Struct LinuxTaskStruct

pub struct LinuxTaskStruct<'a, Driver>
where
    Driver: VmiDriver,
    Driver::Architecture: Architecture + ArchAdapter<Driver>,
{ /* private fields */ }

A Linux task struct.

The task_struct is the process descriptor in the Linux kernel, representing a task (process or thread).

Implementation Details

Corresponds to task_struct.

Implementations

impl<'a, Driver> LinuxTaskStruct<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

pub fn new( vmi: VmiState<'a, Driver, LinuxOs<Driver>>, process: ProcessObject, ) -> Self

Creates a new Linux task struct.

pub fn flags(&self) -> Result<u32, VmiError>

Returns the process flags.

Process flags in Linux include information about the process state, such as whether it’s exiting, a kernel thread, etc.

Implementation Details

Corresponds to task_struct.flags.

pub fn mm(&self) -> Result<Option<LinuxMmStruct<'a, Driver>>, VmiError>

Returns the memory descriptor (mm_struct) of the user-mode process.

The mm_struct contains the memory management information for a process. Kernel threads don’t have an mm_struct and return None.

Implementation Details

Corresponds to task_struct->mm.

pub fn active_mm(&self) -> Result<LinuxMmStruct<'a, Driver>, VmiError>

Returns the active memory context (mm_struct) of the process.

Used by kernel threads to reference the last used mm_struct before entering kernel mode.

If a kernel thread (mm() is None) needs memory access, it temporarily borrows active_mm from the last scheduled user-space process.

When the kernel thread exits, the original mm_struct is restored.

Implementation Details

Corresponds to task_struct->active_mm.

pub fn fs(&self) -> Result<Option<LinuxFsStruct<'a, Driver>>, VmiError>

Returns the filesystem context (fs_struct) of the process.

fs_struct contains:

• root: The process’s root directory (used for chroot).
• pwd: The current working directory.

All threads in the same process share the same fs_struct, unless explicitly changed.

Kernel threads don’t have an fs_struct and return None.

Implementation Details

Corresponds to task_struct->fs.

pub fn d_path( &self, path: &LinuxPath<'_, Driver>, ) -> Result<Option<String>, VmiError>

Constructs the absolute path from a path structure.

Takes into account the process’s filesystem root when constructing the absolute path.

Returns the resolved path as a string if successful, or None if the path could not be resolved (e.g., if the root is null).

Implementation Details

Concatenates task_struct->fs->root with the path structure to construct the absolute path.

pub fn image_path(&self) -> Result<Option<String>, VmiError>

Returns the path of the executable image for a process.

Returns the executable path as a string, or None for special processes like kernel threads or those in the process of exiting.

Implementation Details

Corresponds to d_path(task->mm->exe_file->f_path).

Trait Implementations

impl<'a, Driver> VmiOsProcess<'a, Driver> for LinuxTaskStruct<'a, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

type Os = LinuxOs<Driver>

The VMI OS type.

fn id(&self) -> Result<ProcessId, VmiError>

Returns the process ID.

fn object(&self) -> Result<ProcessObject, VmiError>

Returns the process object.

fn name(&self) -> Result<String, VmiError>

Returns the name of the process.

fn parent_id(&self) -> Result<ProcessId, VmiError>

Returns the parent process ID.

fn architecture(&self) -> Result<VmiOsImageArchitecture, VmiError>

Returns the architecture of the process.

fn translation_root(&self) -> Result<Pa, VmiError>

Returns the process’s page table translation root.

fn user_translation_root(&self) -> Result<Pa, VmiError>

Returns the user-mode page table translation root.

fn image_base(&self) -> Result<Va, VmiError>

Returns the base address of the process image.

fn regions( &self, ) -> Result<impl Iterator<Item = Result<<Self::Os as VmiOs<Driver>>::Region<'a>, VmiError>>, VmiError>

Returns an iterator over the process’s memory regions.

fn find_region( &self, _address: Va, ) -> Result<Option<<Self::Os as VmiOs<Driver>>::Region<'a>>, VmiError>

Finds the memory region containing the given address.

fn threads( &self, ) -> Result<impl Iterator<Item = Result<<Self::Os as VmiOs<Driver>>::Thread<'a>, VmiError>>, VmiError>

Returns an iterator over the threads in the process.

fn is_valid_address(&self, _address: Va) -> Result<Option<bool>, VmiError>

Checks whether the given virtual address is valid in the process.

impl<Driver> VmiVa for LinuxTaskStruct<'_, Driver>

where Driver: VmiDriver, Driver::Architecture: Architecture + ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.