Search papers, labs, and topics across Lattice.
This paper introduces Kops, an extension interface that allows userspace compilers and kernel modules to introduce new operations into the eBPF compilation pipeline without altering the kernel core, thereby minimizing the trusted computing base (TCB). By implementing seven new operations, such as rotate and conditional select, Kops enhances the performance of eBPF, achieving speedups of up to 24% in microbenchmarks and 12% in production applications on x86-64 and ARM64 architectures. The approach ensures that safety is maintained through a verifier that checks a proof sequence of vanilla eBPF instructions, allowing for efficient native code execution while preserving kernel integrity.
Kops enables significant performance improvements in eBPF by allowing new operations to be added without compromising kernel safety or increasing the trusted computing base.
eBPF safely extends OS kernels in domains such as networking, observability, and security. The safety comes from an in-kernel compilation pipeline where a verifier checks every program, and a kernel just-in-time compiler (JIT) translates the verified bytecode to native code. The kernel keeps the JIT simple to stay trustworthy, translating one bytecode instruction at a time in a single pass. This single-pass design misses optimization opportunities, so eBPF runs up to twice as slow as natively compiled code in our characterization. Adding optimizations to the kernel JIT directly requires upstream acceptance and a long release cycle, enlarges the trusted computing base (TCB), and grows the per-architecture kernel code. To address this, we present Kops, an extension interface that lets userspace compilers and kernel modules introduce new operations without modifying the kernel core, while keeping a minimal trusted computing base (TCB). Each operation has two forms, a proof sequence of vanilla eBPF instructions that the existing verifier checks and a native emit of machine instructions that the JIT compiles. Because the verifier checks the proof sequence, the native emit is the only per-operation addition to the TCB. Hardware idioms are the lowest-hanging fruit for this interface. With Kops, we build EInsn, seven operations such as rotate and conditional select that CPUs execute as single instructions. Lean 4 proofs show that each native emit computes the same result as its proof sequence. On x86-64 and ARM64, EInsn speeds up eBPF microbenchmarks by up to 24% and production applications by up to 12%. The same interface also supports whole-program native replacement, reaching 2.358x at the cost of a larger TCB.
ETH