RE: eBPF: Reading page contents from a struct page*
From: ABHIJIT DEODHAR
Date: Thu Nov 06 2025 - 05:33:45 EST
Hi,
I am writing an eBPF program that attaches a kprobe at submit_bio. In this context, I have access to a struct page * and I need to read the page's contents to copy the page data into an ebpf map.
I am planning to use bpf_probe_read_kernel for this purpose. The problem is that bpf_probe_read_kernel() requires a virtual address, which the struct page * itself does not provide.
I've investigated how the kernel solves this internally with functions like kmap_local_page() which internally calls page_address(). On x86-64, this ultimately relies on architecture-specific macros like:
#define page_to_virt(x) __va(PFN_PHYS(page_to_pfn(x)))
I have a couple of questions:
- What is the current best practice to access page data in eBPF? Is it allowed from eBPF? If not - what are the reasons for not allowing it?
- Would a new helper function, perhaps like bpf_kmap_local_page(), be considered a useful addition to eBPF? This could return a temporary, safe virtual address for a page's contents.
Any guidance would be greatly appreciated.
Thanks
Abhijit