Processor vendors constantly introduce new hardware features. Operating systems (OSes) generally enable these features by default, leaving their management to individual applications. This approach, however, can introduce performance overhead or new attack surfaces, a problem termed feature burden . Applications currently lack a fine-grained mechanism to select which hardware features to use. To address this limitation, we introduce the Bespoke Process (bes-proc), a novel operating system abstraction complemented by new hardware extensions for applications with strict performance and security demands. With bes-proc, an application specifies its desired hardware feature set via a processor mask , requiring no modification to the application’s binary. We demonstrate the efficacy of bes-proc by evaluating it on a RISC-V FPGA platform across representative use cases, such as serverless computing, large-memory workloads, and security-sensitive tasks. Our evaluation shows that bes-proc improves performance by a factor of 2.1x to 4.7x.
Safe kernel extensions have gained significant traction, evolving from simple packet filters to large, complex programs that customize storage, networking, and scheduling. Existing kernel extension mechanisms like eBPF rely on in-kernel verifiers to ensure the safety of kernel extensions by static verification using symbolic execution. We identify significant usability issues—safe extensions being rejected by the verifier—due to the language-verifier gap , a mismatch between developers’ expectation of program safety provided by a contract with the programming language, and the verifier’s expectation. We present Rex, a new kernel extension framework that closes the language-verifier gap and improves the usability of kernel extensions in terms of programming experience and maintainability. Rex builds upon language-based safety to provide safety properties desired by kernel extensions, along with a lightweight extralingual runtime for properties that are unsuitable for static analysis, including safe exception handling, stack safety, and termination. With Rex, kernel extensions are written in safe Rust and interact with the kernel via a safe interface provided by Rex’s kernel crate. No separate static verification is needed. Rex addresses usability issues of eBPF kernel extensions without compromising performance.
ASPLOS 2024 received a record of 922 submissions (spread across three review cycles), from which 194 papers were accepted. This record represents an increase of about 50% over 2023, which itself saw a similar increase over 2022. As a result, selecting the best papers proved especially challenging. In this document, we describe the methodology we employed—a process we believe is fair, upholds high standards of quality, and emphasizes consensus and expert judgment. We hope it will be useful for others.
Caches reduce latency and network traffic, and cache performance largely depends on the eviction policy. Eviction effectiveness is typically measured by byte and object miss ratios. Although learning-based eviction policies can reduce misses, their high computational overhead limits practical deployment. This work presents 3L-Cache+, an extended and refined version of 3L-Cache. 3L-Cache+ is an object-level learning-based eviction policy that achieves low computational overhead while delivering strong overall miss-ratio performance. To reduce overhead, we introduce two key techniques. First, we design an efficient training-data collection scheme that filters redundant requests and dynamically adjusts the training frequency. Second, we propose a lightweight eviction method that combines bidirectional sampling, which prioritizes unpopular objects, with an efficient eviction-candidate selection strategy. In addition, an auto-tuning mechanism improves adaptability across traces. We evaluate 3L-Cache+ in a testbed using 4,855 traces. The results show that 3L-Cache+ reduces average CPU overhead by 74.7% and 95.5% compared with HALP and LRB, respectively, and by 22.7% compared with the prior 3L-Cache baseline. 3L-Cache+ incurs only 4.8× LRU overhead under small cache sizes and 3.1× under large cache sizes, while achieving the best byte- or object-miss-ratio performance among 11 state-of-the-art policies.
Coverage-guided kernel fuzzing is an effective technique for ensuring the reliability and security of operating system (OS) kernels. For example, Syzkaller, a widely used and representative coverage-guided kernel fuzzer, has successfully uncovered over 5000 bugs in Linux to date. Specifically, in kernel fuzzing, input minimization is a critical stage for improving fuzzing efficacy by compressing interesting inputs (programs) into shorter and coverage-preserving seeds. If this minimization stage is omitted, the achieved coverage and number of unique bugs found in Syzkaller would decrease by 27.5% and 40.4%, respectively, during a 48-hour fuzzing campaign. However, the minimization stage also takes over half of all fuzzing resources. During the 48-hour fuzzing campaign, 57.5% of program executions are expended in this stage, significantly limiting the potential of kernel fuzzing. To the best of our knowledge, no prior work has explored or mitigated the problem described above in kernel fuzzing. To bridge this gap, this paper introduces two general and novel optimization strategies — influence-guided call removal and type-informed argument simplification — to reduce the cost of the minimization stage. The key idea of these two strategies is to reduce the number of program executions required to verify whether the new coverage achieved by the inputs is preserved. We built SyzMini, a prototype based on Syzkaller that implements our two strategies to optimize input minimization. The evaluation shows that SyzMini significantly reduces the cost of the minimization stage by 60.7%, leading to a 12.5% improvement in branch coverage and a 1.7~2X increase in the number of unique bugs found. In addition, SyzMini has found 13 previously unknown bugs in the latest upstream kernel, all of which have been confirmed, with four already fixed. In terms of applicability, our optimization strategies can also improve the effectiveness of other kernel fuzzers ( e.g. , SyzVegas, SyzDirect, and CountDown). Additionally, based on the insight that calls with indirect influence on the target call have a low probability of actually affecting its execution, we extended the influence-guided call removal strategy by introducing an additional attempt. This attempt preserves only the direct influences to further reduce the cost during call removal. We also integrated the extended strategy into SyzMini, which we refer to as SyzMini + . Our evaluation results demonstrate that SyzMini + achieves a coverage improvement of 14.5% to 16.5% and uncovers 1.9 to 2.3 times as many unique bugs as Syzkaller, further enhancing the effectiveness of SyzMini. We have released the implementations of both SyzMini and SyzMini + as open-source projects, which is available at [1].
