Re: [LSF/MM/BPF TOPIC] eBPF isolation with pkeys

[Dave Hansen <dave.hansen@intel.com>]

On 2/12/26 08:22, Yeoreum Yun wrote:
> Current status
> ==============
> 
> An RFC series is planned for around Q2 2026, and the experimental
> implementations for eBPF isolation with pkey and pkey-aware memory
> allocators have already been completed internally.  Using these
> implementations, we verified that eBPF programs running under isolation
> successfully execute several sched_ext applications provided by
> tools/sched_ext, as well as some bpf kselftest cases.

If you have code, post the code, please. It doesn't matter how ugly it is.

> To that end, this discussion introduces a set of new allocator APIs and
> explores more extensible API designs:
> 
>   - kmalloc_pkey series
>   - vmalloc_pkey series
>   - alloc_percpu_pkey series

It all sounds fun, but this doesn't exactly seem very generic. The meory
that sched_ext needs to access is super different from, say, what a
socket-filtering eBPF program would need.

So this doesn't seem to be likely to be true "eBPF isolation" as much as
sched_ext+eBPP isolation.