Re: Read process VM from kernel

From: Gabriele <phoenix1987@gmail.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>, bpf <bpf@vger.kernel.org>
Subject: Re: Read process VM from kernel
Date: Wed, 5 Jan 2022 23:52:46 +0000	[thread overview]
Message-ID: <CAGnuNNt7va4u78rvPmusYnhXAuy5e9aRhEeO6HDqYUsH979QLQ@mail.gmail.com> (raw)
In-Reply-To: <CAADnVQKN9uZ6KA97r1HzkWA63usdWatxXvV5+i=v=So1nirbVA@mail.gmail.com>

> Please send a patch with a test case.

I have an R&D week coming up next week and if this is still not
implemented I was thinking of looking into it. Any pointers into the
codebase, docs etc... would be appreciated as I would be looking at
this code for the first time.

Cheers,
Gab.

On Tue, 14 Sept 2021 at 05:24, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, Sep 13, 2021 at 8:48 PM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > On Sat, Sep 11, 2021 at 2:05 AM Gabriele <phoenix1987@gmail.com> wrote:
> > >
> > > Hi there
> > >
> > > I recently started playing around with libbpf and I was wondering if
> > > it is possible to read a process' VM from the kernel side. In
> > > user-space one could use process_vm_read, but I haven't been able to
> > > find an equivalent BPF API for that.
> >
> > Currently only current process's memory (in which BPF program is
> > running) can be read with bpf_probe_read_user(). I don't think there
> > is anything that allows reading some other process' data like
> > process_vm_read allows.
>
> Indeed. Currently it's not possible, but this feature request
> came up in the past and we couldn't do it until sleepable programs
> came into existence.
> Now ptrace_access_vm/process_vm_read could be added
> as a bpf helper for sleepable programs.
> Gab,
> Please send a patch with a test case.

-- 
"Egli è scritto in lingua matematica, e i caratteri son triangoli,
cerchi, ed altre figure
geometriche, senza i quali mezzi è impossibile a intenderne umanamente parola;
senza questi è un aggirarsi vanamente per un oscuro laberinto."

-- G. Galilei, Il saggiatore.