Whistler is a new Common Lisp-based DSL and optimizing compiler for eBPF that lets developers write, compile, load, and query eBPF programs entirely within a Common Lisp REPL session. It generates eBPF bytecode during macroexpansion, embeds it as a literal in the expansion, and loads it directly into the kernel without touching disk or requiring the clang+llvm toolchain. A pure-CL loader handles ELF parsing, map creation, FD relocation, kprobe/uprobe/XDP attachment, and ring buffer consumption via direct syscalls. A shared `defstruct` mechanism generates matching accessors for both the BPF kernel side and the CL userspace side, eliminating manual byte-offset parsing. Whistler can also import kernel struct definitions from BTF and tracepoint formats at compile time, and can generate matching C, Go, Rust, or Python struct headers for polyglot userspace code.
Table of contents
A taste #A real-world example #How it works #One struct, both sides #The kernel at your fingertips #The loader is pure CL too #Polyglot userspace #Permissions without root #Why this matters #Sort: