AFAIK, the ptrace syscall uses
access_process_vm to read data from other process. However, different process' address space are isolated, how is that achieved?
Processes’ address spaces are indeed isolated from each other, but they’re not isolated from the kernel. The kernel always knows the memory layout of all active processes.
access_process_vm works as follows:
- it retrieves the memory-management information for the target process (the kernel already knows about the calling process)
- it ensures that the pages it wants to read are pinned in memory (i.e. they exist, won’t be freed completely, and are present; this will cause any paged-out pages to be read back in)
- it maps each remote page in the kernel, and copies the requested data in the appropriate direction.
On 64-bit platforms, in the general case (i.e. the page isn’t an I/O-remapped page), the mapping in the last step relies on the kernel’s direct physical mapping: the kernel has direct access to all physical memory. On 32-bit platforms with
HIGHMEM, this might involve creating specific mappings. (The latter is the reason why
kmap, in the last link above, is defined in
highmem.h — it’s only needed for