Skip to content

Instantly share code, notes, and snippets.

@MarioHewardt
Last active April 27, 2024 09:27
Show Gist options
  • Save MarioHewardt/5759641727aae880b29c8f715ba4d30f to your computer and use it in GitHub Desktop.
Save MarioHewardt/5759641727aae880b29c8f715ba4d30f to your computer and use it in GitHub Desktop.
Enable EBPF on WSL2
By default, EBPF programs will not run on WSL2 due to required kernel modules missing. The following example error is an
indication of this problem:
modprobe: ERROR: ../libkmod/libkmod.c:586 kmod_search_moddep() could not open moddep file '/lib/modules/4.19.84-microso
ft-standard/modules.dep.bin'
modprobe: FATAL: Module kheaders not found in directory /lib/modules/4.19.84-microsoft-standard
chdir(/lib/modules/4.19.84-microsoft-standard/build): No such file or directory
To fix this you need to rebuild the WSL2 kernel with the missing kernel modules. The below instructions are for Ubuntu 18.04 WSL2.
1. git clone https://github.com/microsoft/WSL2-Linux-Kernel.git
2. cd WSL2-Linux-Kernel
3. sudo apt install flex bison build-essential libelf-dev libncurses-dev libssl-dev
4. cp Microsoft/config-wsl .config
5. Add the kernel flags specified in https://github.com/iovisor/bcc/blob/master/INSTALL.md#kernel-configuration to .config
6. export KERNELRELEASE=4.19.84-microsoft-standard
NOTE: Make sure the version corresponds to the version of WSL2. Run: uname -a
7. make KERNELRELEASE=$KERNELRELEASE -j 4
8. make KERNELRELEASE=$KERNELRELEASE modules -j 4
9. sudo make KERNELRELEASE=$KERNELRELEASE modules_install
10. (confirm you can see files under /lib/modules/$(uname -r))
11. sudo mount -t debugfs debugfs /sys/kernel/debug (for any apps that uses it since its not mounted by default)
@deadash
Copy link

deadash commented Jan 26, 2024

I successfully launched eBPF following the guide at https://learn.microsoft.com/en-us/community/content/wsl-user-msft-kernel-v6. However, I used Debian which required the installation of the following packages:

sudo apt install git python3 bc dwarves rsync

Additionally, to run the example Python code provided above, I had to install:

sudo apt install bpfcc-tools python3-bpfcc

Running it initially failed, but I managed to fix it by mounting debugfs with the command:

sudo mount -t debugfs debugfs /sys/kernel/debug

Finally, after opening a new Debian terminal, it printed the following:

b'           <...>-275     [004] d...1    91.948441: bpf_trace_printk: Hello World!'
b'            bash-276     [007] d...1    91.950385: bpf_trace_printk: Hello World!'
b'           <...>-277     [007] d...1    94.875099: bpf_trace_printk: Hello World!'

@Slach
Copy link

Slach commented Jan 26, 2024

@deadash thank you!

@NexViolentus
Copy link

It finally worked even after I tried several guides and got errors every time. I typed usbip and the menu appeared. I got my device to forward to the VM but I cant connect it to WSL1. I can only get WSL1 to work on the VM so im thinking about trying this with rasberrypi instead

@WCY-dt
Copy link

WCY-dt commented Mar 27, 2024

Hi, @MetaT1an @satanshiro,

Have you tried using the following command

export KERNELRELEASE=$(uname -r)

to replace the original one in https://gist.github.com/MarioHewardt/5759641727aae880b29c8f715ba4d30f#file-enable_ebpf_on_wsl2-L15

For me, I can see the new content in /lib/modules/$(uname -r) after rebuilding the kernel.

The kernel KERNELRELEASE should have -WSL2 as the suffix.

Thank you! It works!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment