KernelScript: Cross-Boundary Typed DSL for eBPF Applications
For eBPF developers, KernelScript eliminates a class of silent cross-boundary bugs and reduces maintenance overhead, though it is an incremental improvement over existing manual practices.
KernelScript introduces a typed DSL for eBPF that unifies cross-boundary definitions (maps, programs, domains) into a single source, preventing bugs like mismatched map types that standard C/libbpf silently accepts. Evaluation on 43 workloads shows it catches such bugs at compile time and reduces diffs for cross-boundary changes by 5x.
eBPF lets developers extend Linux with custom packet processing, tracing, and scheduling logic, and a verifier proves before execution that the code will not crash the kernel. The programming model, however, is fragmented: a single application spans kernel code, a userspace loader, and shared maps, yet the relationships among these pieces go unchecked. E.g. A map or event type defined differently on each side silently corrupts shared state. We observe that these cross-boundary relationships duplicate information that a type system can unify. We present KernelScript, a DSL that types maps, program handles, and execution domains in one source, then compiles to standard C through the original toolchain. We evaluate KernelScript on 43 eBPF workloads covering XDP, TC, kprobe, tracepoint, and struct_ops. KernelScript rejects cross-boundary bugs at compile time that standard C/libbpf still builds and loads, a unified source shrinks the diffs for cross-boundary changes by 5x, and generated code remains compatible with the existing toolchain.