KFunc `bpf_iter_task_vma_new`

v6.7

Create a new task vma iterator.

Definition

int bpf_iter_task_vma_new(struct bpf_iter_task_vma *it, struct task_struct *task, u64 addr)

Usage

Docs could be improved

This part of the docs is incomplete, contributions are very welcome

Program types

The following program types can make use of this kfunc:

Example

// SPDX-License-Identifier: GPL-2.0
/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */

#include "vmlinux.h"
#include "bpf_experimental.h"
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"

pid_t target_pid = 0;
unsigned int vmas_seen = 0;

struct {
    __u64 vm_start;
    __u64 vm_end;
} vm_ranges[1000];

SEC("raw_tp/sys_enter")
int iter_task_vma_for_each(const void *ctx)
{
    struct task_struct *task = bpf_get_current_task_btf();
    struct vm_area_struct *vma;
    unsigned int seen = 0;

    if (task->pid != target_pid)
        return 0;

    if (vmas_seen)
        return 0;

    bpf_for_each(task_vma, vma, task, 0) {
        if (seen >= 1000)
            break;

        vm_ranges[seen].vm_start = vma->vm_start;
        vm_ranges[seen].vm_end = vma->vm_end;
        seen++;
    }

    vmas_seen = seen;
    return 0;
}

char _license[] SEC("license") = "GPL";

KFunc bpf_iter_task_vma_new