Milo Craun

220 Gilbert Street

Blacksburg, Virginia 24060

I am first-year graduate student at Virginia Tech studying safe kernel extensions, primarily focusing on extending eBPF through new kernel mechanisms. eBPF provides a mechanism to safely extend running kernels, providing a unique way to dynamically change operating system behavior. eBPF has been applied to increase system observability and tracing, as well as to improve networking performance by bypassing the existing kernel networking stack.

I have been an avid Linux user and enthusiast since my older brother installed Arch Linux on my laptop in elementary school. Currently, I am the President of the Linux and Unix Users Group at Virginia Tech. I believe that high quality free and open source software is absolutely essential to the modern tech landscape, and, as an extension, modern society.

Outside of technology, I am an avid musician, and I love spending time outdoors. I enjoy reading books, and going deep on topics that interest me, which is the focus of the blog attached to this page.

news

Jun 18, 2024	Our publication Eliminating eBPF Tracing Overhead on Untraced Processes has been acceped to the second eBPF workshop attached to SIGCOMM.

latest posts

Jun 29, 2024	Beginnings

selected publications

Eliminating eBPF Tracing Overhead on Untraced Processes

Milo Craun, Khizar Hussain, Uddhav Gautam, Zhengjie Ji, Tanuj Rao, and Dan Williams

In Proceedings of the ACM SIGCOMM 2024 Workshop on EBPF and Kernel Extensions , Sydney, NSW, Australia, 2024

Abs PDF

Current eBPF-based kernel extensions affect entire systems, and are coarse-grained. For some use cases, like tracing, operators are more interested in tracing a subset of processes (e.g., belonging to a container) rather than all processes. While overhead from tracing is expected for targeted processes, we find untraced processes—those that are not the target of tracing—also incur performance overhead. To better understand this overhead, we identify and explore three techniques for per-process filtering for eBPF: post-eBPF, in-eBPF, and pre-eBPF filtering, finding that all three approaches result in excessive overhead on untraced processes. Finally, we propose a system that allows for zero-untraced-overhead per-process eBPF tracing by modifying kernel virtual memory mappings to present per-process kernel views, effectively enabling untraced processes to execute on the kernel as if no eBPF programs are attached.
Enabling eBPF on Embedded Systems Through Decoupled Verification

Milo Craun, Adam Oswald, and Dan Williams

In Proceedings of the 1st Workshop on EBPF and Kernel Extensions , New York, NY, USA, 2023

Abs PDF

eBPF (Extended Berkeley Packet Filter) is a Linux kernel subsystem that aims to allow developers to write safe and efficient kernel extensions by employing an in-kernel verifier and just-in-time compiler (JIT). We find that verification is prohibitively expensive for resource-constrained embedded systems. To solve this we describe a system that allows for verification to occur outside of the embedded kernel and before BPF program load time. The in-kernel verifier and JIT are coupled so they must be decoupled together. A designated verifier kernel accepts a BPF program, then verifies, compiles, and signs a native precompiled executable. The executable can then be loaded onto an embedded device without needing the verifier and JIT on the embedded device. Decoupling verification and JIT from load-time opens the door to much more than running BPF programs on embedded devices. It allows larger and more expressive BPF programs to be verified, provides a way for new approaches to verification to be used without extensive kernel modification and creates the possibility for BPF program verification as a service.