For the record, the current broken behavior can be tested like this:

echo "Hello world!" > greetings
cat <<"EOT" > copyout.d
syscall::read:entry
/pid == $target/
{
	this->ubuf = arg1;
}

syscall::read:return
/pid == $target/
{
	self->kbuf = alloca(10);
	copyoutstr("Ciao ", this->ubuf, 5);
	copyinto(this->ubuf, 10, self->kbuf);
	copyout((void*)((uint64_t)self->kbuf+5), this->ubuf, 5);
}
EOT
dtrace -w -s copyout.d -c "cat greetings"

correct output:

dtrace: script 'copyout.d' matched 4 probes
dtrace: allowing destructive actions
 worl world!
dtrace: pid 5724 has exited

Maybe, instead of using the unprivileged load/store instructions, it would be better to explicitly disable and enable PAN like the native copyin/copyout routines do, using ENTER_USER_ACCESS/EXIT_USER_ACCESS? I believe that would let you avoid writing separate implementations for each direction. That's not an option on 32-bit arm, but they don't have to be consistent, and I'd somewhat prefer to have less code when possible.

In D59449#1364566, @markj wrote:

I'd somewhat prefer to have less code when possible.

So maybe I should redo this using a single function for all 4 modes, which would disable/enable PAN, take an extra parameter (to be ORed when checking for a \0), check the CPU flags after the first byte copy and when crossing a 4k boundary and that would be it.

That's not an option on 32-bit arm, but they don't have to be consistent,

Ok. I need to fix the arm32 copyout part and I'd like to check what the status with powerpc64. Given this and the above, I need to put this review on hold for a while.

Thanks for your review.