iiinova — where your digital self keeps evolving

Paul Chaignon @pchaigno.bsky.social · 08/10/2026

To empirically test the impact of this improvement without involving human trials, Kumar used various LLM models and checked their ability to repair broken BPF programs with and without the changes. All details are in the patchset: lore.kernel.org/bpf/20260815....

lore.kernel.org

Making sure you're not a bot!

000

Paul Chaignon @pchaigno.bsky.social · 08/10/2026

Example verifier error by @mtardy.bsky.social . It shows the error when calling the new bpf_ksock_send kfunc with an unbounded message length.

Screenshot of an example verifier error message on an incorrect bpf_ksock_send call. The error message reads "The third argument (R3) to bpf_ksock_send does not satisfy the verifier contract: the memory size in R3 may reach 2147483647 bytes, but variable memory accesses must stay below 536870912 bytes." It then shows the error in the C code and in the bytecode contexts.

100

Paul Chaignon @pchaigno.bsky.social · 08/10/2026

Linux v7.3 is going to include a rework of the #eBPF verifier errors. Most errors will now describe: - which specific verification rule was violated and why; - where in the C code the error is happening; - how the faulty state was reached; - and how the issue could be fixed.

lore.kernel.org

Making sure you're not a bot!

100

Paul Chaignon @pchaigno.bsky.social · 07/10/2026

I discussed the methodology to build the list of BPF papers at pchaigno.github.io/bpf/2025/01/.... I then used it to plot some statistics and navigate the different topics and questions being investigated in academia. I'll try to follow up with blog posts for more details.

pchaigno.github.io

eBPF Research Papers

Interactive list of eBPF research papers from top conferences according to CSRankings. The list can be filtered according to types of publications (ex., improving, using) and areas (ex., networking, v...

010

Paul Chaignon @pchaigno.bsky.social · 07/10/2026

I've uploaded the slides for my talk at #LinuxPlumbers on eBPF research: pchaigno.github.io/assets/Linux.... Video: www.youtube.com/live/UQCglEw...

A breakdown of eBPF papers in the top conferences across the different research domains (based on ACM SIGs).

111

Paul Chaignon @pchaigno.bsky.social · 07/10/2026

My colleague Alice Mikityanska presented her work on enabling BIG TCP for UDP tunnels at #LinuxPlumbers. She had to rework how BIG TCP works for IPv6 along the way, but we can now benefit from this in all Cilium setups! Slides: lpc.events/event/20/con... Stream: www.youtube.com/watch?v=xFxE...

Slide showing the performance benchmark results using netperf's TCP_STREAM. BIG TCP gives an approximate 10% improvement in throughput, and up to 30% for some cloud providers who're falling back to software GSO.

130

Paul Chaignon @pchaigno.bsky.social · 06/10/2026

They demo a couple of use cases: sending Tetragon logs to syslog, data to Apache Arrow, and even emails! All from BPF. Slides: lpc.events/event/20/con... Stream: youtube.com/live/UQCglEw... Patchset: lore.kernel.org/bpf/20260813...

000

Paul Chaignon @pchaigno.bsky.social · 06/10/2026

@mtardy.bsky.social and @kkourt.bsky.social show how you can now send UDP packets from BPF using new ksock kfuncs! The new kfuncs can create, connect, and send on an UDP socket. These operations currently require sleepable LSM.

Slide showing the new kfuncs allowing BPF programs to send UDP packets.

121

Paul Chaignon @pchaigno.bsky.social · 06/10/2026

The parser uses a deterministic finite automaton (DFA) to parse HTTP/1.1 and HTTP/2 and integrates with existing BPF programs using freplace. It can run on HTTPS traffic by attaching at the socket level and leveraging kTLS.

000

Paul Chaignon @pchaigno.bsky.social · 06/10/2026

Laurin Brandner implemented an HTTP parser using #eBPF! When used to build an in-kernel HTTP cache, it improves throughput by up to 3x at high incoming rates. Slides: lpc.events/event/20/con... Stream: youtube.com/live/UQCglEw... Paper: arxiv.org/pdf/2605.31084 Code: github.com/lerboe/beeper

Slide showing small illustration of the in-kernel HTTP cache.

142

Paul Chaignon @pchaigno.bsky.social · 06/10/2026

At #LinuxPlumbers, Daniel describes what is missing to finish building this. The BPF signing process with the in-kernel loader is documented at www.kernel.org/doc/html/lat....

000

Paul Chaignon @pchaigno.bsky.social · 06/10/2026

shirudo starts in early boot, runs as much as possible in the kernel, and relies on a TPM to ensure the state is as expected. It then uses a BPF program to check the signature of the patches and load them. The security patches use fmod_ret to patch specific kernel functions.

100

Paul Chaignon @pchaigno.bsky.social · 06/10/2026

This morning, Daniel Borkmann presented shirudo, a BPF-based platform for on-the-fly security mitigations. Demo: www.youtube.com/watch?v=dwNq... Slides: lpc.events/event/20/con... Stream: youtube.com/live/UQCglEw...

Slide showing the overall architecture of shirudo, with the packaging of security patches, their distributing to the target machines, and the signed loading in the kernel.

110

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

Slides: www.yunwei37.com/presentation... Stream: www.youtube.com/live/Df1XnT7... Paper: lpc.events/event/20/con...

010

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

Once verified, the kfunc call is restored. The JIT compilers see the kfunc and replace is with the optimized native instruction when supported. In this way, the JIT compilers keep a 1:1 mapping and the verifier doesn't change.

100

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

The second picture illustrates the workaround. The BPF program calls a kfunc that corresponds to optimized instructions on some archs. The verifier replaces the kfunc call with corresponding unoptimized BPF bytecode and verifies it.

Slide illustrating the workaround. The BPF program calls a kfunc that corresponds to optimized instructions on some archs. The verifier replaces the kfunc call with corresponding unoptimized BPF bytecode and verifies it. Once verified, the kfunc call is restored. The JIT compilers see the kfunc and replace is with the optimized native instruction when supported. In this way, the JIT compilers keep a 1:1 mapping and the verifier doesn't change.

111

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

The first picture shows the impact of the JIT compilation on performance. The authors show that the performance hit doesn't come from running in kernel space, nor from going through the bytecode: LLVM is able to generate efficient code. It comes from the simple JIT compilers.

Slide showing the impact of the JIT compilation on performance. The authors show that the performance hit doesn't come from running in kernel space, nor from going through the bytecode: LLVM is able to generate efficient code. It comes from the simple JIT compilers.

100

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

The eBPF JIT compilers run after verification and therefore need to stay simple. They're thus missing many optimizations (compared to LLVM backends) and hurting performance. At #LinuxPlumbers, Yusheng Zheng proposes to work around that with verified inline kfuncs.

110

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

At #LinuxPlumbers, @shunghsiyu.bsky.social had another great talk explaining how the eBPF verifier's value tracking evolved over time, including an explanation of the new cnum abstract domain! Slides: lpc.events/event/20/con... Stream: www.youtube.com/live/Df1XnT7...

021

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

KASAN instruments the kernel to surface out-of-bounds and use-after-free bugs to testing tools like syzkaller. BPF remained a blind spot however. At #LinuxPlumbers, Alexis Lothoré discusses his recent work to close this gap. Slides: lpc.events/event/20/con... Stream: www.youtube.com/live/Df1XnT7...

Slide showing the KASAN-instrumented x86 code output by the JIT compiler, side by side with the original BPF code and the uninstrumented x86 code.

031

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

He found three concurrency bugs in the compiler backends, the JIT compilers, and the arena allocation. At #LinuxPlumbers.

000

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

To find memory ordering bugs in BPF, Puranjay Mohan wrote a tool to convert the existing Linux litmus tests into BPF programs that cover the same memory ordering behaviors. Slides: lpc.events/event/20/con... Stream: www.youtube.com/live/Df1XnT7... Code: github.com/puranjaymoha...

Slide showing how weak memory behavior can cause issues.

110

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

With Rust kernel modules and soon BPF programs in Rust, BTF needs to support Rust constructs. Alan Maguire explains what's needed at #LinuxPlumbers. Slides: lpc.events/event/20/con... Stream: www.youtube.com/live/Df1XnT7...

Slide showing some of the rich types Rust has compared to C code.

021

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

Arguments larger than 64-bits will be spread over two consecutive registers. Return values will be divided between R0 and R2. This new support will require LLVM23 and Linux v7.4. The code can be seen at lore.kernel.org/bpf/20260912... and lore.kernel.org/bpf/20260819....

000

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

At #LinuxPlumbers, Yonghong Song continues with the better Rust support topic, discussing his work to support 128-bit arguments and return values. Slides: lpc.events/event/20/con... Stream: www.youtube.com/live/Df1XnT7...

Slide showing how 128-bit values are handled for both function arguments and return values, with the layout on the registers.

100

Paul Chaignon @pchaigno.bsky.social · 05/10/2026

Alexei Starovoitov at #LinuxPlumbers: "If it passes the [Rust] compiler, the verifier has to accept it." Better support for Rust code is coming to BPF! Slides: lpc.events/event/20/con... Stream: www.youtube.com/live/Df1XnT7...

Slide showing the changes that were or are needed to be able to accept programs from rustc through the verifier.

010

Paul Chaignon @pchaigno.bsky.social · 02/10/2026

Litmus tests are small concurrent programs that expose weak memory behaviors. Ali Siddiqui and Xiaoguang Wang show how #eBPF can enforce placement and timing scheduling invariants to improve the effectiveness of litmus tests. Video: www.youtube.com/watch?v=e1iU... Paper: dl.acm.org/doi/pdf/10.1...

Screenshot of the conclusion slide from the presentation, showing the system overview and summarizing the core idea.

020

Paul Chaignon @pchaigno.bsky.social · 02/10/2026

The cost of going through the BPF bytecode is unknown right now. At the eBPF'26 workshop, Hoang Duong presented a first step toward answering this with a setup to measure the impact on the instruction count. Slides: ebpf.github.io/2026/slides/... Paper: dl.acm.org/doi/pdf/10.1...

Slide showing an example of difference in the x86 assembly when compiling from C directly and through the eBPF bytecode. In this example, a comparison of 8 bits translates to 1 instruction in the first case and 3 instructions in the second case because the eBPF bytecode doesn't have 8-bit comparisons.

030

Paul Chaignon @pchaigno.bsky.social · 02/10/2026

Thanks to everyone who helped make this edition a success, from the people who submitted to the TPC members and the SOSP organizers!

000

Paul Chaignon @pchaigno.bsky.social · 02/10/2026

All papers for the SOSP eBPF'26 workshop are now available at ebpf.github.io/2026/schedul..., with most of the slides and even one video recording! They cover ongoing work on BPF's performance & verification, and on networking, GPU communication, and CPU scheduling use cases.

The front & contents pages of the ACM SOSP eBPF'26 Workshop proceedings, showing the city of Prague where it happened, and the list of published papers.

121

Paul Chaignon @pchaigno.bsky.social · 01/10/2026

The idea is simple, so Tal then dived into several impressive use cases: reducing downtime during live snapshotting of Firecracker VMs, implementing lazy relocations during dynamic linking, speeding up garbage collection in Java, and more.

010

Paul Chaignon @pchaigno.bsky.social · 01/10/2026

Tal Zussman presented bpf_fault at SOSP, the top OS research conference. bpf_fault enables custom page fault handling in the kernel with x6.7 lower latency than the existing userspace solution. Slides: talzussman.com/slides/bpf_f... Paper: dl.acm.org/doi/pdf/10.1... Code: github.com/bpf-fault/bp...

Slide showing how bpf_fault works: a page fault triggers the BPF program, which writes directly into the newly-allocated page.

131

Paul Chaignon @pchaigno.bsky.social · 01/10/2026

The talk has a lot more details on how LAVD also traces futex operations, handles dispatch queues, or leverages the energy model. The slides are a bit dense but include a lot of animations and diagrams to illustrate how LAVD works. Recording: www.youtube.com/live/t0rhCUg...

111

Paul Chaignon @pchaigno.bsky.social · 01/10/2026

Those tasks wait often, wake up other tasks, and only run briefly. Using these three signals, LAVD determines which tasks to urgently run.

Screenshot of the slide showing the three signals LAVD uses to determine which tasks sit in the middle of chains and should be urgently scheduled. The signals are the wait frequency (how often the task sleeps waiting on something external), the wake frequency (how often it wakes another task), and the runtime (the average runtime per schedule).

100

Paul Chaignon @pchaigno.bsky.social · 01/10/2026

LAVD infers which tasks are urgent without annotations or configuration from users. Instead, it prioritizes tasks that sit in the middle of a chain that are the bottlenecks for an application.

Screenshot of the slide showing a diagram with three tasks, A, B, and C. A wakes B which wakes C. B therefore blocks on A and delays everything downstream.

110

Paul Chaignon @pchaigno.bsky.social · 01/10/2026

I thought sched_ext would give birth to many highly-specialized CPU schedulers. LAVD is proving me wrong by optimizing both gaming and cloud workloads. At @kernelrecipes.bsky.social, Changwoo Min and Gavin Guo present its design and how this was made possible.

Screenshot of the slide showing the domains where LAVD has been and could be used. It started with gaming, has expanded to server fleets, and may be used for AI workloads in the future.

120

Paul Chaignon @pchaigno.bsky.social · 25/09/2026

The new limit is supported by the two main JIT compilers, x86-64 and aarch64's, and applies to the whole call chain. Supporting this required a bunch of changes in the verifier, implemented by Kumar Kartikeya Dwivedi. See the patchset for more details.

020

Paul Chaignon @pchaigno.bsky.social · 25/09/2026

This is a significant increase from the 512 bytes limit and likely to help simplify many existing programs in the long term. In Cilium, we're often running close to the current limit and reducing our stack usage tends to increase our BPF complexity. So a 4x bump is definitely welcome!

120

Paul Chaignon @pchaigno.bsky.social · 25/09/2026

eBPF programs will be able to use 2048 bytes of stack starting with Linux v7.4! lore.kernel.org/all/20260924...

Screenshot of the new constant holding the 2048 bytes limit from commit ecc441fc774e ("bpf: Size the per-frame verifier structures for a 2 KiB stack").

172

Paul Chaignon @pchaigno.bsky.social · 22/09/2026

New #eBPF ideas merged upstream sometimes take years before they are discovered, reused, and improved by the research community. I didn't want that for netkit, so I proposed writing a paper about it to Daniel. I'll present it at the eBPF workshop next week! pchaigno.github.io/ebpf/2026/09...

pchaigno.github.io

netkit: Specializing Linux Packet Delivery for Container Networks

This post summarizes our netkit paper from the eBPF’26 workshop at ACM SOSP. The netkit paper proposes an eBPF-based datapath to specialize the Linux networking stack and eliminate redundant backlog q...

043

Paul Chaignon @pchaigno.bsky.social · 15/09/2026

Dan has been active in the eBPF research community for several years, publishing in the best conferences, and of course, at the eBPF workshop. He was recently awarded the 2026 eBPF Foundation grant to work on verifier rejection errors. I can't wait to see his presentation at the workshop!

010

Paul Chaignon @pchaigno.bsky.social · 15/09/2026

We're very lucky to have Dan Williams give the keynote talk at the #eBPF workshop this year! The tentative schedule: ebpf.github.io/2026/schedul....

ebpf.github.io

eBPF'26 — Schedule

Schedule for the fourth eBPF workshop at ACM SOSP, with the papers, their authors, and abstracts.

120

Paul Chaignon @pchaigno.bsky.social · 15/09/2026

AF_XDP copy mode has received less attention than its zero-copy mode. At Netdev 0x1A, Jason Xing showed how he almost doubled the performance of AF_XDP copy mode after methodically profiling it! Slides: netdevconf.info/0x1A/docs/ne... Recording: www.youtube.com/watch?v=nmyu...

Slide showing the second patch sent by Jason Wing, to use more fine-grained locks.

030

Paul Chaignon @pchaigno.bsky.social · 14/09/2026

The list now has 109 papers in total and clearly shows the increasing presence of eBPF papers in the top conferences. I'll be commenting on this aspect of eBPF research and many others during my talk at Linux Plumbers next month: lpc.events/event/20/con...!

Plot showing the increasing number of eBPF papers published over the years in conferences listed by CSRankings. The first eBPF paper was published in 2018 and it goes up to 31 papers published last year.

010

Paul Chaignon @pchaigno.bsky.social · 14/09/2026

I've added 25 papers to my list of #eBPF research papers: pchaigno.github.io/bpf/2025/01/...! It includes some papers I had missed, but now also counts papers from additional conferences (hidden by default), such as EuroSys, Usenix ATC, and OOPSLA.

pchaigno.github.io

eBPF Research Papers

120

Paul Chaignon @pchaigno.bsky.social · 09/09/2026

Now that the camera-ready for SOSP'26 has passed, a lot of papers have their final titles and preprint uploaded! I've updated my list at pchaigno.github.io/academic/202... with the up-to-date info.

pchaigno.github.io

ACM SOSP’26 Papers & Preprints

This post lists the accepted papers at ACM SOSP 2026, along with their preprint version when one was found. An illustration bar plot also shows the distribution of papers across research areas.

010

Paul Chaignon @pchaigno.bsky.social · 03/09/2026

Any day now, the results from the third round of grants are going to be announced, and I'm sure they'll lead to even more top papers 🚀

010

Paul Chaignon @pchaigno.bsky.social · 03/09/2026

The eBPF Foundation's Research Grant program has run for just 3 years, yet it has already been acknowledged in 9 papers it supported: scholar.google.com/scholar?hl=e.... Most of these have been published in the top conferences and workshops of their field!

Photo of some of the eBPF papers acknowledging the eBPF Foundation research grant.

120