Paul Chaignon
LightNews LightNews
pchaigno.bsky.social
Paul Chaignon
@pchaigno.bsky.social
160 followers 30 following 42 posts
System security, eBPF, and programmable networks. Working on Cilium's BPF-based datapath. He/him.
Posts Replies Media Videos
pchaigno.bsky.social
At GNU Tools Cauldron, Eduard Zingerman presented 4 examples of compiler optimizations that can break #eBPF verification in Linux. The discussion then focused on how to mitigate this in GCC, with a potential -fverifiable flag.

Video: www.youtube.com/watch?v=DgiE...
Article: lwn.net/Articles/103...
Slide presenting the first example in which a compiler optimization breaks eBPF verification.
October 24, 2025 at 3:06 PM
pchaigno.bsky.social
At Kernel Recipes, Roman Gushchin presented his work on customizing the Linux out-of-memory handling with #eBPF. It allows you to control when the OOM killer is triggered and how to free memory (typically, what to kill).

Code: lore.kernel.org/bpf/20250818...
Video: www.youtube.com/watch?v=pgDI...
Slide showing a kernel stack trace when using BPF OOM to control what is killed. The blue part is the normal OOM killer being triggered. The green part is the BPF program being called. The yellow part shows the call to the new kfunc to kill a process. And finally, the orange text displays which BPF policy was used for the OOM.
October 15, 2025 at 3:01 PM
pchaigno.bsky.social
The list of talks accepted for the #eBPF track at Linux Plumbers 2025 has been published: lpc.events/event/19/ses...! See you in Tokyo!

(You may need to click on Contribution list to see the talks.)
The Linux Plumbers background picture with giant eBPF bees circling around the Tokyo and Roppongi Hills Mori towers.
October 8, 2025 at 3:31 PM
pchaigno.bsky.social
I've added 6 recent research papers on eBPF to my list, from SIGCOMM'25, SOSP'25, and IEEE S&P'25: pchaigno.github.io/bpf/2025/01/....
Screenshot of the top of the list, showing the interactive selectors and the 6 new papers.
October 6, 2025 at 3:01 PM
pchaigno.bsky.social
At the eBPF workshop, Panayiotis Gavriil introduced uXDP, a new XDP runtime that allows you to run unmodified XDP programs on top of DPDK or AF_XDP. uXDP was able to improve the performance of an unmodified Katran by 40%!

Slides: drive.google.com/file/d/1xrGE...
Paper: dl.acm.org/doi/pdf/10.1...
Slide showing uXDP's architecture with the BPF runtime, including maps, running in userspace on top of either DPDK or AF_XDP.
September 18, 2025 at 4:54 PM
pchaigno.bsky.social
Traditional profiling tools can introduce a lot of overhead when tracing XDP programs. At the eBPF workshop, Vladimiro Paschali presented a new tool that significantly reduces that overhead.

Slides: drive.google.com/file/d/1qsBS...
Paper: dl.acm.org/doi/pdf/10.1...
Code: github.com/VladimiroPas...
Slide showing how profiling tools like perf and bpftool severely impact the performance of the monitored XDP programs.
September 18, 2025 at 4:50 PM
pchaigno.bsky.social
At the eBPF workshop, Srinivas Narayana presented a new approach to synthesize part of the #eBPF verifier. His team used it to improve the addition and subtraction analysis in Linux.

Slides: drive.google.com/file/d/1BbMr...
Paper: people.cs.rutgers.edu/~sn624/paper...
Code: github.com/bpfverif/vayu
Slide from the presentation describing how the verifier uses abstract interpretation to track the values of variables possible at runtime. The slide illustrates how we want the minimal over-approximation to achieve optimal precision.
September 17, 2025 at 3:00 PM
pchaigno.bsky.social
At SIGCOMM'25 yesterday, Alibaba Cloud showed how they improved the performance of their L7 LB in part with sk_reuseport #eBPF programs. As a result, they improved the efficiency of their L7 LB by almost 20%!

Video: www.youtube.com/watch?v=J22-...
Paper: dl.acm.org/doi/pdf/10.1...
Screenshot of the Hermes talk, with the slide showing the overall Hermes architecture and how eBPF is used to efficiently dispatch packets to sockets.
September 10, 2025 at 3:32 PM
pchaigno.bsky.social
The top networking academic conference, SIGCOMM, is happening next week and the 88 papers are already available!
conferences.sigcomm.org/sigcomm/2025...
Screenshot of part of the list of SIGCOMM papers, with authors omitted for brevity.
September 4, 2025 at 2:31 PM
pchaigno.bsky.social
The list of papers accepted at the 3rd #eBPF workshop has been published! conferences.sigcomm.org/sigcomm/2025...
Screenshot of the eBPF workshop program, showing Session 3 ("Time for Better and Safer Programming") and the beginning of Session 4 ("Profiling meets Machine Learning and Privacy").
August 11, 2025 at 3:32 PM
pchaigno.bsky.social
🐝🚀 Deadline Extended 🚀🐝
The submission deadline for the 2025 eBPF workshop at SIGCOMM has been extended!

New deadline: May 23rd.

Don't miss out! Submission link: ebpf25.hotcrp.com
Logo of SIGCOMM 2025 with eBPF bees flying around the letters.
May 6, 2025 at 5:05 PM
pchaigno.bsky.social
With NSDI'25 coming to an end today, I've updated the list of #eBPF papers to include the three papers published at USENIX NSDI this year! pchaigno.github.io/bpf/2025/01/...
Screenshot of the top of the list, showing the interactive selectors and the three eBPF papers published at NSDI'25.
April 30, 2025 at 3:01 PM
pchaigno.bsky.social
Ihor Solodrai started working on a visualization tool to help read #eBPF verifier logs! It shows the current verifier state at any point and tracks data dependencies. Hopefully, it'll make the logs less scary to newcomers!

Code: github.com/libbpf/bpfvv
Example: libbpf.github.io/bpfvv/?url=h...
Screenshot of the example, with the verifier logs showed on the left panel and the current verifier state showed on the right.
April 1, 2025 at 3:00 PM
pchaigno.bsky.social
📢 Call for Papers 📢
The CFP for the 2025 eBPF workshop is out!

📅 Deadline: May 8th
🔗 More info: conferences.sigcomm.org/sigcomm/2025...

Don't miss the chance to share your work with the eBPF 🐝community!
Logo of SIGCOMM 2025 with eBPF bees flying around the letters.
March 24, 2025 at 6:18 PM
pchaigno.bsky.social
The report from this summer's Dagstuhl seminar on Programmable Host Networking has been published: doi.org/10.4230/DagR...! #ebpf #DPDK #DPU
A picture of the Dagstuhl castle, titled "Schloss Dagstuhl - Where Computer Scientists Meet".
February 21, 2025 at 3:31 PM
pchaigno.bsky.social
The list of papers to be presented at Usenix NSDI 2025 has been published: www.usenix.org/conference/n...!
I see at least three papers related to #eBPF, but as usual there are also lots of papers on network verification, queuing, RDMA, machine learning, cellular networks, etc. 🙂
Screenshot of the top of the NSDI'25 schedule page, showing multiple talks on datacenter queuing and routing as well as dataplane programmability for the first day.
February 10, 2025 at 4:02 PM
pchaigno.bsky.social
The results:
- v4 helps decrease program sizes even more than v3 did.
- The impact on the verifier-reported complexity is lower than for v3, but it still has a mixed impact compared to v1 & v2, depending on the BPF programs.

See the blog post for interactive plots and other details. (2/2)
Plot from the blog post, comparing only v3 and v4 for the program sizes for diverse BPF programs from Cilium. The plot shows a slight decrease of all program sizes for v4. Plot from the blog post, showing the verifier-reported complexity for diverse BPF programs from Cilium and for all instruction set extensions. v1 and v2 are close, with v2 generally having lower complexity. v3 and v4 have sometimes lower complexity and sometimes much higher complexity. The results are less drastic with v4.
January 23, 2025 at 4:01 PM
pchaigno.bsky.social
Finally, the cyclomatic complexity has been following the same trend for a long time. The overall average cyclomatic complexity remains low because of the numerous trivial helper functions, while the top 10 most complex functions keep getting more complex.
Plot of the cyclomatic complexity, with both the average for all verifier functions and the average for the 10 most complex functions. The total average is stable and low, whereas the 10 most complex functions keep getting more complex over time.
January 14, 2025 at 4:04 PM
pchaigno.bsky.social
If we compare with the rest of the BPF subsystem (excluding tests, JIT compilers, and tooling), we see the verifier represents about 35% of the codebase. Although it used to be 33% 10 releases ago, it looks like the ratio is fairly stable.
Plot from the blog post, showing the number of lines of code for the BPF verifier and the whole BPF subsystem side-by-side, with a line for the percentage of BPF verifier code in the subsystem. Both sizes keep increasing, while the line for the percentage of verifier code is relatively stable, around 35%.
January 14, 2025 at 4:04 PM
pchaigno.bsky.social
The eBPF verifier keeps growing at a linear pace, now exceeding 28,000 lines of code (with comments).
Plot showing the size of the eBPF verifier, with and without comments. It increases fairly linearly, now reaching 28k LoCs in v6.12.
January 14, 2025 at 4:04 PM
pchaigno.bsky.social
I had missed that Tencent discussed how they use #eBPF since 2022 to perform traffic engineering across their WAN at the granularity of containers.

Recording: www.youtube.com/watch?v=bn6D...
Paper: cs.stanford.edu/~keithw/sigc...
Screenshot of the presentation showing how tc-eBPF enforces a packet path dictated by the control plane using segment routing.
January 6, 2025 at 3:30 PM
pchaigno.bsky.social
The list of papers accepted at EuroSys 2025 has been published! As can be expected, a lot of ML/LLM work, but also several papers on host networking, Linux, and even one on eBPF!
2025.eurosys.org/accepted-pap...
Screenshot of the top of the page with the list of papers, featuring a picture of Rotterdam, where the conference will happen from March 30 to April 3.
December 10, 2024 at 2:09 PM