eBPF References

Extended Berkeley Packet Filter (eBPF) lets a small, verified program observe selected kernel events. User space is normal application code; the kernel is the privileged part of the operating system. A system call is a request from an application to the kernel, such as opening a file.