linux-kernel - RE: eBPF: Reading page contents from a struct page*

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <SIAP153MB1317964108E3DD30AF49A88CD1C2A@SIAP153MB1317.APCP153.PROD.OUTLOOK.COM>
Date: Thu, 6 Nov 2025 10:33:41 +0000
From: ABHIJIT DEODHAR <adeodhar@...rosoft.com>
To: "bpf@...r.kernel.org" <bpf@...r.kernel.org>, "linux-mm@...r.kernel.org"
	<linux-mm@...r.kernel.org>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"alexei.starovoitov@...il.com" <alexei.starovoitov@...il.com>,
	"daniel@...earbox.net" <daniel@...earbox.net>, Alban Crequy
	<albancrequy@...rosoft.com>
Subject: RE: eBPF: Reading page contents from a struct page*

Hi, 

I am writing an eBPF program that attaches a kprobe at submit_bio. In this context, I have access to a struct page * and I need to read the page's contents to copy the page data into an ebpf map. 
I am planning to use bpf_probe_read_kernel for this purpose. The problem is that bpf_probe_read_kernel() requires a virtual address, which the struct page * itself does not provide. 

I've investigated how the kernel solves this internally with functions like kmap_local_page() which internally calls page_address(). On x86-64, this ultimately relies on architecture-specific macros like: 

#define page_to_virt(x) __va(PFN_PHYS(page_to_pfn(x))) 

I have a couple of questions: 

- What is the current best practice to access page data in eBPF? Is it allowed from eBPF? If not - what are the reasons for not allowing it?
- Would a new helper function, perhaps like bpf_kmap_local_page(), be considered a useful addition to eBPF? This could return a temporary, safe virtual address for a page's contents. 

Any guidance would be greatly appreciated. 

Thanks
Abhijit