBUG_INFO_BTF=y

# Verify that the BTF file exists.
ls -l /sys/kernel/btf/vmlinux
# Expected output: The file exists.

# If BTF is not enabled on the kernel, replace it with a kernel version that has BTF enabled.
# TencentOS Server 4 enables BTF by default. If BTF is missing, verify the kernel source.

# Use bpftool to view the actual instruction count of the program.
bpftool prog show
# Expected output: xlated <instruction count> insns  limit 1000000 insns

# If the instruction count approaches the limit, split the program into multiple smaller BPF programs.
# Or optimize the program logic to reduce loops and branches.
# Check whether any loops are not unrolled or any tail calls are not used.

# View the current value of bpf_stats
sysctl kernel.bpf_stats
# Expected output: kernel.bpf_stats = 0

# Enable BPF statistics collection (0 to disable, 1 to enable)
sysctl -w kernel.bpf_stats=1
# Expected output: kernel.bpf_stats = 1