Accessing data pages from bio for continuous replication

[aadeodhar]

I am trying to access the application I/O data in the kernel using eBPF and came across this project.

I have a couple of questions wrt block filtering and eBPF:

• What is the current best practice to access page data in eBPF - something like kmap_local_page() in kernel code? Is it allowed from eBPF? If not - what are the reasons for not allowing it?

Can we enhance this solution to do continuous data replication of every I/O instead of the snapshot based approach that is being used here?

Any guidance would be greatly appreciated. Thanks!

[iamvishnuks]

Thanks for the first issue here!

You're right that accessing block I/O data with eBPF is quite limited. Currently, there's no way to read the actual data payload of block I/O operations directly from eBPF at the kernel level.

Why kmap_local_page() doesn't work:
eBPF programs can only call whitelisted BPF helper functions, not arbitrary kernel functions like kmap_local_page(). This is enforced by the eBPF verifier to maintain safety guarantees - eBPF programs cannot sleep, hold locks for long, or access memory outside verified bounds.

Current workarounds:

• You can use bpf_probe_read_kernel() to read small chunks of kernel memory
• Hook into block layer tracepoints to capture I/O metadata (bio/request structs)
• But accessing the full page data isn't currently possible

Regarding continuous replication:
A struct_ops implementation for block I/O could potentially help here (though this would require upstream kernel work). However, even with better data access, continuous replication faces challenges:

• eBPF map size limits (~4GB)
• Performance overhead of capturing every I/O with full data
• Potential for overwhelming the BPF ring buffer on high I/O workloads

A hybrid approach might work better: use eBPF for metadata/filtering, and handle bulk data replication in userspace.

Would you be interested in exploring a specific use case? That might help identify the best architecture.

[aadeodhar]

Thanks for the reply.

Could you please explain a bit more on "You can use bpf_probe_read_kernel() to read small chunks of kernel memory".
Are the small chunks of memory part of the page? How to get the correct memory address from the struct page field? Is there a way to use bpf_probe_read_kernel() on the struct page to do it?

Thanks!