RHEL 7 eBPF loading failure

[jjedwa165]

eBPF has been backported for RHEL 7 w/ kernel 3.10-940+.

However only the following program types are supported

BPF_PROG_TYPE_KPROBE
BPF_PROG_TYPE_TRACEPOINT
BPF_PROG_TYPE_PERF_EVENT

For db9614b this causes an issue during the bpf_object__probe_loading call which checks to see if programs of type BPF_PROG_TYPE_SOCKET_FILTER can load.

Suggest changing this check to BPF_PROG_TYPE_TRACEPOINT

[anakryiko]

Yes, I'm aware of this problem, it came up before at least twice. The problem with doing TRACEPOINT or KPROBE (and I think we should stick to KPROBE, actually), is that some older kernels will support SOCKET_FILTER, but not TRACEPOINT/KPROBE. So I think the solution here would be to try SOCKET_FILTER, if that fails, try again KPROBE. If that succeeds, assume BPF subsystem is set up properly. WDYT? Would you be able to submit the patch for that (keep in mind it has to go through kernel mailing list, see README for more details).

[jjedwa165]

ok, will do.

[jjedwa165]

Sent. [PATCH] add multiple program checks to bpf_object__probe_loading