When I started reading on BPF there weren’t many academic papers to describe how it worked, how it didn’t, or how it is used. There are many blog posts and informal articles out there, but it’s harder to find self-contained papers with references to older, sometimes unsuspected, related works. They have become more frequent though, so I wanted to draw up a list with one-sentence summaries for anyone looking for related works or otherwise interested.

I expect this list to only grow with time. If I want to keep things manageable, I need a way to select papers. Except I’d rather not be the one having to decide which papers are the “best papers”1. So I opted to follow the selection from CSRankings: I will only list papers from conference selected by CSRankings by default2. CSRankings tends to put the bar fairly high, but I think there is at least consensus on the top conferences they selected.

I’ve sorted papers according to their type of contribution and the field or area they focus on. For example, papers improving either the JIT compilers or verifier of eBPF will have improving, jit, and verifier (see those papers).

If you notice any bug in the selectors, missing papers, or other opportunity for improvement, as usual, don’t hesitate to reach out via one of the contacts at the bottom of the page.

Type selector

Areas selector

Hide non-default conferences from CSRankings


Selected 92 papers.

It's the Kernel's Fault! Custom Page Fault Handling With bpf_fault

SOSP'26   Paper  Tal Zussman, Riju Dey, Hasan Zengin, Yiming Fang, David Hildenbrand, Asaf Cidon
using misc 
Extends the Linux kernel to allow users to run custom eBPF-based page fault handlers.

Tamias: Feedback-Guided Systematic Concurrency Exploration for Transparent Distributed System Fuzzing

SOSP'26   Paper  Congyu Liu, Yaoxu Song, Pedro Fonseca, Yongle Zhang
using misc security 
Systematically explores the concurrency space during fuzzing using sched_ext to control the order of execution of threads.

Waiting at the front door: Continuous monitoring of latency in the host network stack

IMC'26   Paper  Simon Sundberg, Anna Brunstrom, Simone Ferlin-Reiter, Jesper Dangaard Brouer, Toke Høiland-Jørgensen
using networking 
Implements a tool to measure the host latency of every packet on the system with very low overhead using the fentry and fexit BPF attach points.

Efficient Build Dependency Verification Using eBPF and Incremental Analysis

ICSE'26   Paper  Yuta Saito, Kazunori Sakamoto, Hironori Washizaki
using security 
Uses BPF-based system call tracing to identify dependencies in build systems.

eMicro: Real-Time Multi-Hop Access Control for Microservices with eBPF

CCS'26   Paper  Rizky Ramadhana, Osama Bajaber, Saimon Amanuel Tsegai, Teryl Taylor, Frederico Araujo, Yuede Ji, Peng Gao
using networking security 
Designs a system to enforce multi-hop network policies encoded as DFAs, with tc and socket BPF programs to propagate DFA states and enforce policies.

Agile QoS-aware Dynamic Power Management with eBPF Governors

ICS'26   Paper  Mohammadreza Rezvani, Daniel Wong
using misc 
Introduces Harware Managed P-States (HWP) policies as eBPF programs, to set the performance preference hints that control the CPU frequency.

Sealing the Window: Efficient Tamper Protection for Provenance Logs

S&P'26   Paper  Sagar Mishra, R. Sekar
using security 
Improves upon eAudit with a message authentication code (MAC) attached to the audit entry and computed using eBPF.

OS-Sanitizer: System-wide Latent Defect Inference in Linux Applications

Sec'26   Paper  Addison Crump, Sahil Sihag, Florian Bauckholt, Keno Hassler, Thorsten Holz
using security misc 
Identifies potential defects in Linux applications via dynamic testing using fprobes, uprobes, and LSM BPF programs.

Concurrency Fuzzing of the Linux Kernel with eBPF

Sec'26   Paper  Jiacheng Xu, Dylan Wolff, Xing Yi Han, Jialin Li, Abhik Roychoudhury
using misc 
Designs a fuzzer to find concurrency bugs in Linux using sched_ext to serialize the execution of kernel threads.

Don't Stall Me Now: Hiding Memory Latency in eBPF

SIGCOMM'26   Paper   Talk  Farbod Shahinfar, Marco Molè, Aurojit Panda, Gianni Antichi
improving networking 
Extends the eBPF runtime and APIs to allow for prefetching and batching in networking BPF programs.

Virtualizing eBPF with Late-Binding

OSDI'26   Paper  Jing Zhang, Xiaguannan Song, Dong Du, Yubin Xia, Binyu Zang, Haibo Chen
improving misc 
Allows BPF hooks to be shared by multiple tenants by adding an indirection layer and dispatching to per-tenant programs.

PeeR: First-Class Scheduling for Latency Critical eBPF Applications

OSDI'26   Paper   Talk  Jeremy Carin, Ben Holmes, Weiyang Wang, Ankit Bhardwaj, Manya Ghobadi
improving misc 
Makes BPF programs schedulable and preemptable using sched_ext and cooperative preemption at helper calls.

BeeQoS: A Cloud-Native QoS System for Adaptive and Scalable Multi-Priority Bandwidth Guarantees

WWW'26   Paper  Jinyao Liu, Si Wu, Haoyuan Ma, Chaoqun Li, Hongjing Yu, Dingyi Jia, Feng Li, Pengfei Hu
using networking 
Implements a QoS system with multi-priority bandwidth guarantees using eBPF for traffic shaping and flow sampling.

Xkernel: Rethinking Performance Tunability of Operating System Kernels

OSDI'26   Paper   Talk  Zhongjie Chen, Wentao Zhang, Yulong Tang, Ran Shu, Fengyuan Renn, Tianyin Xu, Jing Liu
using misc 
Leverages eBPF kprobes to tune arbitrary performance constants in the kernel at runtime.

HybridMesh: A Hardware-software Hybrid Approach for Accelerating Service Mesh Ingress

NSDI'26   Paper   Talk  Myoungsung You, Jaehyun Nam, Minjae Seo, Taejune Park, Seungwon Shin
using networking 
Relies on BPF to handle in-packet metadata and to help improve performance of their service mesh, by redirecting traffic with tc-bpf and sk_msg.

Remote TCP Connection Offload and Applications

NSDI'26   Paper   Talk  Shuo Li, Steven W. D. Chien, Tianyi Gao, Michio Honda
using networking 
Relies on tc-bpf to implement flow steering while the tc-flower hardware offload is configured.

KRAKENGUARD: Towards Fine-Grained eBPF Isolation

NSDI'26   Paper   Talk  Jainil Patel, Lucas Graeff Buhl-Nielsen, Adrien Ghosn, Marios Kogias
improving security 
Implements a userspace policy enforcement engine for BPF programs that handles cross-program interactions.

Tux: Efficient Drop-in Networking for Database Systems

VLDB'26   Paper  Xinjing Zhou, Viktor Leis, Xiangyao Yu, Michael Stonebraker
using networking misc 
Leverages AF_XDP to build a high-performance networking stack for database systems.

ONCache: A Cache-Based Low-Overhead Container Overlay Network

NSDI'25   Paper   Talk  Shengkai Lin, Shizhen Zhao, Peirui Cao, Xinchi Han, Quan Tian, Wenfeng Liu, Qi Wu, Donghai Han, Xinbing Wang
using networking 
Leverages tc-bpf programs to accelerate the routing, encapsulation and decapsulation, and redirection of packets in a container overlay, independently of the usual network plugins.

EDDE: Container Deployment Framework Beyond the Cloud

SC'25   Paper  Hao Fan, Zhuo Huang, Shadi Ibrahim, Lin Gu, Song Wu
using misc 
Optimizes FUSE in the context of container images using preloaded eBPF maps to cache the pull indexes and image data.

Copper and Wire: Bridging Expressiveness and Performance for Service Mesh Policies

ASPLOS'25   Paper   Talk  Divyanshu Saxena, William Zhang, Shankara Pailoor, Isil Dillig, Aditya Akella
using networking 
Traces related gRPC requests and response across applications by parsing an HTTP/2 tracing ID using cgroup-bpf programs.

BPF-DB: A Kernel-Embedded Transactional Database Management System For eBPF Applications

SIGMOD'25   Paper  Matthew Butrovich, Samuel Arch, Wan Shen Lim, William Zhang, Jignesh M. Patel, Andrew Pavlo
using misc storage 
Introduces an in-kernel database management system (DBMS) in eBPF, with ACID properties.

Approximation Enforced Execution of Untrusted Linux Kernel Extensions

Sec'25   Paper  Hao Sun, Zhendong Su
improving verifier 
Relies on state approximations from the Linux verifier to enforce runtime checks on BPF programs.

Deprivileging Low-Level GPU Drivers Efficiently with User-Space Processes and CHERI Compartments

CCS'25   Paper  Paul Metzger, A. Theodore Markettos, Edward Tomasz Napierała, Matthew Naylor, Robert N. M. Watson, Timothy M. Jones
using security misc 
Implements in-kernel interrupt handlers on a uBPF VM, for userspace GPU drivers.

Rethinking Tamper-Evident Logging: A High-Performance, Co-Designed Auditing System

CCS'25   Paper  Rui Zhao, Muhammad Shoaib, Viet Tung Hoang, Wajih Ul Hassan
using security 
Designs a tamper-evident auditing system all in eBPF, including the authentication code computation

Intent-aware Fuzzing for Android Hardened Application

CCS'25   Paper  Seongyun Jeong, Minseong Choi, Haehyun Cho, Seokwoo Choi, Hyungsub Kim, Yuseok Jeon
using security tracing misc 
While fuzzing Android applications, relies on eBPF to trigger scheduled application behaviors and collect coverage.

Aeolia: A Fast and Secure Userspace Interrupt-Based Storage Stack

SOSP'25   Paper  Chuandong Li, Ran Yi, Zonghao Zhang, Jing Liu, Changwoo Min, Jie Zhang, Yingwei Luo, Xiaolin Wang, Zhenlin Wang, Diyu Zhou
using storage misc 
Leverages sched_ext to bridge the scheduling semantic gap between userspace and the kernel when using user interrupts.

Prove It to the Kernel: Precise Extension Analysis via Proof-Guided Abstraction Refinement

SOSP'25   Paper  Hao Sun, Zhendong Su
improving verifier 
Improves the Linux verifier's precision by refining the abstract state in userspace when needed, and producing a formal proof for it.

Training Solo: On the Limitations of Domain Isolation Against Spectre-v2 Attacks

S&P'25   Paper  Sander Wiebing, Cristiano Giuffrida
analysis security 
Leverages cBPF to implement a cross-domain Spectre-v2 transient execution attack.

SoK: Challenges and Paths Toward Memory Safety for eBPF

S&P'25   Paper  Kaiming Huang, Jack Sampson, Mathias Payer, Gang Tan, Zhiyun Qian, Trent Jaeger
analysis security verifier 
Surveys and evaluates existing work on eBPF memory safety.

SwiftSweeper: Defeating Use-After-Free Bugs Using Memory Sweeper Without Stop-the-World

S&P'25   Paper   Talk  Junho Ahn, Kanghyuk Lee, Chanyoung Park, Hyungon Moon, Youngjin Kwon
using misc security 
Designs a memory-sweeping allocator to prevent use-after-free bugs, with a BPF-based custom page fault handler to improve performance.

eBPF Misbehavior Detection: Fuzzing with a Specification-Based Oracle

SOSP'25   Paper  Tao Lyu, Kumar Kartikeya Dwivedi, Thomas Bourgeat, Mathias Payer, Meng Xu, Sanidhya Kashyap
improving verifier 
Introduces a specification-based oracle to fuzz the BPF verifier.

FlexGuard: Fast Mutual Exclusion Independent of Subscription

SOSP'25   Paper  Victor Laforet, Sanidhya Kashyap, Călin Iorgulescu, Julia Lawall, Jean-Pierre Lozi
using misc 
Improves lock handover time by using eBPF to detect critical section preemptions.

cache_ext: Customizing the Page Cache with eBPF

SOSP'25   Paper  Tal Zussman, Ioannis Zarkadas, Jeremy Carin, Andrew Cheng, Hubertus Franke, Asaf Cidon
using misc 
Extends the kernel with new BPF hooks, kfuncs, and per-cgroup struct_ops to be able to customize the page cache policies.

Hermes: Enhancing Layer-7 Cloud Load Balancers with Userspace-Directed I/O Event Notification

SIGCOMM'25   Paper   Talk  Tian Pan, Enge Song, Yueshang Zuo, Shaokai Zhang, Yang Song, Jiangu Zhao, Wengang Hou, Jianyuan Lu, Xiaoqing Sun, Shize Zhang, Ye Yang, Jiao Zhang, Tao Huang, Biao Lyu, Xing Li, Rong Wen, Zhigang Zong, Shunmin Zhu
using networking 
Improves the performance of their L7 load balancer by customizing the kernel's connection dispatch using sk_reuseport BPF programs.

Extending Applications Safely and Efficiently

OSDI'25   Paper   Talk  Yusheng Zheng, Tong Yu, Yiwei Yang, Yanpeng Hu, Xiaozheng Lai, Dan Williams, Andi Quinn
using tracing misc 
Proposes to implement safe userspace extension mechanisms and observability tools using the bpftime userspace eBPF VM for better efficiency.

VEP: A Two-stage Verification Toolchain for Full eBPF Programmability

NSDI'25   Paper   Talk  Xiwei Wu, Yueyang Feng, Tianyi Huang, Xiaoyang Lu, Shengkai Lin, Lihan Xie, Shizhen Zhao, Qinxiang Cao
improving verifier 
Implements a proof-carrying code process for the verification of eBPF using annotations on the C source code.

eTran: Extensible Kernel Transport with eBPF

NSDI'25   Paper   Talk  Zhongjie Chen, Qingkai Meng, ChonLam Lao, Yifan Liu, Fengyuan Ren, Minlan Yu, Yang Zhou
using networking 
Designs a framework based on AF_XDP and new networking hooks to allow users to implement custom transport protocols on top of Linux.

State-Compute Replication: Parallelizing High-Speed Stateful Packet Processing

NSDI'25   Paper   Talk  Qiongwen Xu, Sebastiano Miano, Xiangyu Gao, Tao Wang, Adithya Murugadass, Songyuan Zhang, Anirudh Sivaraman, Gianni Antichi, Srinivas Narayana
using networking 
Proposes a method to scale the processing of single-flow traffic on multiple cores using XDP.

Measuring Network Latency from a Wireless ISP: Variations Within and Across Subnets

IMC'24   Paper  Simon Sundberg, Anna Brunstrom, Simone Ferlin-Reiter, Toke Høiland-Jørgensen, Robert Chacón
using networking 
Implements a latency measurement system for TCP in ISP networks, using tcp-ebpf to compute and aggregate measurements in the kernel.

P4Control: Line-Rate Cross-Host Attack Prevention via In-Network Information Flow Control Enabled by Programmable Switches and eBPF

S&P'24   Paper   Talk  Osama Bajaber, Bo Ji, Peng Gao
using networking security 
Designs a network defense system that tracks lateral movement across hosts and processes using P4 and eBPF hooks.

BUDAlloc: Defeating Use-After-Free Bugs by Decoupling Virtual Address Management from Kernel

Sec'24   Paper   Talk  Junho Ahn, Jaehyeon Lee, Kanghyuk Lee, Wooseok Gwak, Minseong Hwang, Youngjin Kwon
using misc security 
Designs a one-time allocator to detect use-after-free bugs, with a BPF-based custom page fault handler to improve performance.

BeeBox: Hardening BPF Against Transient Execution Attacks

Sec'24   Paper   Talk  Di Jin, Alexander J. Gaidis, Vasileios P. Kemerlis
improving verifier security 
Combines the verifier's static analysis with SFI-like runtime checks and memory copies to mitigate transient execution attacks.

eAudit: A Fast, Scalable and Deployable Audit Data Collection System

S&P'24   Paper   Talk  R. Sekar, Hanke Kimm, Rohit Aich
using security 
Implements a faster auditing system using eBPF at tracepoints.

Toss a Fault to BpfChecker: Revealing Implementation Flaws for eBPF runtimes with Differential Fuzzing

CCS'24   Paper  Chaoyuan Peng, Muhui Jiang, Lei Wu, Yajin Zhou
improving verifier jit 
Designs a fuzzer for userspace eBPF runtimes, including Windows's, using differential fuzzing, verifier logs, and an intermediate representation of the eBPF bytecode.

NetEdit: An Orchestration Platform for eBPF Network Functions at Scale

SIGCOMM'24   Paper   Talk  Theophilus A. Benson, Prashanth Kannan, Prankur Gupta, Balasubramanian Madhavan, Kumar Saurabh Arora, Jie Meng, Martin Lau, Abhishek Dhamija, Rajiv Krishnamurthy, Srikanth Sundaresan, Neil Spring, Ying Zhang
using networking 
Describes an orchestration system for eBPF programs designed to tune the network stack of Meta's services.

Merlin: Multi-tier Optimization of eBPF Code for Performance and Compactness

ASPLOS'24   Paper   Talk  Jinsong Mao, Hailun Ding, Juan Zhai, Shiqing Ma
improving misc 
Proposes new compiler optimization tailored to the eBPF bytecode.

DINT: Fast In-Kernel Distributed Transactions with eBPF

NSDI'24   Paper   Talk  Yang Zhou, Xingyu Xiang, Matthew Kiley, Sowmya Dharanipragada, Minlan Yu
using networking offload 
Designs a new distributed transaction system that offloads common operations to tc and XDP.

BlueSWAT: A Lightweight State-Aware Security Framework for Bluetooth Low Energy

CCS'24   Paper  Xijia Che, Yi He, Xuewei Feng, Kun Sun, Ke Xu, Qi Li
using security misc 
Proposes to use a userspace eBPF VM to facilitate the distribution of security patches to Bluetooth Low Energy (BLE) devices, to mitigate session-based attacks.

SeaK: Rethinking the Design of a Secure Allocator for OS Kernel

Sec'24   Paper   Talk  Zicheng Wang, Yicheng Guang, Yueqi Chen, Zhenpeng Lin, Michael Le, Dang K Le, Dan Williams, Xinyu Xing, Zhongshu Gu, Hani Jamjoom
using security misc 
Builds a secure allocator for the kernel, to separate security-sensitive objects, using new BPF helpers.

Rethinking Process Management for Interactive Mobile Systems

MobiCom'24   Paper  Jianwei Zheng, Zhenhua Li, Feng Qian, Wei Liu, Hao Lin, Yunhao Liu, Tianyin Xu, Nan Zhang, Ju Wang, Cang Zhang
using misc 
Leverages eBPF to measure the usage of hardware resources by Android applications and investigate slow UI responsiveness problems.

MegaTE: Extending WAN Traffic Engineering to Millions of Endpoints in Virtualized Cloud

SIGCOMM'24   Paper   Talk  Congcong Miao, Zhizhen Zhong, Yunming Xiao, Feng Yang, Senkuo Zhang, Yinan Jiang, Zizhuo Bai, Chaodong Lu, Jingyi Geng, Zekun He, Yachen Wang, Xianneng Zou, Chuanchuan Yang
using networking 
Relies on eBPF to identify traffic sources and enforce traffic engineering via segment routing across the WAN.

Validating the eBPF Verifier via State Embedding

OSDI'24   Paper   Talk  Hao Sun, Zhendong Su
improving verifier 
Devises a sanitizer-free test oracle to fuzz the eBPF verifier by embedding correctness checks in the BPF program.

Hive: A Hardware-assisted Isolated Execution Environment for eBPF on AArch64

Sec'24   Paper   Talk  Peihua Zhang, Chenggang Wu, Xiangyu Meng, Yinqian Zhang, Mingfan Peng, Shiyang Zhang, Bing Hu, Mengyao Xie, Yuanming Lai, Yan Kang, Zhe Wang
improving verifier security 
Proposes to replace the static analysis of the verifier with a hardware-based runtime isolation for ARM64.

End-to-End Mechanized Proof of a JIT-Accelerated eBPF Virtual Machine for IoT

CAV'24   Paper  Shenghao Yuan, Frédéric Besson, Jean-Pierre Talpin
improving jit 
Correctness proof for the eBPF JIT compiler used in the micro-controller RIOT kernel.

Fast, Flexible, and Practical Kernel Extensions

SOSP'24   Paper  Kumar Kartikeya Dwivedi, Rishabh Iyer, Sanidhya Kashyap
improving verifier 
Extends the Linux verifier with limited runtime checks and in a backward compatible way, significantly improving eBPF's expressibility.

MOAT: Towards Safe BPF Kernel Extension

Sec'24   Paper   Talk  Hongyi Lu, Shuai Wang, Yechang Wu, Wanning He, Fengwei Zhang
improving verifier security 
Hardens eBPF in Linux by leveraging Intel MPK and adding runtime checks for helpers.

Cross Container Attacks: The Bewildered eBPF on Clouds

Sec'23   Paper   Talk  Yi He, Roland Guo, Yunlong Xing, Xijia Che, Kun Sun, Zhuotao Liu, Ke Xu, Qi Li
analysis security 
Highlights that eBPF tracing programs can be used to escape container boundaries and the impact on cloud and online coding platforms.

λ-IO: A Unified IO Stack for Computational Storage

FAST'23   Paper   Talk  Zhe Yang, Youyou Lu, Xiaojian Liao, Youmin Chen, Junru Li, Siyu He, Jiwu Shu
using storage 
Modifies eBPF to implement a unified IO stack spanning the kernel and storage devices, in the context of in-storage computing.

eHDL: Turning eBPF/XDP Programs into Hardware Designs for the NIC

ASPLOS'23   Paper   Talk  Alessandro Rivitti, Roberto Bifulco, Angelo Tulumello, Marco Bonola, Salvatore Pontarelli
using networking 
Introduces a synthesis tool that generates FPGA pipelines for NICs from unmodified XDP programs.

Fuzz on the Beach: Fuzzing Solana Smart Contracts

CCS'23   Paper  Sven Smolka, Jens-Rene Giesen, Pascal Winkler, Oussama Draissi, Lucas Davi, Ghassan Karame, Klaus Pohl
improving security misc 
Fuzzes Solana smart contracts, including those compiled to eBPF bytecode, by extending Solana's userspace eBPF VM with six bug oracles and coverage feedback.

xBGP: Faster Innovation in Routing Protocols

NSDI'23   Paper   Talk  Thomas Wirtgen, Tom Rousseaux, Quentin De Coninck, Nicolas Rybowski, Randy Bush, Laurent Vanbever, Axel Legay, Olivier Bonaventure
using networking 
Designs an extension mechanism for BGP using a userspace implementation of eBPF and several C verification tools to replace and extend the Linux verifier.

Taking 5G RAN Analytics and Control to a New Level

MobiCom'23   Paper  Xenofon Foukas, Bozidar Radunovic, Matthew Balkwill, Zhihua Lai
using networking 
Proposes to extend virtualized Radio Access Network (vRAN) functions using a userspace BPF implementation and the PREVAIL verifier, with a new runtime check to bound the execution time.

Network-Centric Distributed Tracing with DeepFlow: Troubleshooting Your Microservices in Zero Code

SIGCOMM'23   Paper   Talk  Junxian Shen, Han Zhang, Yang Xiang, Xingang Shi, Xinrui Li, Yunxi Shen, Zijian Zhang, Yongxiang Wu, Xia Yin, Jilong Wang, Mingwei Xu, Yahui Li, Jiping Yin, Jianchang Song, Zhuofeng Li, Runjie Nie
using tracing 
Presents a distributed tracing framework for troubleshooting microservices that leverages eBPF for data collection.

Tigger: A Database Proxy That Bounces with User-Bypass

VLDB'23   Paper  Matthew Butrovich, Karthik Ramanathan, John Rollinson, Wan Shen Lim, William Zhang, Justine Sherry, Andrew Pavlo
using networking offload 
Offloads PostgreSQL connection pooling and mirroring to the kernel using sockmap BPF programs.

Electrode: Accelerating Distributed Protocols with eBPF

NSDI'23   Paper   Talk  Yang Zhou, Zezhou Wang, Sowmya Dharanipragada, Minlan Yu
using networking offload 
Offloads common Paxos networking operations to tc and XDP to improve performance.

Verifying the Verifier: eBPF Range Analysis Verification

CAV'23   Paper  Harishankar Vishwanathan, Matan Shachnai, Srinivas Narayana, Santosh Nagarakatte
improving verifier 
Automatically and formally proves the ranges analysis of the Linux verifier.

Sifter: Protecting Security-Critical Kernel Modules in Android through Attack Surface Reduction

MobiCom'22   Paper  Hsin-Wei Hung, Yingtong Liu, Ardalan Amiri Sani
using security 
Hardens security-critical kernel modules on Android by filtering syscall patterns using eBPF tracepoints and seccomp-ebpf, an extension of seccomp.

Tastes Great! Less Filling! High Performance and Accurate Training Data Collection for Self-Driving Database Management Systems

SIGMOD'22   Paper  Matthew Butrovich, Wan Shen Lim, Lin Ma, John Rollinson, William Zhang, Yu Xia, Andrew Pavlo
using tracing misc 
Implements a BPF-based data collection framework for database management systems (DBMSes).

Domain Specific Run Time Optimization for Software Data Planes

ASPLOS'22   Paper   Talk  Sebastiano Miano, Alireza Sanaee, Fulvio Risso, Gábor Rétvári, Gianni Antichi
improving networking 
Optimizes datapath binaries, including eBPF bytecodes, based on traffic patterns.

End-to-end Mechanized Proof of an eBPF Virtual Machine for Micro-controllers

CAV'22   Paper  Shenghao Yuan, Frédéric Besson, Jean-Pierre Talpin, Samuel Hym, Koen Zandberg, Emmanuel Baccelli
improving verifier 
Correctness proof for the eBPF interpreter and verifier used in the micro-controller RIOT kernel.

Application-Informed Kernel Synchronization Primitives

OSDI'22   Paper   Talk  Sujin Park, Diyu Zhou, Yuchen Qian, Irina Calciu, Taesoo Kim, Sanidhya Kashyap
using misc 
Allows Linux users to customize kernel lock policies using eBPF and according to the applications' needs and hardware characteristics.

RapidPatch: Firmware Hotpatching for Real-Time Embedded Devices

Sec'22   Paper   Talk  Yi He, Zhenhua Zou, Kun Sun, Zhuotao Liu, Ke Xu, Qian Wang, Chao Shen, Zhi Wang, Qi Li
using misc 
Implements a hotpatching mechanism for real-time OSes using eBPF, a modified verifier, and additional runtime checks.

SPRIGHT: Extracting the Server from Serverless Computing! High-Performance eBPF-Based Event-Driven, Shared-Memory Processing

SIGCOMM'22   Paper   Talk  Shixiong Qi, Leslie Monis, Ziteng Zeng, Ian-chin Wang, K. K. Ramakrishnan
using networking 
Leverages various eBPF hooks to improve the performance of Knative, a container-based serverless platform.

XRP: In-Kernel Storage Functions with eBPF

OSDI'22   Paper   Talk  Yuhong Zhong, Haoyu Li, Yu Jian Wu, Ioannis Zarkadas, Jeffrey Tao, Evan Mesterhazy, Michael Makris, Junfeng Yang, Amy Tai, Ryan Stutsman, Asaf Cidon
using storage offload 
Offloads processing to the NVMe drivers using BPF, to reduce kernel overhead in storage applications

Synthesizing Safe and Efficient Kernel Extensions for Packet Processing

SIGCOMM'21   Paper   Talk  Qiongwen Xu, Michael D. Wong, Tanvi Wagle, Srinivas Narayana, Anirudh Sivaraman
improving networking misc 
Proposes a synthesis-based compiler that optimizes eBPF programs while ensuring they still pass the Linux verifier.

The Ties that un-Bind: Decoupling IP from web services and sockets for robust addressing agility at CDN-scale

SIGCOMM'21   Paper   Talk  Marwan Fayed, Lorenz Bauer, Vasileios Giotsas, Sami Kerola, Marek Majkowski, Pavel Odinstov, Jakub Sitnicki, Taejoong Chung, Dave Levin, Alan Mislove, Christopher A. Wood, Nick Sullivan
using networking 
Contributes sk_lookup to Linux, to make the IP/port to socket binding programmable using eBPF.

BMC: Accelerating Memcached using Safe In-Kernel Caching and Pre-Stack Processing

NSDI'21   Paper   Talk   Summary Yohann Ghigoff, Julien Sopena, Kahina Lazri, Antoine Blin, Gilles Muller
using networking offload 
Speeds up Memcached with an XDP-based, transparent, first-level cache.

An Analysis of Speculative Type Confusion Vulnerabilities in the Wild

Sec'21   Paper   Talk  Ofek Kirzner, Adam Morrison
analysis security 
Describes how eBPF can be leveraged to create speculative type confusion gadgets in the kernel.

Syrup: User-Defined Scheduling Across the Stack

SOSP'21   Paper   Talk  Kostis Kaffes, Jack Tigar Humphries, David Mazières, Christos Kozyrakis
using networking 
Proposes an eBPF-based framework to enable users to write application-specific scheduling policies for threads, network packets, and network connections.

Revisiting the Open vSwitch Dataplane Ten Years Later

SIGCOMM'21   Paper   Talk  William Tu, Yi-Hung Wei, Gianni Antichi, Ben Pfaff
using networking 
Describes how production experience with Open vSwitch over a decade led to the development of its new AF_XDP-based datapath.

Synthesizing JIT Compilers for In-Kernel DSLs

CAV'20   Paper  Jacob Van Geffen, Luke Nelson, Isil Dillig, Xi Wang, Emina Torlak
improving jit 
Synthesizes eBPF and cBPF JIT compilers, which are proven to be formally correct, from DSL interpreters.

hXDP: Efficient Software Packet Processing on FPGA NICs

OSDI'20   Paper   Talk   Summary Marco Spaziani Brunella, Giacomo Belocchi, Marco Bonola, Salvatore Pontarelli, Giuseppe Siracusano, Giuseppe Bianchi, Aniello Cammarano, Alessandro Palumbo, Luca Petrucci, Roberto Bifulco
using networking 
Investigates the execution of XDP programs on FPGA NICs by implementing an interpreter.

Specification and Verification in the Field: Applying Formal Methods to BPF Just-in-Time Compilers in the Linux Kernel

OSDI'20   Paper   Talk  Luke Nelson, Jacob Van Geffen, Emina Torlak, Xi Wang
improving jit 
Applies formal verification techniques to the eBPF JIT compilers and implements a new formally-verified JIT compiler for 32-bit RISC-V.

LBM: A Security Framework for Peripherals within the Linux Kernel

S&P'19   Paper   Talk  Dave Tian, Grant Hernandez, Joseph I. Choi, Vanessa Frost, Peter C. Johnson, Kevin R. B. Butler
using security misc 
Compiles filtering rules for peripherals subsystems in Linux (USB, Bluetooth, NFC) into eBPF programs.

Scaling Symbolic Evaluation for Automated Verification of Systems Code with Serval

SOSP'19   Paper   Talk  Luke Nelson, James Bornholt, Ronghui Gu, Andrew Baumann, Emina Torlak, Xi Wang
improving verifier 
Proposes a framework to developing verifiers for system software, including eBPF, by lifting existing interpreters under symbolic execution.

Pluginizing QUIC

SIGCOMM'19   Paper   Talk  Quentin De Coninck, François Michel, Maxime Piraux, Florentin Rochet, Thomas Given-Wilson, Axel Legay, Olivier Pereira, Olivier Bonaventure
using networking 
Designs an extension mechanism for QUIC using a userspace implementation of eBPF with SFI-like runtime checks.

Simple and Precise Static Analysis of Untrusted Linux Kernel Extensions

PLDI'19   Paper   Talk   Summary Elazar Gershuni, Nadav Amit, Arie Gurfinkel, Nina Narodytska, Jorge A. Navas, Noam Rinetzky, Leonid Ryzhyk, Mooly Sagiv
improving verifier 
Introduces PREVAIL, an alternative to the Linux eBPF verifier based on abstract interpretation and now used in Windows.

Jitk: A Trustworthy In-Kernel Interpreter Infrastructure

OSDI'14   Paper   Talk  Xi Wang, David Lazar, Nickolai Zeldovich, Adam Chlipala, Zachary Tatlock
improving jit 
Proposes a formally-verified infrastructure to compile high-level rules into cBPF bytecode and machine code.

Swift: A Fast Dynamic Packet Filter

NSDI'08   Paper  Zhenyu Wu, Mengjun Xie, Haining Wang
improving networking 
Proposes an alternative to cBPF for packet filtering, with a CISC ISA and support for SIMD.

Safe Kernel Extensions Without Run-Time Checking

OSDI'96   Paper  George C. Necula, Peter Lee
improving verifier 
Proposes kernel extensions in the form of proof-carrying code and compares it to cBPF.

The BSD Packet Filter: A New Architecture for User-level Packet Capture

USENIX Winter'93   Paper  Steven McCanne, Van Jacobson
foundation networking 
The original cBPF paper, describing a register-based packet filter for BSD.



Thanks to Kahina for her reviews and for reporting multiple bugs with the early version of the selectors.


  1. Of course, I can’t really escape chosing a method to select papers, so it’s not as if this is completely objective either. ↩

  2. To see papers from all conferences listed by CSRankings, including those not selected by default, you can uncheck the last toggle below. ↩