This gist was written quite a while ago. If you are still having problems enabling eBPF on WSL2 I would recommend filing an issue in their repo. If I end up trying it again in the future I'll update this gist with any changes that may be needed.

Can anyone give one hello-world demo to verify that bpf program can run on WSL2? In this way, we can troubleshoot that the issue is in bpf program aspect or wsl2 aspect?

Hi @baoqger,
I have a mistake:

FAILED: load BTF from vmlinux: Unknown error -2make: *** [Makefile:1179: vmlinux] Error 255

Has that ever happened to you?

Thank you for the nice and well structured guide, worked without any issues for me. 😃

Hi, @MetaT1an @satanshiro,

Have you tried using the following command

export KERNELRELEASE=$(uname -r)

to replace the original one in https://gist.github.com/MarioHewardt/5759641727aae880b29c8f715ba4d30f#file-enable_ebpf_on_wsl2-L15

For me, I can see the new content in /lib/modules/$(uname -r) after rebuilding the kernel.

The kernel KERNELRELEASE should have -WSL2 as the suffix.

@baoqger here is a hello-world i used, and it worked.

#!/usr/bin/python3
from bcc import BPF
from time import sleep

program = """
BPF_HASH(clones);

int hello_world(void *ctx) {
    u64 uid;
    u64 counter = 0;
    u64 *p;

    uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
    p = clones.lookup(&uid);
    if (p != 0){
        counter = *p;
    }

    counter++;
    clones.update(&uid, &counter);

    return 0;
}
"""

b = BPF(text=program)
clone = b.get_syscall_fnname("clone")
b.attach_kprobe(event=clone, fn_name="hello_world")
b.trace_print()

sleep(1000)

while True:
    sleep(2)
    s = ""
    if len(b["clones"].items()):
        for k,v in b["clones"].items():
            s += "ID {}: {}\t".format(k.value, v.value)
        print(s)
    else:
        print("No entries yet")

Here is a simpler one:

#!/usr/bin/python3  
from bcc import BPF

program = r"""
int hello(void *ctx) {
    bpf_trace_printk("Hello World!");
    return 0;
}
"""

b = BPF(text=program)
syscall = b.get_syscall_fnname("execve")
b.attach_kprobe(event=syscall, fn_name="hello")

b.trace_print()

then open a second terminal and run any linux command (ls, echo...etc) and you should see in the trace output Hello World

Can anyone give one hello-world demo to verify that bpf program can run on WSL2? In this way, we can troubleshoot that the issue is in bpf program aspect or wsl2 aspect?

Hi @baoqger, I have a mistake:

FAILED: load BTF from vmlinux: Unknown error -2make: *** [Makefile:1179: vmlinux] Error 255

Has that ever happened to you?

Hey, have you ever found a solution to this? I am having the same issue

Can anyone give one hello-world demo to verify that bpf program can run on WSL2? In this way, we can troubleshoot that the issue is in bpf program aspect or wsl2 aspect?

Hi @baoqger, I have a mistake:

FAILED: load BTF from vmlinux: Unknown error -2make: *** [Makefile:1179: vmlinux] Error 255

Has that ever happened to you?

Hey, habe you ever found a solution to this? I am having the same issue

Same :(

I have been trying to unfuck this for several days. This is a tough son of a bitch to solve. I have followed several guides and still FAILED: load BTF from vmlinux: Unknown error -22make: *** [Makefile:1179: vmlinux] Error 255

I successfully launched eBPF following the guide at https://learn.microsoft.com/en-us/community/content/wsl-user-msft-kernel-v6. However, I used Debian which required the installation of the following packages:

sudo apt install git python3 bc dwarves rsync

Additionally, to run the example Python code provided above, I had to install:

sudo apt install bpfcc-tools python3-bpfcc

Running it initially failed, but I managed to fix it by mounting debugfs with the command:

sudo mount -t debugfs debugfs /sys/kernel/debug

Finally, after opening a new Debian terminal, it printed the following:

b'           <...>-275     [004] d...1    91.948441: bpf_trace_printk: Hello World!'
b'            bash-276     [007] d...1    91.950385: bpf_trace_printk: Hello World!'
b'           <...>-277     [007] d...1    94.875099: bpf_trace_printk: Hello World!'

@deadash thank you!

It finally worked even after I tried several guides and got errors every time. I typed usbip and the menu appeared. I got my device to forward to the VM but I cant connect it to WSL1. I can only get WSL1 to work on the VM so im thinking about trying this with rasberrypi instead

Hi, @MetaT1an @satanshiro,

Have you tried using the following command

export KERNELRELEASE=$(uname -r)

to replace the original one in https://gist.github.com/MarioHewardt/5759641727aae880b29c8f715ba4d30f#file-enable_ebpf_on_wsl2-L15

For me, I can see the new content in /lib/modules/$(uname -r) after rebuilding the kernel.

The kernel KERNELRELEASE should have -WSL2 as the suffix.

Thank you! It works!

I wrote complete guide in my blog

https://massoudasadiblog.blogspot.com/2024/07/ebpf-on-wsl2-kernel-version-6x-ubuntu.html?m=1