5.4 kernel support

[chadbrewbaker]

Any way to get it partially working under the 5.4 kernel? Highest supported version for GitHub Actions workers and WSL2.

[rtkaratekid]

The author of the repo would probably know better than me, but because he's chosen to use the vmlinux.h file for including kernel structures, the easiest oldest kernel to support would be Linux 5.5 which is the the earliest version that most distros expose a non-compiled vmlinux.h file on. On most distros, Linux 5.4 and earlier requires custom compilation to ensure there are debug symbols present and you can use pahole to generate the expected vmlinux.h file.

I think that you could fork this and build the BPF programs using the standard kernel module way, but I've only glanced at the code and I'm not sure if there would be internal data structure issues.

Hope that helps!

[chadbrewbaker]

https://github.com/microsoft/WSL2-Linux-Kernel/tree/linux-msft-wsl-5.4.y I have most interest in as it's my day to day working environment. This repo could support a build that git submodules in that repo for WSL2 users - which is a lot. For Ubuntu Azure - probably need to contact an Ubuntu maintainer to add it as a package - 99% similar to the WSL2 build.

[harporoeder]

@rtkaratekid Thanks for your detailed post!

@chadbrewbaker I think it would be technically possible to support 5.4, but more things have to be changed than just the case mentioned by @rtkaratekid for example this is using kernel 5.8 ringbuffers and would need a fallback. I plan to focus the near future on packaging for Arch easing distribution, and supporting a couple more features.

I'll leave this issue open as I am interested in expanding the supported platforms

I am curious about your mention of Azure, are you interested in running this on headless machines?