[Question] Is it possible to both support legacy and new kernels by writing code once?

[woodpenker]

I know it is possible to use BPF on 4.x kernel, but some features are not always supported, such as global var, /sys/kernel/btf/vmlinux, and tp_btf. If I want to write some tools to support from 4.x to 5.x kernels, I have to deal with these discord:

1. Define some macros to generate the suitable code for the target kernel like this.
2. I can use BTFHub to get some BTFs or use pahole to generate the BTF files for the ones not provided in the hub, and then let the tool load it by an option.
3. Define two or more entry points to hook at the same tracepoint using tp_btf, raw_tp, kprobe, or else, and then choose to load one by detecting the kernel's version or feature.

But the first one is not CORE, I still have to build twice to generate 2 tools with the same usage. Another way is to compile two bpf.o of the same code with global var or not, and then let the userspace decide which one to load. The second and third one needs some code change for tools from BCC like this.

So, is it possible to fill the gaps between different kernels? Are there some more discords? And does the community want this ability?

[anakryiko]

I don't think there is any magical solution. So what you describe is probably the way to do it. You can write your code to use the lowest common denominator set of features (e.g., don't use global vars at all, use BPF maps directly, etc). You'll lose some of the nice features and developer productivity, but you'll be able to support older kernels.

There is no magic bullet, in short.

[woodpenker]

Got it. Thank you for the explanation.