no* BPF programs are written in a very small subset of C (or rust or C++), which does not include dynamic memory allocation or unbounded loops.

* you can use maps which are persistent key-value stores provided by the eBPF runtime, and you can call out to approved C functions provided by the kernel, but those won't allocate memory for you.

This is currently not easy to do. First of all, the kernel BPF implementation is GPLv2, which means you cannot rip out the runtime and embed it in your userspace code unless you are able to distribute your userspace software as GPLv2 (This is AFAIK and IANAL). For software engineering and license compatibility reasons, you probably want to use a clean implementation of eBPF.

Two such implementations exist. uBPF has a simple implementation. This implementation is likely not feature complete, as it is not regularly updated and the kernel BPF validator keeps getting new features. DPDK also has an implementation of BPF. This appears to be actively developed, but it also comes with a lot of baggage from DPDK. It may be possible to fork for this purpose, but it appears to primarily used for running traditional network filters on incoming packets in userspace.

What you are looking for is a really interesting possibility but would require a significant software engineering effort.

If you relax the constraint that BPF runs in userspace, it is possible to insert userspace dynamic tracing points (USDT) into your code, which will call out to a BPF program in the kernel when executed.

> First of all, the kernel BPF implementation is GPLv2, which means you cannot rip out the runtime and embed it in your userspace code unless you are able to distribute your userspace software as GPLv2

mmm right, should've thought of that.

> What you are looking for is a really interesting possibility but would require a significant software engineering effort.

thanks for the info, i appreciate it, and it gives me a bit to chew on.