eBPF Programming: Understanding eBPF Bytecode and C Language

An eBPF program is a set of eBPF bytecode instructions. It's possible to write eBPF code directly in this bytecode, much as it's possible to program in assembly language. Humans typically find a higher-level programming language easier to deal with, and at least at the time of this writing, I'd say the vast majority of eBPF code is written in 'C' and then compiled to eBPF bytecode.

'C' is a popular choice because it's a familiar language for many developers, and it has good support for low-level operations like bit manipulation and pointer arithmetic. Additionally, the eBPF kernel API provides a set of helper functions that can be called from eBPF programs to interact with the kernel and perform common operations like reading and writing memory, accessing network packets, and performing system calls. These helper functions are written in 'C' and are automatically compiled into eBPF bytecode along with the rest of the program.

While 'C' is the most common language for eBPF programming, it's not the only option. Other languages like Rust and Go have also been used to write eBPF programs, and there are eBPF compilers and toolchains available for these languages as well. Additionally, there are projects like BCC (BPF Compiler Collection) that provide a set of high-level libraries and tools for writing eBPF programs in a variety of languages. These libraries abstract away some of the low-level details of eBPF programming, making it easier to write complex programs without having to deal with the intricacies of the eBPF bytecode directly.