BPF Access Control and CO-RE in Android

Explore the challenges and potential solutions for implementing BPF Access Control and Compile Once Run Everywhere (CO-RE) support in Android. Delve into the current limitations of BPF usage in the Android ecosystem, including the restricted access to kernel data structures and the confinement of SOC vendors and OEM partners to BPF socket filters. Examine the complexities involved in developing CO-RE support for Android, considering the diverse ecosystem and the need for careful implementation. Discuss the requests from vendors for expanded access to kprobes and tracepoints, and analyze the implications of extending the kernel ABI. Investigate potential approaches to limit access to BPF attach points while ensuring program compatibility across various Android and kernel versions.

BPF Access Control and CO-RE in Android - Neill Kapron