On Mon, Sep 13, 2021 at 8:48 PM Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> wrote: > > On Sat, Sep 11, 2021 at 2:05 AM Gabriele <phoenix1987@xxxxxxxxx> wrote: > > > > Hi there > > > > I recently started playing around with libbpf and I was wondering if > > it is possible to read a process' VM from the kernel side. In > > user-space one could use process_vm_read, but I haven't been able to > > find an equivalent BPF API for that. > > Currently only current process's memory (in which BPF program is > running) can be read with bpf_probe_read_user(). I don't think there > is anything that allows reading some other process' data like > process_vm_read allows. Indeed. Currently it's not possible, but this feature request came up in the past and we couldn't do it until sleepable programs came into existence. Now ptrace_access_vm/process_vm_read could be added as a bpf helper for sleepable programs. Gab, Please send a patch with a test case.
