We are trying to support older kernel version with perf_buff vs. also newer kernel version with ring_buff. With some kernel guarding, we could try to compile time. We wanted to have BPF_CORE feature to avoid different kernel version maintenance issues.
Is it possible to detect kernel version in bpf program at runtime and use respective data structure.
In user space we could use uname(x) to detect kernel version, anything in bpf kernel program to detect kernel version.
similarly, support for diff kernel version bpf_program__attach_uprobe vs. bpf_program__attach_uprobe_multi and kprobe versions.
Question is similar to ebpf - use ringbuf and perfbuf depending on kernel version (this is compile time fix). Looks like bpf provides macro https://nakryiko.com/posts/bpf-core-reference-guide. extern int LINUX_KERNEL_VERSION __kconfig;
Detect using uname in bpf userspace set it in global variable , share with kernel bpf. ?
Is there better way to solve issue.
// user space bpf
kernel_version = uname(buff);
if (kernel_version < 5.8) {
load_per_buffer();
} else {
load_ring_buffer();
}
// kernel space bpf
kernel_version = bpf_kernel_version() //extern int LINUX_KERNEL_VERSION __kconfig;
if (kernel_version < 5.8) {
update_per_buffer(); and submit;
} else {
update_ring_buffer(); and submit;
}