KernelScript: Unifying EBPF, Userspace, and Kernel Extensions in One Language

### Overview In this talk, Kung Wang, founder and CEO of Madicore Technology, presents KernelScript, a new type-safe programming language designed for eBPF-centric development. While eBPF provides high-performance packet filtering, tracing, security, and kernel customization (powering projects like Cilium, Katran, and bpftrace), developing eBPF solutions today suffers from a fragmented developer experience. Developers currently must write and maintain up to three separate pieces across different paradigms: the restricted in-kernel eBPF C program, a userspace loader leveraging libbpf to manage lifecycles and maps, and potentially a kernel module to register kernel functions (kfuncs). KernelScript aims to unify the eBPF program, userspace loader, and kernel extension layers into a single source file and language.

### Key Topics - **Ecosystem Fragmentation**: Developers currently contend with strict eBPF verifier restrictions, verbose libbpf boilerplate, kernel module C code, and distinct build environments. Existing alternatives like bpftrace are limited in scope (e.g., lacking raw kernel structure access or networking support), while Rust and Go libraries still often require C code for the in-kernel logic. - **Unified Compilation Targets**: A single KernelScript source file is processed by the KernelScript compiler to automatically emit up to three targets: standard eBPF C code, userspace loader logic, and kernel module code for any required kfuncs, accompanied by an auto-generated Makefile. - **Language Design and High-Level Syntax**: KernelScript syntax resembles a blend of Rust and high-level languages. It uses annotations (such as marking functions as an XDP program or kfunc) and supports higher-level abstractions like struct ops (e.g., for TCP congestion control). - **Map and Feature Simplification**: eBPF maps are defined and accessed like global Python dictionaries rather than requiring manual section macros, map structs, or explicit map lookup and update helper calls. KernelScript also abstracts tail calls into regular function calls and replaces nested C goto error handling with high-level try-catch structures translated into C goto labels under the hood. - **Integrations and Typing**: The toolchain leverages BPF Type Format (BTF) to extract kernel data structures and maintain type compatibility across kernel versions. It also supports auto-generating Python bindings to expose eBPF map data directly to Python environments for analytics and machine learning.

### Technical Details - **Implementation**: The KernelScript compiler is implemented in OCaml, chosen for its strong language parsing and string-translation capabilities. - **Workflow**: Project workflow involves project initialization, optional BTF data structure extraction, editing logic in a KernelScript template, and running the compiler to generate C source files and a Makefile for building the binaries. - **Current Capabilities**: The compiler currently supports at least six eBPF program types, dynamic pointers, XDP rate limiting, and complex struct ops such as TCP congestion control. - **Project Status**: KernelScript is currently in beta. Syntax and APIs are actively evolving and subject to change without backwards compatibility guarantees.

### Takeaways KernelScript lowers the barrier of entry for eBPF and Linux kernel customization by removing the need for deep, low-level libbpf and kernel module boilerplate. While the compiler and language are in early development, future plans include supporting additional eBPF program and map types, CPU scheduler struct ops (sched_ext), automated deployment pipelines, and live migration of eBPF programs. Additionally, Wang introduced a related companion project called Kernel Bundle Image (OCI-like container packaging) to simplify bundling and distributing eBPF binaries, kernel modules, and vmlinux artifacts.