* Read process VM from kernel
@ 2021-09-11 9:02 Gabriele
2021-09-14 3:47 ` Andrii Nakryiko
0 siblings, 1 reply; 4+ messages in thread
From: Gabriele @ 2021-09-11 9:02 UTC (permalink / raw)
To: bpf
Hi there
I recently started playing around with libbpf and I was wondering if
it is possible to read a process' VM from the kernel side. In
user-space one could use process_vm_read, but I haven't been able to
find an equivalent BPF API for that.
Cheers,
Gab
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Read process VM from kernel
2021-09-11 9:02 Read process VM from kernel Gabriele
@ 2021-09-14 3:47 ` Andrii Nakryiko
2021-09-14 4:24 ` Alexei Starovoitov
0 siblings, 1 reply; 4+ messages in thread
From: Andrii Nakryiko @ 2021-09-14 3:47 UTC (permalink / raw)
To: Gabriele; +Cc: bpf
On Sat, Sep 11, 2021 at 2:05 AM Gabriele <phoenix1987@gmail.com> wrote:
>
> Hi there
>
> I recently started playing around with libbpf and I was wondering if
> it is possible to read a process' VM from the kernel side. In
> user-space one could use process_vm_read, but I haven't been able to
> find an equivalent BPF API for that.
Currently only current process's memory (in which BPF program is
running) can be read with bpf_probe_read_user(). I don't think there
is anything that allows reading some other process' data like
process_vm_read allows.
>
> Cheers,
> Gab
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Read process VM from kernel
2021-09-14 3:47 ` Andrii Nakryiko
@ 2021-09-14 4:24 ` Alexei Starovoitov
2022-01-05 23:52 ` Gabriele
0 siblings, 1 reply; 4+ messages in thread
From: Alexei Starovoitov @ 2021-09-14 4:24 UTC (permalink / raw)
To: Andrii Nakryiko; +Cc: Gabriele, bpf
On Mon, Sep 13, 2021 at 8:48 PM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Sat, Sep 11, 2021 at 2:05 AM Gabriele <phoenix1987@gmail.com> wrote:
> >
> > Hi there
> >
> > I recently started playing around with libbpf and I was wondering if
> > it is possible to read a process' VM from the kernel side. In
> > user-space one could use process_vm_read, but I haven't been able to
> > find an equivalent BPF API for that.
>
> Currently only current process's memory (in which BPF program is
> running) can be read with bpf_probe_read_user(). I don't think there
> is anything that allows reading some other process' data like
> process_vm_read allows.
Indeed. Currently it's not possible, but this feature request
came up in the past and we couldn't do it until sleepable programs
came into existence.
Now ptrace_access_vm/process_vm_read could be added
as a bpf helper for sleepable programs.
Gab,
Please send a patch with a test case.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Read process VM from kernel
2021-09-14 4:24 ` Alexei Starovoitov
@ 2022-01-05 23:52 ` Gabriele
0 siblings, 0 replies; 4+ messages in thread
From: Gabriele @ 2022-01-05 23:52 UTC (permalink / raw)
To: Alexei Starovoitov; +Cc: Andrii Nakryiko, bpf
> Please send a patch with a test case.
I have an R&D week coming up next week and if this is still not
implemented I was thinking of looking into it. Any pointers into the
codebase, docs etc... would be appreciated as I would be looking at
this code for the first time.
Cheers,
Gab.
On Tue, 14 Sept 2021 at 05:24, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, Sep 13, 2021 at 8:48 PM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > On Sat, Sep 11, 2021 at 2:05 AM Gabriele <phoenix1987@gmail.com> wrote:
> > >
> > > Hi there
> > >
> > > I recently started playing around with libbpf and I was wondering if
> > > it is possible to read a process' VM from the kernel side. In
> > > user-space one could use process_vm_read, but I haven't been able to
> > > find an equivalent BPF API for that.
> >
> > Currently only current process's memory (in which BPF program is
> > running) can be read with bpf_probe_read_user(). I don't think there
> > is anything that allows reading some other process' data like
> > process_vm_read allows.
>
> Indeed. Currently it's not possible, but this feature request
> came up in the past and we couldn't do it until sleepable programs
> came into existence.
> Now ptrace_access_vm/process_vm_read could be added
> as a bpf helper for sleepable programs.
> Gab,
> Please send a patch with a test case.
--
"Egli è scritto in lingua matematica, e i caratteri son triangoli,
cerchi, ed altre figure
geometriche, senza i quali mezzi è impossibile a intenderne umanamente parola;
senza questi è un aggirarsi vanamente per un oscuro laberinto."
-- G. Galilei, Il saggiatore.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-01-05 23:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-11 9:02 Read process VM from kernel Gabriele
2021-09-14 3:47 ` Andrii Nakryiko
2021-09-14 4:24 ` Alexei Starovoitov
2022-01-05 23:52 ` Gabriele
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).