Re: one-shot BPF program in the context of a specific PID
Andrei Matei
Hi Alexei, I'm playing around with using BPF to read a given process' memory for debugging purposes. I'd like to recreate some of the experience that a debugger gives you by stopping and ptrace-ing another process, except without the "stopping" part. One of the aspects is around getting a snapshot of the running process; for example, for a Go program, this involves reading the information that the Go runtime has about all the Goroutines, walking their stacks, and collecting different variables from the different stack frames. You'll notice that this use case doesn't quite fit as a uprobe - I don't want the BPF program to be run when a particular program counter is hit; instead, I want the BPF program to run whenever the debugger decides to run it. Crucially, the BPF program needs to run *within the virtual memory context* of the debugged program, so it can bpf_probe_read_user() its memory. So, I want process A to trigger a BPF program that will execute within process B. Or, is there perhaps a way to read the virtual memory of an arbitrary program? > Have you considered using a task iterator parametrized with a particular task? I had not. I'm reading about it now, but I'm not sure if it helps me. If it applies, can you please say more? Thanks! On Tue, Dec 20, 2022 at 9:16 AM Alexei Starovoitov <alexei.starovoitov@...> wrote: On Sun, Dec 18, 2022 at 4:09 PM Andrei Matei <andreimatei1@...> wrote: |
|