Research Update: Isolated Execution Environment for eBPF (Part 3) (opens in new tab)

Recap. In Blog 2 we showed how HIVE handles inclusive type pointers (those pointing to BPF objects) by decoupling fragmented BPF objects and isolating them in a unified BPF space protected by AArch64’s LSU instructions and E0PD. In this blog, we tackle the harder half of the problem: exclusive type pointers, which point to kernel objects that BPF programs are allowed to share with the kernel. We first explain how BPF programs access kernel objects and how the verifier secures them, then summa...