BPF series adds sleepable kfuncs to map and write user memory
Proposed helpers would let privileged BPF programs allocate anonymous pages, including executable ones, and fault in copies into the current process.
Jiri Olsa has posted a first non-RFC series that adds sleepable BPF kernel functions to allocate and free private anonymous memory in the current process and to copy data into its address space with page faults enabled.
The motivation is live process surgery that existing helpers cannot cleanly support, such as replacing a function in a running binary or rewriting environment variables. The long-standing probe write helper deliberately disables faults for the duration of the copy, so it fails when a page is not resident. The new copy path allows faults, forces write access where needed, and is limited to the current task so remote-task security checks are not required.
Mappings may request execute permission. Selftests on x86-64 and arm64 write short instruction sequences into a fresh mapping (or into a page later marked executable) and run them. The helpers are registered for sleepable kprobe-style programs, gated on the CAP_SYS_ADMIN BPF token capability and the kernel lockdown check that blocks unprivileged writes into user memory. Because mapping goes through the kernel’s internal mmap path rather than the mmap syscall, seccomp filters do not mediate the new regions, a behavior the series documents explicitly.
Review on the BPF list focused on interface shape and architecture edge cases. Andrii Nakryiko objected to a new __srcptr argument suffix meant to mark read-only buffers, arguing the verifier should treat C const pointers as read-only instead; Alexei Starovoitov agreed and noted a single suffix cannot compose with other annotations. Olsa accepted both the const approach and a rename that makes the helper’s anonymous-only scope obvious, leaving room for a broader mapping interface later. Automated review also warned that skipping architecture protection validation could admit flags some platforms reject (for example PowerPC strong-access-ordering) and that 32-bit tasks on x86 may see address selection fail outside syscall context. Olsa said he would add the architecture check and fix the other issues in a revision.