diff --git a/loader/Loader.cpp b/loader/Loader.cpp index 6ec7458..5f0fb89 100644 --- a/loader/Loader.cpp +++ b/loader/Loader.cpp @@ -483,6 +483,14 @@ static int getSymNameByIdx(ifstream& elfFile, int index, string& name) { static bool mapMatchesExpectations(const unique_fd& fd, const string& mapName, const struct bpf_map_def& mapDef, const enum bpf_map_type type) { + // bpfGetFd... family of functions require at minimum a 4.14 kernel, + // so on 4.9-T kernels just pretend the map matches our expectations. + // Additionally we'll get almost equivalent test coverage on newer devices/kernels. + // This is because the primary failure mode we're trying to detect here + // is either a source code misconfiguration (which is likely kernel independent) + // or a newly introduced kernel feature/bug (which is unlikely to get backported to 4.9). + if (!isAtLeastKernelVersion(4, 14, 0)) return true; + // Assuming fd is a valid Bpf Map file descriptor then // all the following should always succeed on a 4.14+ kernel. // If they somehow do fail, they'll return -1 (and set errno), @@ -572,6 +580,16 @@ static int createMaps(const char* elfPath, ifstream& elfFile, vector& } enum bpf_map_type type = md[i].type; + if (type == BPF_MAP_TYPE_DEVMAP && !isAtLeastKernelVersion(4, 14, 0)) { + // On Linux Kernels older than 4.14 this map type doesn't exist, but it can kind + // of be approximated: ARRAY has the same userspace api, though it is not usable + // by the same ebpf programs. However, that's okay because the bpf_redirect_map() + // helper doesn't exist on 4.9-T anyway (so the bpf program would fail to load, + // and thus needs to be tagged as 4.14+ either way), so there's nothing useful you + // could do with a DEVMAP anyway (that isn't already provided by an ARRAY)... + // Hence using an ARRAY instead of a DEVMAP simply makes life easier for userspace. + type = BPF_MAP_TYPE_ARRAY; + } if (type == BPF_MAP_TYPE_DEVMAP_HASH && !isAtLeastKernelVersion(5, 4, 0)) { // On Linux Kernels older than 5.4 this map type doesn't exist, but it can kind // of be approximated: HASH has the same userspace visible api.