magic_write: Translate struct page to virtual address in BPF programs #2654
AlonZivony
started this conversation in
Development
Replies: 1 comment
-
This is more an implementation discussion than an issue in tracee. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
In my work on the issue of missing
magic_write
event duringsendfile
syscall (#1357) I concluded that given the fact that we can't read from files directly the data, the best thing we have in the flow of the code in the kernel is access to pages that include the data (through thepipe_inode_info
struct).So, to be able to read the data from a page, a method to convert
struct page
to its matching virtual address is required.It is a bit complicated to implement because of different physical memory models available and different architecture implementations, but it should be possible using defines, kconfig and globals (#1506 #1504 #1505).
Beta Was this translation helpful? Give feedback.
All reactions