User Experience on mobile might not be great yet, but I'm working on it.

Your first time on this page? Allow me to give some explanations.

Awesome eBPF

A curated list of awesome projects related to eBPF.

Here you can see meta information about this topic like the time we last updated this page, the original creator of the awesome list and a link to the original GitHub repository.

Last Update: Dec. 1, 2020, 9 a.m.

Thank you zoidbergwill & contributors
View Topic on GitHub:
zoidbergwill/awesome-ebpf

Search for resources by name or description.
Simply type in what you are looking for and the results will be filtered on the fly.

Further filter the resources on this page by type (repository/other resource), number of stars on GitHub and time of last commit in months.

eBPF Essentials

Kernel Documentation

Index for BPF-related documentation coming with the Linux kernel.

eBPF specification (somewhat outdated; information should still be valid, but not exhaustive).

Frequently Asked Questions on the decisions behind the BPF infrastructure.

Frequently Asked Questions about contributing to eBPF development.

Manual Pages

Manual page about the bpf() system call, used to manage BPF programs and maps from userspace.

Manual page about using BPF with tc, including example commands and samples of code.

Description of the in-kernel helper functions forming the BPF standard library.

Other

Generic eBPF presentations

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

10.61K
1.96K
5d
Apache-2.0

An accessible introduction providing context, history, and details about the functioning of eBPF.

A set of slides covering all the basics about eBPF and XDP (mostly for network processing).

An introduction mostly covering the tracing aspects.

An introduction mostly covering the tracing aspects.

An introduction mostly covering the tracing aspects, first part with flame graphs.

A blog post from 2014 on the development of BPF and demonstrating what can be done with it, using an example of stateful socket filtering by attaching an eBPF program to a socket.

A description of all existing hooks for BPF program types, and of their interest.

A review of the kernel functions that can be called from within eBPF programs.

How BPF communicates with userspace - BPF maps, perf events, bpf_trace_printk.

Setting up your environment to build BPF programs.

A blog post covering the basics of eBPF as well as code samples in Go on how to build and load a minimal eBPF program into the kernel.

BPF Internals

Kernel Tracing

A detailed introduction to tracing with eBPF, from listing the available trace points to running bpftrace programs.

Systemtap, Kernelshark, trace-cmd, LTTng, perf-tool, ftrace, hist-trigger, perf, function tracer, tracepoint, kprobe/uprobe, and more.

XDP

Source text and experimental data for our paper describing XDP

89
13
1y 9m
n/a

Presentations and docs

493
86
1y 4m
n/a

A very accessible introduction to XDP, providing sample code to show how to process packets.

Generic documentation about most features of eBPF.

Contains some benchmark results obtained with the mlx4 driver.

Linux Kernel's fight against DPDK. Future plans (as of this writing) for XDP and comparison with DPDK.

Additional hints about XDP internals and expected evolution.

Details and use cases about XDP, with benchmark results, and code snippets for benchmarking as well as for basic DDoS protection with eBPF/XDP (based on an IP blacklisting scheme).

Advanced details about current memory issues faced by XDP developers.

How to get started with eBPF and XDP for normal humans. Also summarized by Julia Evans on her blog.

Update on XDP, and in particular on the redirect actions.

About packet filtering on Linux, DDoS protection, packet processing in the kernel, kernel bypass, XDP and eBPF.

Cloudflare's blog post talking about their move to using XDP for packet filtering.

AF_XDP

bpfilter

A blog post by Cilium on the the motivations behind eBPF and bpfilter, with a couple examples and links to other projects using eBPF and bpfilter.

Slides from a talk by Quentin Monnet with a background on eBPF and comparing bpfilter to iptables.

BTF

Kernel documentation about BTF, explaining how to use it.

A description of the work done with BTF to provide debugging information for BPF programs.

cBPF

Hardware Offload

Hardware offload for eBPF with TC or XDP (Linux kernel 4.9+), introduced by Netronome.

Tutorials

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

10.61K
1.96K
5d
Apache-2.0

Examples and hands-on labs for Linux tracing tools workshops

873
232
5m
MIT

XDP tutorial

617
165
16d
n/a

Operated by Netronome: some tutorials for network-related eBPF use cases, including an eBPF Offload Starting Guide.

How to get started with eBPF and XDP for normal humans. Also summarized by Julia Evans on her blog.

Examples

Prototyping kernel development work outside mainline

198
75
5m
GPL-2.0

Sample BPF offload apps.

16
4
7m
n/a

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

10.61K
1.96K
5d
Apache-2.0

Sample project demonstrating how to use eBPF to encap/decap packets with an MPLS label.

19
3
1y 45d
GPL-3.0

Sample ebpf programs to analyze

7
1
1y 10m
n/a

In the kernel tree: some sample eBPF programs.

In the kernel tree: Linux BPF selftests, with many eBPF programs.

Some networking programs to attach to the TC interface.

bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

10.61K
1.96K
5d
Apache-2.0

iproute2

Package containing tools for network management on Linux. In particular, it contains tc, used to manage eBPF filters and actions, and ip, used to manage XDP programs. Most of the code related to BPF is in lib/bpf.c.

The development tree, synchronised with net-next.

LLVM

Contains several tools used in eBPF workflows. Snapshots of the latest versions for Ubuntu/Debian can be retrieved from here.

libbpf

A C library used for handling BPF objects (programs and maps), and manipulating ELF object files containing them. It is shipped with the kernel and mirrored on GitHub.

bpftool and Other Tools from the Kernel Tree

Also some other tools in the kernel tree, under linux/tools/net/ for versions earlier than 4.15, or linux/tools/bpf/ after that:

A small debugger for cBPF programs.

A disassembler for both BPF flavors and could be highly useful for JIT debugging.

User Space eBPF

Userspace eBPF VM

262
53
7m
Apache-2.0

Generic eBPF runtime

95
12
11m
Apache-2.0

Rust virtual machine and JIT compiler for eBPF programs

262
25
10m
n/a

A new eBPF verifier, using abstract interpretation

52
9
5d
MIT

Trace Go program execution with uprobes and eBPF

131
9
22d
LGPL-3.0

Testing in Virtual Environments

Collection of vagrant scripts for testing xdp

65
18
3y 5m
n/a
22
7
4m
n/a

Projects Related to eBPF

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

10.61K
1.96K
5d
Apache-2.0

P4_16 reference compiler

266
206
90d
Apache-2.0

eBPF-based Networking, Security, and Observability

6.27K
716
89d
Apache-2.0

Suricata Extreme Performance Tuning guide - Mark II

66
14
2y 7m
GPL-2.0

Linux system exploration and troubleshooting tool with first class support for containers

6.33K
618
5d
Apache-2.0

Presentations and docs

493
86
1y 4m
n/a

High-level tracing language for Linux eBPF

3.24K
442
8d
Apache-2.0

Schedule bpftrace programs on your kubernetes cluster using the kubectl

1.09K
67
13d
MIT

Framework for running BPF programs with rules on Linux as a daemon. Container aware.

393
31
1y 6m
MIT

BPFd (Deprecated, please see README.md) : Berkeley Packet Filter daemon (BPFd). Makes it possible to run BCC tools across systems.

72
18
1y 5m
Apache-2.0

A debian-based shell environment designed for Android and adb

116
31
4m
n/a

P4 with eBPF to create high-performance programmable switches.

Related to the former item. Audio interview of John Fastabend by Ben Pfaff, one of the core maintainers of Open vSwitch.

P4 with some elements related to eBPF hardware offload on Netronome's NFP (Network Flow Processor) architecture.

video](https://www.youtube.com/watch?v=TnJF7ht3ZYc&list=PLkA60AVN3hh8oPas3cq2VA9xB7WazcIgs)

Interview of Thomas Graf by Ben Pfaff.

Ivan Pepelnjak interviewing Thomas, October 2016, on eBPF, P4, XDP and Cilium.

A layer 4 load-balancer based on XDP, open-sourced by Facebook.

Common Ethernet Driver Framework for faster network I/O, a technology initiated by Mellanox.

A library to create, load and use eBPF programs from Go.

ply

A small but flexible open source dynamic tracer for Linux, with features similar to the bcc tools, but with a simpler language inspired by awk and DTrace.

Helps with measuring power consumption for servers and uses eBPF programs for in-kernel aggregation of data.

The Code

with linux/include/uapi/bpf.h: definitions related to eBPF, to be used respectively in the kernel and to interface with userspace programs.

This directory contains most of BPF-related code. In particular, those files are worth of interest:

Different operations permitted by the system call, such as program loading or map management.

Functions and eBPF helpers related to networking (TC, XDP etc.); also contains the code to migrate cBPF bytecode to eBPF (all cBPF programs are translated to eBPF in recent kernels).

Functions and eBPF helpers related to tracing and monitoring (kprobes, tracepoints, etc.).

for x86. Exception is made for JIT compilers used for hardware offload, sitting in their drivers, such as linux/drivers/net/ethernet/netronome/nfp/bpf/jit.c for Netronome NFP.

and in particular in files act_bpf.c (action) and cls_bpf.c (filter): code related to BPF actions and filters with TC.

contains the function dev_change_xdp_fd() that is called through a Netlink command to hook a XDP program to a device, after is has been loaded into the kernel from user space. This function in turns uses a callback from the relevant driver.

Development and Community

XDP project collaboration through a git-repo

120
19
22d
n/a

BPF patches land in this tree. It is regularly merged into net-next, which is itself merged for each release to Linus' tree.

Mailing list for Linux kernel networking stack development. All patches are sent there for review and inclusion.

BPF is at the heart of the project, and is regularly discussed on the mailing list.

Other Lists of Resources on eBPF

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

10.61K
1.96K
5d
Apache-2.0

Presentations and docs

493
86
1y 4m
n/a