Towards eBPF Support in a Memory-Safe OS: A Case Study on Asterinas

Abstract

While eBPF is widely used for kernel extensibility, its integration into memory-safe kernel architectures remains largely unexplored. We present preliminary work on integrating eBPF into Asterinas, a framekernel that restricts unsafe Rust to a minimal Trusted Computing Base (TCB). We introduce an eBPF hook at the UDP packet transmission path, enabling user-defined programs to inspect packet metadata and payload, and to enforce accept/drop policies at runtime. Our prototype leverages an existing eBPF interpreter and establishes the feasibility of eBPF programmability within a Rust-based, memory-safe kernel. We identify the design challenges in adapting the eBPF execution model to Asterinas' architectural constraints and highlight key research challenges in achieving safe Just-In-Time (JIT) compilation without expanding the kernel's TCB.