Hi @cfc4n / eCapture team,
I maintain bpfcompat (Apache-2.0): it boots real distro kernels in disposable QEMU/KVM VMs, load/attach-validates a compiled .bpf.o, and reports a per-kernel pass/fail matrix with classified failure reasons (missing BTF, CO-RE relocation, unsupported map/program/attach type).
eCapture's uprobe/kprobe CO-RE objects have to load across a very wide kernel range (and arches), which is exactly the surface bpfcompat targets. I'd be glad to run eCapture's compiled objects across a kernel spread and share the matrix — complementary evidence / a possible non-blocking CI lane, not a replacement for anything.
Context: a Falco modern_bpf reference matrix (it pinpoints the 5.8 ring-buffer boundary) and an enterprise/backported-kernel matrix (RHEL 8/9/10, Oracle UEK, Amazon Linux 2 incl. no-BTF 4.14, openSUSE — 14/14). Live demo.
Would a published "does eCapture load on these kernels" matrix (or a GH Actions lane) be useful? Happy to put one together against your build.
Independent test of a public project; not affiliated with or endorsed by eCapture.
Hi @cfc4n / eCapture team,
I maintain bpfcompat (Apache-2.0): it boots real distro kernels in disposable QEMU/KVM VMs, load/attach-validates a compiled
.bpf.o, and reports a per-kernel pass/fail matrix with classified failure reasons (missing BTF, CO-RE relocation, unsupported map/program/attach type).eCapture's uprobe/kprobe CO-RE objects have to load across a very wide kernel range (and arches), which is exactly the surface bpfcompat targets. I'd be glad to run eCapture's compiled objects across a kernel spread and share the matrix — complementary evidence / a possible non-blocking CI lane, not a replacement for anything.
Context: a Falco modern_bpf reference matrix (it pinpoints the 5.8 ring-buffer boundary) and an enterprise/backported-kernel matrix (RHEL 8/9/10, Oracle UEK, Amazon Linux 2 incl. no-BTF 4.14, openSUSE — 14/14). Live demo.
Would a published "does eCapture load on these kernels" matrix (or a GH Actions lane) be useful? Happy to put one together against your build.
Independent test of a public project; not affiliated with or endorsed by eCapture.