eBPF summit 2023 Register now

Infrastructure

ApplicationsInfrastructure

Major Infrastructure

  • Linux Kernel

    Linux Kernel

    eBPF Runtime

    The Linux kernel contains the eBPF runtime required to run eBPF programs. It implements the bpf(2) system call for interacting with programs, maps, BTF and various attachment points where eBPF programs can be executed from. The kernel contains a eBPF verifier in order to check programs for safety and a JIT compiler to translate programs to native machine code. User space tooling such as bpftool and libbpf are also maintained as part of the upstream kernel.

    Git treesWebsitePatchesMailing listOffice hoursCIDocs
  • LLVM Compiler

    LLVM Compiler

    eBPF Backend

    The LLVM compiler infrastructure contains the eBPF backend required to translate programs written in a C-like syntax to eBPF instructions. LLVM generates eBPF ELF files which contain program code, map descriptions, relocation information and BTF meta data. These ELF files contain all necessary information for eBPF loaders such as libbpf to prepare and load programs into the Linux kernel. The LLVM project also contains additional developer tools such as an eBPF object file disassembler.

    GitHubWebsiteCompiler ExplorerBugtrackerPatches
  • GCC Compiler

    GCC Compiler

    eBPF Backend

    The GCC compiler comes with an eBPF backend starting from GCC 10. Up to that point, LLVM has been the only compiler which supports generating eBPF ELF files. The GCC port is roughly equivalent to the LLVM eBPF support. There are some missing bits of functionality but the GCC community is working to close these gaps over time. GCC also contains eBPF binutils as well as eBPF gdb support for debugging of eBPF code that is traditionally consumed by the Linux kernel. Included as part of this is an eBPF simulator for gdb.

    Git repoWebsiteCompiler ExplorerBugtrackerMailing listDocs

Emerging

  • eBPF for Windows

    eBPF for Windows

    eBPF Runtime

    The eBPF for Windows project is a work-in-progress that allows using existing eBPF toolchains and APIs familiar in the eBPF ecosystem to be used on top of Windows. That is, this project takes existing eBPF projects as submodules and adds the layer in between to make them run on top of Windows.

    GitHubWebsiteOffice hoursSlack channel

  • uBPF

    Userspace eBPF Runtime

    An eBPF runtime that permits execution of eBPF programs in user mode, with support for an interpreter as well as JIT compilation of eBPF programs on x86-64 and ARM64 architectures. This project supports running on Windows, macOS, and Linux platforms.

    GitHub
  • rbpf

    rbpf

    User Space eBPF Runtime

    Running in user space, rbpf provides a cross-platform eBPF interpreter and a JIT-compiler for x86-64, implemented in Rust. It was initially a port of uBPF to Rust.

    GitHubCrateDocs
  • hBPF

    hBPF

    eBPF in Hardware

    An extended Berkley Packet Filter CPU implemented in hardware on FPGA. In contrast to classic HDL languages like Verilog or VHDL, Migen/LiteX (both based on Python) where used. Supports custom extensions to 'call' opcode and includes full test suite for each opcode for included emulator and simulator as well as for included hardware targets.

    GitHubWebsite

  • PREVAIL

    eBPF Verifier

    A polynomial-time eBPF verifier supporting bounded loops based on abstract interpretation.

    GitHub

  • BPF Conformance

    eBPF Conformance Testing Framework

    A conformance testing framework for eBPF runtime implementations. It provides a set of tests that can be used to verify that an eBPF implementation is compliant with the eBPF specification.

    GitHub

eBPF Libraries

  • Golang

    • eBPF is designed as a pure Go library that provides utilities for loading, compiling, and debugging eBPF programs. It has minimal external dependencies and is intended to be used in long running processes.
    • libbpfgo is a Go wrapper around libbpf. It supports BPF CO-RE and its goal is to be a complete implementation of libbpf APIs. It uses CGo to call into linked versions of libbpf.

  • C++

    • libbpf is a C/C++ based library which is maintained as part of the upstream Linux kernel. It contains an eBPF loader which takes over processing LLVM generated eBPF ELF files for loading into the kernel. libbpf received a major boost in capabilities and sophistication and closed many existing gaps with BCC as a library. It also supports important features not available in BCC such as global variables and BPF skeletons.

  • Rust

    • libbpf-rs is a safe, idiomatic, and opinionated wrapper API around libbpf written in Rust. libbpf-rs, together with libbpf-cargo (libbpf cargo plugin) allows to write 'compile once run everywhere' (CO-RE) eBPF programs.
    • redbpf is a Rust eBPF toolchain that contains a collection of Rust libraries to work with eBPF programs.
    • aya is an eBPF library built with a focus on operability and developer experience. It allows for both eBPF programs and their userspace programs to be written in Rust.

eBPF Auxiliary Libraries

  • libxdp

    Utilities for use with XDP

    libxdp is an XDP-specific library that sits on top of libbpf and implements a couple of XDP features: it supports loading of multiple programs to run in sequence on the same interface, and it contains helper functions for configuring AF_XDP sockets as well as reading and writing packets from these sockets.

    GitHub

Frequently Asked Questions

  • Are these projects under the eBPF Foundation?

    • This page lists a number of open source projects that use eBPF as the underlying core technology. These projects are not all under the eBPF Foundation but are listed here as a survey of the eBPF project landscape today.

  • Add your project

    1. Make sure that the project is meeting the requirements to be listed. See below.
    2. Open a pull request and provide the required information. Use one of the already listed projects as a template. The ordering of applications is based on the number of Github stars (high to low), updated on a quarterly basis.
    3. The pull request will be reviewed by the community and merged by one of the maintainers. If you have any questions, feel free to ask on Slack.

  • Are you maintaining a listed project?

    • If you are maintaining one of the listed projects and would like to adjust the content. Get in touch on Slack or open a pull request directly.

  • Requirements for a project to be listed

    Projects can be listed on this page as "Major" or "Emerging". The requirements for being listed as "Emerging" are:

    • The project must be open source. All source code must be licensed under an open source license. Any documentation must be licensed under an open license.
    • The project must be using eBPF as its underlying core technology (in other words, a project would lose its purpose if the eBPF parts are removed) or help accelerate the adoption of eBPF in production.
    • The project must be actively maintained.
    • The project must be open to collaboration and have a governance model following open source best-practices.

    In order to be listed as a "Major" project, a project must meet all of the requirements above, plus:

    • The project must have more than 50 contributors.
    • The project must be used in production-like environments with a significant amount of users. Since this information may not be easily discoverable from a link to the project, such information should be included in the pull request description.