cilium/ebpf

Features

• Kernel Bytecode Execution - Loads compiled instructions into the kernel to trigger logic based on specific system events or network hooks.
• Cross-Platform Runtimes - Provides a runtime that enables the execution of eBPF bytecode on both Linux and Windows operating systems.
• Kernel Event Hooks - Allows binding eBPF programs to specific kernel events to trigger execution when the system reaches a defined state.
• Compile Once Run Everywhere Relocation - Adjusts memory offsets at runtime using type information to ensure bytecode compatibility across different kernel versions.
• eBPF Tooling - Executes eBPF bytecode on Windows systems using a platform-specific runtime compatible with standard implementations.
• Bytecode Loaders - Parses compiled eBPF object files and injects bytecode into kernel hooks for system-level execution.
• CO-RE Relocation - Provides a relocation engine and type-format utilities to ensure bytecode compatibility across different kernel distributions.
• Cross-Platform Deployment - Provides the ability to develop and run eBPF programs across multiple kernel versions and both Linux and Windows.
• Kernel Interfaces - Offers abstractions for interacting with kernel maps, ring buffers, and global variables from user space.
• Kernel Map Data Access - Performs lookups and retrievals of data stored in kernel maps from within an application.
• Kernel Map Management - Creates and manages map objects for sharing data between the kernel and user space.
• Kernel Observability Programs - Loads and compiles programs to run within the kernel for system-level observability, networking, and security.
• Kernel-to-User Bridges - Implements mechanisms for exchanging data and routing requests between the kernel and user-space via shared maps.
• Kernel-Userspace Shared Maps - Uses specialized kernel data structures to exchange information and maintain state between the kernel and the application.
• Kernel Version Compatibility Layers - Adjusts memory accesses at runtime using type formats so programs work across different distributions and versions.
• eBPF Go Libraries - Provides a comprehensive Go library for loading and managing eBPF programs and maps.
• Kernel Event Observability - Attaches programs to kernel hooks to monitor system events and extract performance data in real time.
• Kernel Ring Buffer Retrieval - Extracts data from kernel maps using specialized interfaces for performance events and ring buffers.
• Map Specification Parsing - Parses type-style or fixed-width map definitions from specific sections to initialize kernel maps.
• Multi-Architecture Binary Bundling - Embeds compiled objects for multiple CPU architectures into a single binary for portable deployment across different hardware.
• Kernel Feature Managers - Checks if the running kernel supports specific program types or helpers to ensure compatibility across different versions.
• Binary Asset Embedding - Embeds compiled objects for multiple CPU architectures into a single binary to enable deployment without external files.
• Metadata Section Parsing - Derives program types and map definitions by parsing metadata stored in specific sections of the compiled object file.
• Executable Program Loading - Parses compiled files into specifications to modify and load programs and maps into the kernel.
• Bytecode Compilation and Embedding - Compiles C programs into bytecode and generates glue code to embed and manage these programs within an application.
• Development Workflows - Implements a workflow for compiling C code into bytecode and generating type-safe Go scaffolding.
• File Descriptor Managers - Tracks kernel file descriptors and closes them during garbage collection to prevent resource leaks in the system.
• Go Code Generators - Automatically creates type-safe wrappers and structures from compiled objects to simplify interaction between user space and the kernel.
• Global Variable Mappings - Exposes mutable and read-only global variables from the binary for modification before they are loaded into the kernel.
• Section-Based Typing - Derives program types and attachment targets from file section names to simplify the loading process.
• Development Frameworks - Pure-Go library for loading and attaching eBPF programs.

Star history