RE: eBPF: Reading page contents from a struct page*

From: ABHIJIT DEODHAR

Date: Thu Nov 06 2025 - 05:33:45 EST


Hi,

I am writing an eBPF program that attaches a kprobe at submit_bio. In this context, I have access to a struct page * and I need to read the page's contents to copy the page data into an ebpf map.
I am planning to use bpf_probe_read_kernel for this purpose. The problem is that bpf_probe_read_kernel() requires a virtual address, which the struct page * itself does not provide.

I've investigated how the kernel solves this internally with functions like kmap_local_page() which internally calls page_address(). On x86-64, this ultimately relies on architecture-specific macros like:

#define page_to_virt(x) __va(PFN_PHYS(page_to_pfn(x)))

I have a couple of questions:

- What is the current best practice to access page data in eBPF? Is it allowed from eBPF? If not - what are the reasons for not allowing it?
- Would a new helper function, perhaps like bpf_kmap_local_page(), be considered a useful addition to eBPF? This could return a temporary, safe virtual address for a page's contents.

Any guidance would be greatly appreciated.

Thanks
Abhijit