Speaker
Description
Android partners have expressed significant interest in eBPF for a variety of purposes including system stability monitoring, performance monitoring, power consumption analysis, and customizable scheduling through sched_ext; however, providing an officially supported framework presents engineering challenges. Modern eBPF deployment requires CO-RE (Compile Once - Run Everywhere) support and userspace control surfaces, but Android's security model precludes allowing arbitrary applications to load unverified bytecode.
Moving eBPF verification directly into the kernel would allow these features while also satisfying Android safety requirements, but it's not a viable solution at present. Custom syscall interfaces for loading eBPF programs via file descriptors have been rejected upstream, and carrying these out-of-tree patches in the Android Kernel introduces unacceptable maintenance debt.
Instead, we propose using light skeleton-based loaders packaged within vendor modules to provide this functionality. This approach securely isolates components and avoids custom kernel syscalls. While this method restricts on-demand loading capabilities from userspace, it aligns with existing security boundaries. The implementation relies heavily on BTF and CO-RE, which introduces specific stability concerns. One challenge is that missing kernel type definitions or aggressive symbol trimming in production environments cause eBPF programs to fail silently.
The objective of this talk is to outline the architectural tradeoffs of the vendor module approach for eBPF in Android. We will detail the current limitations of light skeletons, address BTF stability concerns, and define the necessary constraints for secure vendor telemetry. This session will establish a technical baseline for future discussions regarding kernel maintainability and partner requirements.