octave_libbpf: Authoring, Loading, and Driving eBPF Programs from GNU Octave

Abstract

eBPF (extended Berkeley Packet Filter) has become the de-facto technology for safe, programmable in-kernel observability and networking on Linux. The conventional eBPF workflow, however, is firmly rooted in a C toolchain: programs are authored in restricted C, compiled by clang with -target bpf, and driven from userspace through libbpf. This paper presents octave_libbpf, a GNU Octave package that exposes the full libbpf interface to Octave and, more unusually, implements an entire eBPF toolchain — an instruction assembler, a BTF type encoder, and an ELF64/BPF object writer — purely in Octave m-code. The result is that eBPF programs can be written, assembled, loaded, attached, inspected, and driven directly from the Octave prompt, with no C compiler and no clang in the loop. After describing the layered software architecture and the object-oriented API, we survey the documented common use cases and demonstrate the package's value in three domains: artificial-intelligence workload profiling, device-driver engineering, and network programming.