#ebpf #interpreter #filtering

tos-tbpf

Virtual machine and JIT compiler for eBPF programs

2 releases

0.14.1 Oct 15, 2025
0.14.0 Oct 15, 2025

#300 in Programming languages

Download history 267/week @ 2025-10-15 10/week @ 2025-10-22

277 downloads per month

Apache-2.0

620KB
13K SLoC

Contains (ELF lib, 37KB) tests/elfs/long_section_name.so, (ELF lib, 2KB) tests/elfs/bss_section_tbpfv0.so, (ELF lib, 2KB) tests/elfs/callx_unaligned.so, (ELF lib, 2KB) tests/elfs/data_section_tbpfv0.so, (ELF lib, 2KB) tests/elfs/program_headers_overflow.so, (ELF lib, 2KB) tests/elfs/relative_call.so and 14 more.

tos-tbpf

TBPF virtual machine

Description

This tbpf is forked from the Anza-xyz project.

This crate contains a virtual machine for eBPF program execution. BPF, as in Berkeley Packet Filter, is an assembly-like language initially developed for BSD systems, in order to filter packets in the kernel with tools such as tcpdump so as to avoid useless copies to user-space. It was ported to Linux, where it evolved into eBPF (extended BPF), a faster version with more features. While BPF programs are originally intended to run in the kernel, the virtual machine of this crate enables running it in user-space applications; it contains an interpreter, an x86_64 JIT-compiler for eBPF programs, as well as an assembler, disassembler and verifier.

The crate is supposed to compile and run on Linux, MacOS X, and Windows, although the JIT-compiler does not work with Windows at this time.

Developer

Dependencies

  • rustc version 1.83 or higher

Build and test instructions

  • To build run cargo build
  • To test run cargo test

License

Following the effort of the Rust language project itself in order to ease integration with other projects, the tbpf crate is distributed under the terms of both the MIT license and the Apache License (Version 2.0).

See LICENSE-APACHE and LICENSE-MIT for details.

Dependencies

~1–20MB
~325K SLoC