RACE: Towards Automatic eBPF Program Synthesis via Retrieval-Augmented Generation and Chain-of-Thought Reasoning
摘要
The extended Berkeley Packet Filter (eBPF) has emerged as a powerful and safe in-kernel execution technology, widely adopted in domains such as system observability, security auditing, and high-performance networking. However, due to its stringent verifier constraints and steep learning curve, automatically generating compliant eBPF programs remains a substantial challenge. This paper presents a novel framework RACE for eBPF program synthesis that combines Retrieval-Augmented Generation (RAG) with Chain-of-Thought (CoT) reasoning. The framework leverages a high-quality code knowledge base and structured multi-stage prompts to guide large language models (LLMs) in generating eBPF programs from natural language descriptions. It also incorporates both syntactic validation through the native eBPF verifier to ensure correctness and reliability. Experiments conducted on three representative LLMs—GPT-4o Mini, Gemini 2.0 Flash, and Qwen-Plus—demonstrate significant improvements across both BCC and BPFtrace programming paradigms. Notably, the framework achieves up to 93.3% task-level success rate on complex BCC tasks while significantly reducing false positive rates, showcasing strong generalizability, effectiveness, and practical deployment potential.