https://arxiv.org/api/sLr/WvkMOjqGdSIwNFqaC8AnJm8 2026-09-10T22:25:13Z 1464 90 15 http://arxiv.org/abs/2504.20412v3 2026-07-06T02:42:28Z

Fuzzing frameworks like syzkaller have uncovered thousands of Linux kernel crashes, many of which are critical and security-sensitive. However, the ability to rapidly repair these crashes has not kept pace, particularly given the complexity and low-level nature of kernel code. Predominantly targeting user-space applications, existing LLM-based program repair techniques are not tailored to the unique challenges posed by kernel fuzz bugs-such as the absence of natural language bug reports, lack of exhaustive test oracles, and highly specialized crash artifacts. Thus, in this work, we first identify the prevalent bottlenecks that generic agents struggle with in complex systems such as the Linux kernel. Guided by these findings, we then build kAgent, a workflow-based agent inspired by how kernel developers diagnose and fix bugs, and kGym++, the co-designed toolstack supporting kAgent's requests. kAgent inspects relevant execution logs, generates execution-grounded natural language hypotheses, synthesizes candidate patches, validates patches through crash reproduction, and iteratively refines its reasoning. We ablate these agentic system features in kAgent and quantitatively analyze their contributions to the overall performance. We also report our experience on building agents for kernel crash repair. Although derived from this work on Linux, we note that our experience applies broadly to fuzzing-discovered bugs in complex systems software. We evaluate kAgent on kBenchSyz and show that it can repair up to 54.5% of crashes without localization and 65% with correct file hints. We also show kAgent's generalization on a few wild Syzkaller bugs, and how different patch types offer varying utility to developers who debug complex system software.

2025-04-29T04:18:51Z Accepted to ICML, 2026; in the Deep Learning for Code Workshop. This paper was previously circulated as "CrashFixer" Alex Mathai Chenxi Huang Suwei Ma Jihwan Kim Hailie Mitchell Aleksandr Nogikh Petros Maniatis Franjo Ivančić Junfeng Yang Baishakhi Ray http://arxiv.org/abs/2607.02969v1 2026-07-03T05:23:32Z

Cloud data centers rely on virtualization technologies to serve AI workloads in multi-tenant environments. With the growing scale of data-intensive AI workloads, the performance of storage I/O paths at the virtualization layer has become a critical factor. A single user request often crosses multiple IP blocks, where functional units such as storage, GPU, and accelerator devices under virtualization fan out into separate stack traversals between the guest and the backend. As a result, round-trip and context-switching overheads accumulate with the number of devices. In this letter, we identify that a dominant factor in this overhead lies not in the kernel-mediated I/O path alone, but in the per-device submission structure itself, which persists even in user-space, kernel-bypass storage frameworks such as SPDK. To address this, we propose cross-IP request coalescing, which relocates the fan-out point from the guest to the SPDK vhost-user backend. The guest submits multi-device I/O as a single compound request, and the accelerated bdev at the backend decomposes and dispatches it to each target device, replacing multiple per-device guest-backend round trips with a single submission. Evaluation in an SPDK-based virtualized environment shows that the proposed approach achieves up to 1.78x lower latency than the per-device baseline, with the benefit growing as concurrency increases.

2026-07-03T05:23:32Z Submitted to IEEE Computer Architecture Letters Kiseok Kim Hyeontae Joo Hwangnam Kim http://arxiv.org/abs/2607.02748v1 2026-07-02T20:33:32Z

eBPF lets developers run custom programs inside the Linux kernel, where a verifier proves each program safe. However, when the verifier rejects a program, the unclear error makes repair challenging: the error reports where verification stopped, not where the program lost the proof the verifier required. To quantify this gap, we conduct an empirical study of 235 reproduced rejections, showing that 47% of rejections return only EINVAL, one error string maps to as many as nine distinct root causes, and 10 of the 12 root causes are eBPF-specific. Repair thus requires both domain knowledge and locating where the proof was lost, yet existing tools only help developers read the error. We present bpfix, which reconstructs where the required proof was established and where it was lost from the verifier log, and prints a Rust-like diagnostic. To evaluate bpfix and the ability of LLMs to help repair, we construct a benchmark of 75 LLM repair tasks. Current models achieve 0-37% one-shot success with the raw log, and replacing the log with the bpfix localization improves repair by 11-21pp, suggesting that locating where the proof was lost is key to guiding repair. bpfix is available at https://github.com/eunomia-bpf/bpfix

2026-07-02T20:33:32Z Yusheng Zheng, Zhengjie Ji, Weichen Tao have equal contribution to the paper Yusheng Zheng Zhengjie Ji Weichen Tao Xiangyu Gao Jianchang Su Wei Zhang Andi Quinn Dan Williams http://arxiv.org/abs/2608.14601v1 2026-07-02T13:46:31Z

Transparent fault tolerance -- making an unmodified server binary survive crashes -- has been pursued for four decades without reaching production. Every attempt paid three costs on the critical path: recording message arrival order for replay, coordinating a consistent snapshot, and holding each reply until the state that produced it was durable. This paper argues the costs are not intrinsic: they are the price of a network that guarantees neither order nor delivery. We state four conditions under which all three vanish. Three concern the network: Order (messages are delivered in one global sequence), Barrier (delivery is confirmed by a commit barrier), and Durability (each message is replicated to backups before its barrier completes). The fourth, Determinism, falls to the host: a user-space shim closes it for unmodified binaries at 2-10% overhead -- virtual time, virtualized randomness, and share-nothing sharding in place of thread scheduling. OneBarrier realizes all four conditions over an in-network total-order fabric (1Pipe) with microsecond round trips. Fifteen unmodified applications -- including Redis, Memcached, Nginx, Node.js, and a multi-process PostgreSQL -- recover byte-identically, and crash injection confirms linearizable, exactly-once histories; the core protocols are machine-checked in TLA+. A durable write placed inside the barrier adds 4.6 microseconds to a request; the same write placed after it adds three milliseconds. On a network that meets the conditions, fault tolerance is a property, not a tax.

2026-07-02T13:46:31Z Bojie Li http://arxiv.org/abs/2607.02630v1 2026-07-02T13:39:17Z

Hardware accelerators now sit on the critical path of online serving. GPUs, FPGAs, and increasingly remote services such as hardware security modules, post-quantum KEMs, and inference servers. For fine-grained offloads (microseconds to a few milliseconds) the classic responses to the resulting stall both fail: a context switch costs as much as the offload, and a busy-wait burns the core. Overlapping the offload with other requests is the fix, and prior systems obtain it by adding concurrency: an async-framework rewrite, a new runtime or dataplane OS, or a hand-tuned point integration. We observe that the concurrency already exists: serving concurrent requests is suspending and resuming them, so every server ships the machinery overlap needs. Overlap is then a routing problem, not a rewrite problem: submit the offload to an executor, suspend the request with the server's own deferred-response primitive, resume it on completion. Across ten off-the-shelf servers spanning every production concurrency model, this recipe takes 22-138 lines added, at most one modified, and recovers 1.2-5.4x on real hardware; the server's concurrency model and the offload's weight predict both numbers in advance, and the win is bounded by device throughput and the server's own overlap capacity. At the limit, an LD_PRELOAD fiber runtime injects the reroute into an unmodified thread-per-connection binary (17.3x) within a characterized envelope. Rerouting suspends run-to-completion atomicity; a measured taxonomy confines the hazard to unlocked shared aggregates, and a transparent page-protection detector guards exactly those, validated on stock Redis.

2026-07-02T13:39:17Z Bojie Li http://arxiv.org/abs/2606.23370v2 2026-07-01T17:07:48Z

Device-side Large Language Models (LLMs) have grown explosively, offering stronger privacy and higher availability than their cloud-side counterparts. During LLM inference, both the model weights and the user data are valuable, and attackers may compromise the OS kernel to steal them. ARM TrustZone is the de facto hardware-based isolation technology on mobile devices, used to protect sensitive applications from a compromised OS. However, protecting LLM inference with TrustZone incurs significant overhead to both the secure inference and the normal aplications, due to two challenges: the inflexible resource isolation and the inefficient secure resource management. To address these challenges, this paper presents FlexServe, a fast and secure LLM inference system for mobile devices. The key idea is to decouple the access permission from the management permission of secure resources, so that the normal-world OS cannot access them but can still manage them as usual. First, FlexServe introduces a Recallable Resource Isolation mechanism to construct Recallable Secure Memory (Flex-Mem) and a Recallable Secure NPU (Flex-NPU). They can only be accessed by the secure world, but can be efficiently allocated and reclaimed by the normal-world OS. Based on them, FlexServe further introduces a FlexServe Framework to run secure LLM inference in the secure world. It works together with the normal-world OS to perform cooperative secure memory management. We implement a prototype of FlexServe and compare it with two TrustZone-based strawman designs. The results show that FlexServe achieves average TTFT speedups of 10.05X over the strawman and 2.44X over an optimized strawman.

2026-06-22T14:05:51Z Repeated paper uploading due to mistakes. See arXiv:2603.09046 Yinpeng Wu Yitong Chen Lixiang Wang Jinyu Gu Zhichao Hua Yubin Xia http://arxiv.org/abs/2603.09046v3 2026-07-01T17:06:07Z

Device-side Large Language Models (LLMs) have witnessed explosive growth, offering higher privacy and availability compared to cloud-side LLMs. During LLM inference, both model weights and user data are valuable, and attackers may even compromise the OS kernel to steal them. ARM TrustZone is the de facto hardware-based isolation technology on mobile devices, used to protect sensitive applications from a compromised OS. However, protecting LLM inference with TrustZone incurs significant overhead due to its inflexible isolation of memory and the NPU. To address these challenges, this paper introduces FlexServe, a fast and secure LLM serving system for mobile devices. It first introduces a Flexible Resource Isolation mechanism to construct Flexible Secure Memory (Flex-Mem) and Flexible Secure NPU (Flex-NPU). Both memory pages and the NPU can be efficiently switched between unprotected and protected modes. Based on these mechanisms, FlexServe designs a fast and secure LLM inference framework within TrustZone's secure world. The LLM-Aware Memory Management and Secure Inference Pipeline are introduced to accelerate inference. A Multi-Model Scheduler is proposed to optimize multi-model workflows. We implement a prototype of FlexServe and compare it with two TrustZone-based strawman designs. The results show that FlexServe achieves an average $10.05\times$ speedup in Time to First Token (TTFT) compared to the strawman, and an average $2.44\times$ TTFT speedup compared to an optimized strawman with pipeline and secure NPU enabled. For multi-model agent workflows, the end-to-end speedup is up to $24.30\times$ and $4.05\times$ compared to the strawman and optimized strawman, respectively.

2026-03-10T00:31:25Z 13 pages, 11 figures Yinpeng Wu Yitong Chen Lixiang Wang Jinyu Gu Zhichao Hua Yubin Xia http://arxiv.org/abs/2606.25189v2 2026-06-30T22:31:10Z

AI agents increasingly run in production through harnesses, the software around the LLM, including an engine that enforces safety and effectiveness policies, e.g., 'run tests before committing.' Enforcing these policies requires bridging a semantic gap: policy intent is expressed in underspecified natural language, while enforcement must act on concrete system actions, e.g., which test to run. Many policies also define event ordering or data flow actions. Yet existing approaches fall short. Tool-call guardrails miss system actions that bypass the tool layer, while OS sandboxes control resource access instead of actions, returning opaque errors that confuse the agent. Our key insight is that policy context lives within the agent closest to the task, while enforcement must happen at the OS to cover all execution paths. We introduce ActPlane, a policy engine that lets agents declare policies and enforces them in the OS kernel with semantic feedback and isolation. ActPlane uses a simple information-flow control (IFC) DSL to support cross-event policies. We implement ActPlane with eBPF and evaluate it on policies from the empirical study, coding-task benchmarks, and safety benchmarks. ActPlane improves policy compliance, including on indirect execution paths that tool-call interception cannot observe, with 1.9%-8.4% overhead. ActPlane is at https://github.com/eunomia-bpf/ActPlane

2026-06-23T21:33:13Z Yusheng Zheng Tianyuan Wu Quanzhi Fu Tong Yu Wenan Mao Tao Ma Dan Williams Wei Wang Andi Quinn http://arxiv.org/abs/2602.13692v3 2026-06-30T17:19:18Z

Large language models(LLMs) are now used to power complex multi-turn agentic workflows. Existing systems run agentic inference by loosely assembling isolated components: an LLM inference engine (e.g., vLLM) and a tool orchestrator (e.g., Kubernetes). Although agentic workflows involve multiple LLM and tool requests, these systems schedule and allocate resources separately on a per-request basis, without end-to-end knowledge of the workflow. This leads to sub-optimal management of KV cache and tool execution environments. To address the challenges, we propose ThunderAgent, a fast, simple, and program-aware agentic inference system. We first abstract agentic workflows as LLM Programs, enabling a unified view of heterogeneous resources, including KV caches, system states, and external tool assets such as disk memory and network ports. Built upon this abstraction, ThunderAgent introduces a program-aware scheduler and a tool resource manager designed to maximize KV cache hit rates, mitigate memory imbalances, and enable asynchronous environment preparation. Evaluations across coding, routing, and scientific discovery agents demonstrate that ThunderAgent achieves 1.5-3.6x throughput improvements in serving, 1.8-3.9x in RL rollout, and up to 4.2x disk memory savings compared to state-of-the-art inference systems. To facilitate reproducibility and support future development, we open-source the system implementations of the whole ThunderAgent at: https://github.com/Agentic-Kinetics/ThunderAgent.

2026-02-14T09:26:41Z Hao Kang Ziyang Li Weili Xu Xinyu Yang Yinfang Chen Junxiong Wang Beidi Chen Tushar Krishna Chenfeng Xu Simran Arora http://arxiv.org/abs/2606.31415v1 2026-06-30T09:41:38Z

Embedded systems that combine hardware interrupts, buffering, and distributed communication are often perceived as inherently asynchronous and difficult to analyze. However, such systems can exhibit a deterministic timing structure when modeled using explicit logical-time semantics. This paper presents a Global Navigation Satellite System (GNSS) correction-data pipeline implemented as a federated Lingua Franca (LF) application. The federated LF program decomposes the end-to-end pipeline into reactors with explicit time semantics, including a time-triggered GNSS receiver, a UART interrupt stream derived from baud rate and First-In First-Out (FIFO) buffer characteristics, a periodic forwarding task, and downstream processing with jitter monitoring. Federated execution and runtime logs validate the analytically derived deterministic timing structure-including interrupt cadence, ring-buffer evolution, packetization behavior, and physical--logical jitter-yielding a reproducible and predictable timing profile.

2026-06-30T09:41:38Z 4 pages, ReCPS, DATE Conference at Verona 2026 Tejeswini Jayaramareddy Hokeun Kim Hoeseok Yang http://arxiv.org/abs/2606.31408v1 2026-06-30T09:35:28Z

Large Language Models (LLMs) have rapidly proliferated, driving widespread adoption of AI applications. Most deployments rely on centralized infrastructures such as Microsoft Azure, Google Cloud, or AWS, requiring users to share sensitive data and training or fine-tuning code. This dependence raises significant security and privacy concerns, as cloud providers must be trusted to ensure confidentiality and integrity. Trusted Execution Environments (TEEs) e.g., Intel SGX/TDX, AMD SEV-SNP, and ARM CCA have been introduced to mitigate these risks. More recently, NVIDIA has developed GPU TEEs (e.g., H100/H200), yet comprehensive evaluations of end-to-end workflows that integrate CPU and GPU TEEs remain limited. Critical aspects, including performance overhead, remote attestation, and security guarantees for AI/LLM applications, have not been sufficiently studied. This paper addresses this gap by presenting an end-to-end workflow that combines CPU and GPU TEEs. We propose mechanisms to ensure confidentiality and integrity at both the VM level (via Intel TDX and AMD SEV-SNP) and the application level, highlighting vulnerabilities such as Kubernetes administrators' ability to access confidential VM contents. Finally, we evaluate the performance overhead of our system using industry benchmarks, focusing on configurations that integrate Intel TDX with NVIDIA H200 GPUs.

2026-06-30T09:35:28Z 8 pages, 2 figures Robert Schambach TU Dresden Quoc Do Le STACKIT Cloud Sergei Arnautov Scontain GmbH Christof Fetzer TU Dresden and Scontain GmbH http://arxiv.org/abs/2605.09735v2 2026-06-30T03:39:11Z

Static-graph LLM decoders provide predictable launches, fixed tensor shapes, and low submission overhead, but online decoding exposes highly irregular KV-cache behavior: request lengths differ, EOS events arrive asynchronously, and logical histories fragment over time. Dynamic runtimes recover flexibility through paged KV management and step-level scheduling, while static-graph executors often over-reserve memory and suffer burst-time latency outliers. This paper studies whether much of this variability can be absorbed below a fixed decode interface. We present KV-RM, a runtime design that regularizes KV-cache movement beneath a static-graph LLM decoder. KV-RM decouples logical KV histories from physical storage, tracks active KV state through a block pager, and materializes each decode step through a single committed descriptor. A merge-staged transport path coalesces non-contiguous KV mappings into a small number of large transfer groups before a fixed-shape attention kernel consumes them. Optional bounded far-history summaries can be enabled under the same interface, but the core design does not depend on them. On a 2-GPU NVIDIA A100 node, KV-RM improves mixed-length decoding throughput and tail latency relative to a static-graph baseline, reduces reserved KV memory across workload families, and removes severe burst-time latency spikes under production-trace replay. These results suggest that KV-cache movement, rather than kernel shape, can be an effective boundary for recovering runtime flexibility in static-graph LLM serving.

2026-05-10T20:10:26Z Withdrawn by the authors. The authors identified substantive errors that affect the interpretation of the results and the support for the main conclusions. The current version should not be relied upon Zhiqing Zhong Zhijing Ye Jian Zhang Weijian Zheng Bolun Sun Xiaodong Yu http://arxiv.org/abs/2606.30697v1 2026-06-29T03:19:40Z

Current operating systems expose interfaces optimized for human users but not for AI agents. Humans benefit from pixels, icons, windows, visual grouping, mouse movement, and keyboard shortcuts; AI agents instead need compact semantic state, grounded actions, and reliable feedback. As a result, many computer-use agents are forced to interpret screenshots, OCR output, and visual crops, introducing high token costs, visual ambiguity, latency, and coordinate uncertainty. This paper introduces LUMOS (Language Model Unified Machine-Readable Operating-System Semantics), a semantic interaction layer between AI agents and operating systems. LUMOS converts native accessibility metadata and browser UI structures into machine readable semantic blueprints with stable identifiers, roles, names, values, bounds, and action affordances. It also supports live semantic pointer grounding by querying the UI element under or near the cursor through operating-system automation APIs. An LLM then acts through an accessibility grounded observe act loop using constrained visible-UI primitives rather than application-specific scripts. LUMOS does not claim to replace visual agents; instead, it reduces dependence on screenshots when operating systems already provide semantic structure. These results suggest a path toward AI-native operating systems and machine-readable interaction layers.

2026-06-29T03:19:40Z The LUMOS repository is available at https://github.com/thotayogeswarreddy/Lumos.git Yogeswar Reddy Thota http://arxiv.org/abs/2512.12530v2 2026-06-28T06:09:33Z

The Linux kernel is permeated with constant values that are critical to system performance. Many of these constants, referred to as perf-consts, are magic numbers with brittle assumptions on hardware and workloads. Unfortunately, there is no capability of in-situ tuning of perf-const values on deployed kernels. This paper rethinks OS performance tunability. We present Xkernel, a system that offers a safe, efficient, and programmable interface for in-situ tuning of any perf-consts directly on a running kernel. Xkernel transforms any perf-const into a tunable knob on demand using a novel approach called Scoped Indirect Execution (SIE). SIE captures precise binary boundaries where a perf-const enters system state and redirects control to synthesized instructions that update the state as if new values were used. Xkernel goes beyond version atomicity when updating perf-consts to guarantee side-effect safety, a property notably absent in existing kernel update mechanisms. Case studies on various OS subsystems demonstrate significant performance benefits of tuning perf-consts which is made possible by Xkernel.

2025-12-14T02:57:02Z 14 pages Zhongjie Chen Wentao Zhang Yulong Tang Ran Shu Fengyuan Ren Tianyin Xu Jing Liu http://arxiv.org/abs/2508.02007v2 2026-06-25T16:38:23Z

Address translation is a major performance bottleneck in modern computing systems. Predicting the physical address (PA) of requested data before address translation completes can hide this latency, but accurate virtual address (VA)-to-PA prediction is difficult because conventional operating systems make VA-to-PA mappings unpredictable. Prior work improves predictability but relies on large pages or VA-to-PA contiguity, or stores speculation metadata in costly hardware structures. We introduce Revelator, a hardware-OS cooperative technique that uses hashing to enable accurate speculative address translation with small system modifications. Revelator employs a tiered hash-based memory allocation policy for both program data and last-level page table entries (PTEs), creating predictable VA-to-PA and VA-to-PTE mappings. After an L2 TLB miss, a lightweight hardware speculation engine uses the OS hash functions to predict these mappings and prefetch the corresponding cache blocks before translation completes, hiding address translation latency and accelerating page table walks (PTWs). Revelator does not rely on large pages or VA-to-PA contiguity and requires only small OS and hardware changes. Across 11 data-intensive workloads, Revelator improves performance by 15.3% on average over the state-of-the-art speculative address translation technique under high memory fragmentation. In virtualized environments, it predicts both guest and host physical addresses, providing a 13.6% average speedup over Nested Paging. In 16-core systems, Revelator achieves 1.40x (1.50x) speedup over Transparent Huge Pages across 30 server workload mixes from Google under medium (high) memory fragmentation. RTL synthesis shows only 0.02% area and 0.03% power overheads on a high-end server-grade CPU. Revelator is freely available at \href{https://github.com/CMU-SAFARI/Virtuoso}{github.com/CMU-SAFARI/Virtuoso}.

2025-08-04T02:51:53Z Konstantinos Kanellopoulos Konstantinos Sgouras Harsh Songara Andreas Kosmas Kakolyris Vlad-Petru Nitu Spiros Galanopoulos Rahul Bera Konstantina Koliogeorgi Rakesh Kumar Onur Mutlu