Enabling eBPF on Embedded Systems Through Decoupled Verification
| dc.contributor.author | Craun, Milo | en |
| dc.contributor.author | Oswald, Adam | en |
| dc.contributor.author | Williams, Dan | en |
| dc.date.accessioned | 2023-10-02T14:53:57Z | en |
| dc.date.available | 2023-10-02T14:53:57Z | en |
| dc.date.issued | 2023-09-10 | en |
| dc.date.updated | 2023-10-01T07:51:42Z | en |
| dc.description.abstract | eBPF (Extended Berkeley Packet Filter) is a Linux kernel subsystem that aims to allow developers to write safe and efficient kernel extensions by employing an in-kernel verifier and just-in-time compiler (JIT). We find that verification is prohibitively expensive for resource-constrained embedded systems. To solve this we describe a system that allows for verification to occur outside of the embedded kernel and before BPF program load time. The in-kernel verifier and JIT are coupled so they must be decoupled together. A designated verifier kernel accepts a BPF program, then verifies, compiles, and signs a native precompiled executable. The executable can then be loaded onto an embedded device without needing the verifier and JIT on the embedded device. Decoupling verification and JIT from load-time opens the door to much more than running BPF programs on embedded devices. It allows larger and more expressive BPF programs to be verified, provides a way for new approaches to verification to be used without extensive kernel modification and creates the possibility for BPF program verification as a service. | en |
| dc.description.version | Published version | en |
| dc.format.mimetype | application/pdf | en |
| dc.identifier.doi | https://doi.org/10.1145/3609021.3609299 | en |
| dc.identifier.uri | http://hdl.handle.net/10919/116401 | en |
| dc.language.iso | en | en |
| dc.publisher | ACM | en |
| dc.rights | Creative Commons Attribution 4.0 International | en |
| dc.rights.holder | The author(s) | en |
| dc.rights.uri | http://creativecommons.org/licenses/by/4.0/ | en |
| dc.title | Enabling eBPF on Embedded Systems Through Decoupled Verification | en |
| dc.type | Article - Refereed | en |
| dc.type.dcmitype | Text | en |