Suricata

Running Suricata with Netronome in XDP mode we got the following error:

Suricata version: 5.0.4-dev

Relevant af-packet config:

af-packet:
- cluster-type: cluster_qm
  xdp-filter-file: /etc/suricata/xdp_filter.bpf
  xdp-mode: hw
  use-percpu-hash: false
  bypass: true

ERROR: {"timestamp":"2020-06-29T13:00:09.509163+0200","log_level":"Error","event_type":"engine","engine":{"error_code":130,"error":"SC_ERR_INVALID_VALUE","message":"Unable to find 'cpus_count' map"}}

cpus_count map is createt in xdp_filter:

#if BUILD_CPUMAP
/* Special map type that can XDP_REDIRECT frames to another CPU */
struct bpf_map_def SEC("maps") cpu_map = {
    .type               = BPF_MAP_TYPE_CPUMAP,
    .key_size   = sizeof(__u32),
    .value_size = sizeof(__u32),
    .max_entries        = CPUMAP_MAX_CPUS,
};

struct bpf_map_def SEC("maps") cpus_available = {
    .type               = BPF_MAP_TYPE_ARRAY,
    .key_size   = sizeof(__u32),
    .value_size = sizeof(__u32),
    .max_entries        = CPUMAP_MAX_CPUS,
};

struct bpf_map_def SEC("maps") cpus_count = {
    .type               = BPF_MAP_TYPE_ARRAY,
    .key_size   = sizeof(__u32),
    .value_size = sizeof(__u32),
    .max_entries        = 1,
};
#endif

Following the documentation for Netronome CPU_MAP should be disabled https://suricata.readthedocs.io/en/latest/capture-hardware/ebpf-xdp.html.

This error originates from EBPFBuildCPUSet in util-ebpf.c, based on what I can see from the code it should not affect the functionality when running Netronome.