BPF series proposes user-memory mmap and copy kfuncs

Jiri Olsa has posted a third revision on the BPF list of a bpf-next series that adds sleepable kfuncs for creating, populating, and removing private anonymous mappings in the current process.

BPF today can write into user space with bpf_probe_write_user, but that helper disables page faults for the copy. Memory that is not already resident cannot be touched. There is also no supported way for a program to allocate or tear down its own anonymous mappings. That combination blocks live-process work such as installing a replacement function or rewriting environment variables.

The proposed interface is three kfuncs scoped to the current task. One creates a private anonymous mapping with caller-chosen protections, including execute. Another copies data into the process address space while allowing faults and reporting incomplete copies as errors. A third removes a mapping. Together they form a short allocate, fill, and free path without changing the fault behavior of the existing probe write helper or inventing a separate mapping abstraction.

Olsa registers the helpers for kprobe-class programs. Use is gated on CAP_SYS_ADMIN via a BPF token and on the kernel's write-user lockdown check. Mapping is done by calling the kernel's mmap and munmap paths directly rather than issuing the system calls, so seccomp does not mediate the mapping itself. A filter can still allow or deny the syscall that triggered the program, but it cannot separately filter what these kfuncs map.

A related verifier change treats const-qualified kfunc memory arguments as read-only, so programs may pass read-only globals where the prototype allows it. Selftests exercise mapping permissions, executable pages on x86-64 and arm64, fault-in of paged-out memory, writes into read-only mappings, partial copy faults, and rejection from non-sleepable or under-privileged programs.