What Is eBPF?

Chapter 3. eBPF Programs

In this chapter, let’s turn to what’s involved in writing eBPF code. We need to consider the eBPF program itself, that runs in the kernel, and also the user space code that will interact with it.

Kernel and User Space Code

First of all, what programming languages can you use to write eBPF programs?

The kernel accepts eBPF programs in bytecode form.¹ It’s possible to write this bytecode by hand, in much the same way that it’s possible to write application code in assembly language—but it’s generally more practical for humans to use a higher-level language that can be compiled (that is, translated automatically) into bytecode.

eBPF programs can’t be written in arbitrary high-level languages for a couple of reasons. First, the language compiler needs to have support for emitting the eBPF bytecode format that the kernel expects. Second, many compiled languages have runtime features—for example, Go’s memory management and garbage collection—that make them unsuitable. At time of writing the only options for writing eBPF programs are C (compiled with clang/llvm) and, more recently, Rust. The vast majority of eBPF code published to date is in C, and this makes sense given that it’s the language of the Linux kernel.

At a minimum, something in user space needs to load the program into the kernel and attach it to the right event. There are utilities such as bpftool to help with this, but these are low-level tools that assume detailed knowledge of eBPF and are ...