Read process VM from kernel

Read process VM from kernel

[Gabriele]

Hi there

I recently started playing around with libbpf and I was wondering if
it is possible to read a process' VM from the kernel side. In
user-space one could use process_vm_read, but I haven't been able to
find an equivalent BPF API for that.

Cheers,
Gab

Re: Read process VM from kernel

[Andrii Nakryiko]

On Sat, Sep 11, 2021 at 2:05 AM Gabriele <phoenix1987@gmail.com> wrote:
>
> Hi there
>
> I recently started playing around with libbpf and I was wondering if
> it is possible to read a process' VM from the kernel side. In
> user-space one could use process_vm_read, but I haven't been able to
> find an equivalent BPF API for that.

Currently only current process's memory (in which BPF program is
running) can be read with bpf_probe_read_user(). I don't think there
is anything that allows reading some other process' data like
process_vm_read allows.

>
> Cheers,
> Gab

Re: Read process VM from kernel

[Alexei Starovoitov]

On Mon, Sep 13, 2021 at 8:48 PM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Sat, Sep 11, 2021 at 2:05 AM Gabriele <phoenix1987@gmail.com> wrote:
> >
> > Hi there
> >
> > I recently started playing around with libbpf and I was wondering if
> > it is possible to read a process' VM from the kernel side. In
> > user-space one could use process_vm_read, but I haven't been able to
> > find an equivalent BPF API for that.
>
> Currently only current process's memory (in which BPF program is
> running) can be read with bpf_probe_read_user(). I don't think there
> is anything that allows reading some other process' data like
> process_vm_read allows.

Indeed. Currently it's not possible, but this feature request
came up in the past and we couldn't do it until sleepable programs
came into existence.
Now ptrace_access_vm/process_vm_read could be added
as a bpf helper for sleepable programs.
Gab,
Please send a patch with a test case.

Re: Read process VM from kernel

[Gabriele]

> Please send a patch with a test case.

I have an R&D week coming up next week and if this is still not
implemented I was thinking of looking into it. Any pointers into the
codebase, docs etc... would be appreciated as I would be looking at
this code for the first time.

Cheers,
Gab.

On Tue, 14 Sept 2021 at 05:24, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, Sep 13, 2021 at 8:48 PM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > On Sat, Sep 11, 2021 at 2:05 AM Gabriele <phoenix1987@gmail.com> wrote:
> > >
> > > Hi there
> > >
> > > I recently started playing around with libbpf and I was wondering if
> > > it is possible to read a process' VM from the kernel side. In
> > > user-space one could use process_vm_read, but I haven't been able to
> > > find an equivalent BPF API for that.
> >
> > Currently only current process's memory (in which BPF program is
> > running) can be read with bpf_probe_read_user(). I don't think there
> > is anything that allows reading some other process' data like
> > process_vm_read allows.
>
> Indeed. Currently it's not possible, but this feature request
> came up in the past and we couldn't do it until sleepable programs
> came into existence.
> Now ptrace_access_vm/process_vm_read could be added
> as a bpf helper for sleepable programs.
> Gab,
> Please send a patch with a test case.



-- 
"Egli è scritto in lingua matematica, e i caratteri son triangoli,
cerchi, ed altre figure
geometriche, senza i quali mezzi è impossibile a intenderne umanamente parola;
senza questi è un aggirarsi vanamente per un oscuro laberinto."

-- G. Galilei, Il saggiatore.