ePass: A Framework for Enhancing Flexibility and Runtime Safety of eBPF Programs
summary
ePass lifts eBPF bytecode into an SSA IR and provides a kernel-side compiler pipeline that runs verifier-cooperative passes; 12 example passes (most under 100 lines) include a heap pass that emulates dynamic allocation on a map, a loop counter that derives per-loop bounds from verifier analysis and enforces a 1,000,000-instruction cap, and an MSM pass that builds shadow memory for stack sanitization. Implementation is ~12,000 C lines, enables previously rejected programs, mitigates multiple CVEs, and shows ~2% runtime overhead.
AI-written summary · about
chapters (7)
- 0:00Introduction to EPAS
- 1:25Verifier limitations in eBPF
- 4:39EPAS design overview
- 6:28Core compiler framework
- 12:08Use cases and passes
- 21:49Implementation and experiments
- 25:01Conclusion and Q&A
related talks
29meBPF on the Rise - Getting Started
33meBPF: exploring use case of BPF kernel infrastructure
32meBPF: The Next Power Tool of SREs
43meBPF Superpowers for SRE
42mResolving Performance and Security Issues with eBPF
01h 03mBPF and Spectre: Mitigating transient execution attacks
20mEPF: Evil Packet Filter
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel