-
Shung-Hsi Yu (SUSE)
While safety and performance get most of the credit for BPF's success, a safe and fast program that couldn't do anything interesting would be rather useless. Much of the flexibility that makes BPF programs interesting today (e.g. indexing into a map value at a computed offset, walking packet data, reading a stack array at a variable index) was actually not there at the start.
In this talk,...
Go to contribution page -
Vineet Gupta
BPF Verifier has troubles grok'ing GCC generated code (having evolved with LLVM over time). This talk is about my recent work on BPF GCC and the kernel verifier and efforts to make them like each other more.
Go to contribution page -
Alexei Starovoitov
Support for all of Rust required rethinking of how the verifier processes instructions. Stack liveness, SCEV, indirect calls are known building blocks while more fundamental rewrite is still necessary. The talk will cover completed and upcoming work areas in the verifier, LLVM, GCC, rustc, libbpf.
Go to contribution page -
Daniel Borkmann (Isovalent), John Fastabend (Isovalent)
In times of Fable/Mythos or equivalent LLMs, security fixes and attack-surface hardening increasingly needs to land on production systems now, but data-center fleets, Kubernetes nodes, or embedded/air-gapped devices all typically share long patch-and-reboot cycles.
BPF is the natural vehicle for on-the-fly live mitigations and runtime visibility - to the kernel itself as well as to...
Go to contribution page -
Paul Chaignon (Isovalent)
The body of academic work on eBPF is growing so large and scattered that itโs hard to see the forest for the trees. Papers span all kinds of topics and conferences, vary wildly in quality, and are often dense and hard to parse.
This talk will present the dominant trends of research. To that end, we will first explain academia's heuristics to identify "high-quality papers"โit is not the...
Go to contribution page -
Gรผrkan Gรผr (Zurich University of Applied Sciences ZHAW)
Although eBPF is widely used to extend the Linux kernel, running programs in kernel space introduces critical security risks. Existing technical work often overlooks eBPF's entire security lifecycle. This talk aims to address this gap by systematically analyzing eBPF vulnerabilities, mitigations, and architectural limits. By reviewing research papers and CVEs, we will map real-world exploits...
Go to contribution page -
Laurin Brandner (ETH Zรผrich)
Recent advances in the Linux kernel have enabled increasingly complex kernel offloads with eBPF. Despite this, parsing application-layer protocols, e.g. HTTP, remains a challenge. The reason for this is the self-describing structure of such protocols, which typically requires more state and more complex control flow than a transport-layer protocol. This is unfortunate because supporting L7...
Go to contribution page -
Yonghong Song
Large-size Arguments
Current bpf verifier will reject a function if one of its arguments
Go to contribution page
is a union/struct or more than one register size (except __int128 type).
Such limitation forces users to work around codes to fit bpf prog
requirement, but such limitation does not exists for other languages,
like normal C, rust, etc. Without such limitation, users will be... -
Mr Joshua Lilly (Meta), Liam Wisehart
Host-side hardening for a confidential VM is not one control, it's an onion. AMD SEV protects guest memory, MetalOS and a measured/verified boot chain establish the platform, signing and provisioning gate what lands on disk, and process isolation constrains the runtime. This talk is about one specific layer of that onion, the eBPF LSM that enforces binary identity and process protection at...
Go to contribution page -
Alan Maguire (Oracle)
Traditionally the kernel community have introduced new sysctl tunables in places in the code where there is no "one-size-fits-all" answer. With BPF we have the opportunity to make such decision points programmable. A simple example of this is the kernel socket acceptq length, set via a combination of the listen() backlog and somaxconn sysctl. While the traditional advice has been to set this...
Go to contribution page -
Aniket Gattani (Google Inc.)
While the BPF verifier ensures kernel safety, its rigid static rules heavily bottleneck the development of complex kernel extensions. Last yearโs LPC introduced [Rex][1] (Rust Extensions) to address these gaps. By leveraging Rust, Rex aims to guarantee memory and type safety at compile time rather than relying on the restrictive verifier. While this initial iteration utilized runtime...
Go to contribution page -
Alan Maguire (Oracle)
Now that kernel modules can be built in Rust [1],[2], it seems timely to look at programming language constructs outside of C to assess their applicability to BTF representation. Suggestions include
- slices/"fat pointers" with type and size
- tagged unions
- generics
- interfaces
- lifetime tags
Rough suggestions will be made for how to represent these as BTF kinds to trigger...
Go to contribution page -
Puranjay Mohan (Meta)
The eBPF instruction set has quietly grown a concurrency surface: load_acquire/store_release instructions, arena atomics now JIT-compiled across x86, arm64, riscv and powerpc, resilient queued spinlocks, and lock-free ring buffers. eBPF programs routinely run concurrently across CPUs and increasingly coordinate through shared memory. Yet unlike the Linux kernel โ which has a formal,...
Go to contribution page -
YUSHENG ZHENG, Hao Sun (ETH Zurich)
eBPF users pay for verified safety with performance. Across 27 microbenchmarks extracted from production programs, code that reaches native speed when compiled directly is up to 2x slower through the eBPF pipeline. The gap is structural and cannot be closed by LLVM optimization passes or source code rewrites: every deployment runs on specific hardware under a specific workload, yet the...
Go to contribution page -
Roy Nchang (National Advanced School of Engineering (ENSPY), Yaoundรฉ)
eBPF programs can exchange data efficiently with other programs and userspace through maps, ring buffers, and kfuncs, but these mechanisms stop at the boundary of a kernel instance. The Linux kernel has no generic, safe, low-latency mechanism for eBPF programs in a guest and host to communicate through shared memory across the VM boundary. Royโs Google Summer of Code (GSoC) project [1]...
Go to contribution page -
Mr Reinhard Kugler (SBA Research)
The industry increasingly adopts Linux for automotive and industrial use cases, since companies like Red Hat or Canonical engaged in development of Linux platforms in safety-critical domains. Using container technologies or just a bootable images on restricted silicon, now software operates cyber-physical processes. Those platforms are often cloud-connected because of maintainability,...
Go to contribution page -
Tal Zussman (Columbia University)
Page faults, which occur when a program accesses a virtual memory page that is not mapped to physical memory, are traditionally handled by the operating system. However, many applications benefit from running custom page fault handling logic. For example, some applications may seek to prefill newly-faulted pages with content, or intercept writes in order to make a copy of the original...
Go to contribution page -
Martin Fink (Technical University of Munich)
Abstract
eBPF provides a safe way to extend the kernel functionality. To ensure safety, the kernel verifies the memory safety and termination of eBPF programs and is thus the security boundary for eBPF. It must accept untrusted programs from userspace and determine, under strict time and memory limits, whether they are safe to execute.
Today, the verifier symbolically executes program...
Go to contribution page -
Anton Protopopov (Isovalent at Cisco)
In the modern era, Linux kernel CVEs might accumulate faster than fleets can reboot into patched kernels. In some cases, this takes not even days. BPF-based mitigations can block vulnerable code paths at runtime, no reboot needed.
However, at the moment, BPF is far from being a golden bullet. Two mechanisms on how BPF can alter an execution path, LSM Hooks and error injection, are naturally...
Go to contribution page -
Alexis Lothorรฉ (Bootlin)
KASAN (Kernel Address Sanitizer) is a powerful developer tool for detecting
Go to contribution page
use-after-free and out-of-bounds memory accesses in the kernel code.
However, not all memory accesses performed by the kernel are covered by
KASAN monitoring. BPF programs are a major example: when they are
translated by the in-kernel JIT compiler, the kernel directly emits new
native instructions that then escape... -
Babis Stylianopoulos (Sony Interactive Entertainment), Jeffrey Barendse (Sony Interactive Entertainment)
At PlayStation, we see DDoS attacks of multiple terabits per second targeting game servers. Traditional DDoS mitigation systems can be costly, slow to react, and difficult to place close enough to the ingress points of the network.
This talk presents a token-based eBPF/XDP architecture for inline DDoS protection. We show how distributing short lived tokens to legitimate clients allows us to...
Go to contribution page -
Kornilios Kourtis (Isovalent), Mahรฉ Tardy (Isovalent)
BPF-based agents aim to be as transparent as possible while minimizing CPU and memory overhead. Real-world experience from projects such as Ciliumโs Tetragon has shown that moving more functionality directly into the kernel is an effective strategy. However, one remaining limitation for observability and logging is the lack of an API for sending data over the network directly from BPF...
Go to contribution page -
Toke Hรธiland-Jรธrgensen (Red Hat)
BPF usage has traditionally required system-wide capabilities, and giving an application access to using BPF is an all-or-nothing proposition. With BPF tokens, we gained the ability to delegate BPF capabilities to user namespaces with more granularity, and with an LSM we can increase granularity further.
Both BPF token usage, and an LSM require a userspace implementation of the policy...
Go to contribution page -
Gabriele Monaco (Red Hat Inc.)
RV is a lightweight method for verifying system behavior at runtime using, for instance, deterministic automata. Currently, RV monitors must be implemented in-kernel, meaning any new monitor requires going through the upstream kernel development process.
Go to contribution page
We can replicate the existing monitor infrastructure in BPF mapping kernel primitives to BPF equivalents such as maps and ring buffers,...
Choose timezone
Your profile timezone: