Crate ebpfkit 

ebpfkit — High-Performance JIT eBPF Compilation and Filtering

Exposes a zero-dependency, bare-metal BPF compiler to bridge string constraints dynamically into kernel ring-0 operations.

It absolutely blitzes userspace tools like Ripgrep by discarding non-matching hardware pages before they ever cross the NVMe-to-Userspace DMA boundaries.

Platform: Linux only. This crate requires eBPF support which is a Linux kernel feature. On non-Linux platforms, the crate compiles but all public functions return errors.

Modules

assembler

Low-level eBPF opcode definitions and raw structure macros. Core eBPF (extended Berkeley Packet Filter) Assembler Primitive.

compiler

Dynamic runtime JIT compilation of regex and literal components. JIT Compiler for dynamic eBPF filter generation.

loader

Bare-metal syscall operations to load and bind BPF bytecode into the kernel. Native Linux syscall bridge for injecting JIT’d eBPF filters.

Macros

alu64_imm

Helper macro for assembling ALU operations with Immediate values.

alu64_reg

Helper macro for assembling ALU operations with Register sources.

exit

jmp_imm

Conditional Jumps.

jmp_reg

ldx_mem

Load explicitly from mapped pointers.

Enums

AttachError

Errors from attaching a kernel page discard filter.

Functions

attach_kernel_page_discard

Compiles and loads an active Kernel-Space Page Discard filter.