White Paper: Red Hat Crash Utility


Contents

help page:  struct


NAME
  struct - structure contents

SYNOPSIS
  struct struct_name[.member] [[-o][-l offset][-r] [address | symbol] [count]]

DESCRIPTION
  This command displays either a structure definition, or a formatted display
  of the contents of a structure at a specified address.  When no address is
  specified, the structure definition is shown along with the structure size.
  A structure member may be appended to the structure name in order to limit
  the scope of the data displayed to that particular member; when no address
  is specified, the member's offset and definition are shown.

    struct_name  name of a C-code structure used by the kernel.
        .member  name of a structure member.
             -o  show member offsets when displaying structure definitions.
      -l offset  if the address argument is a pointer to a list_head structure
                 that is embedded in the target data structure, the offset
                 to the list_head member may be entered in either of the
                 following manners:
                   1. in "structure.member" format.
                   2. a number of bytes. 
             -r  raw dump of structure data.
        address  hexadecimal address of a structure; if the address points
                 to an embedded list_head structure contained within the
                 target data structure, then the "=l" option must be used.
         symbol  symbolic reference to the address of a structure.
          count  count of structures to dump from an array of structures;
                 if used, this must be the last argument entered.

  Structure data, sizes, and member offsets are shown in the current output
  radix.
 
  Please note that in the vast majority of cases, the "struct" command
  name may be dropped; if the structure name does not conflict with any crash
  or gdb command name, then the "struct_name[.member]" argument will be
  recognized as a structure name, and this command automatically executed.
  See the NOTE below.

EXAMPLES
  Display the vm_area_struct at address c1e44f10:

    crash> struct vm_area_struct c1e44f10
    struct vm_area_struct {
      vm_mm = 0xc2857750,
      vm_start = 0x8048000, 
      vm_end = 0x80a5000, 
      vm_next = 0xc1e44a10,
      vm_page_prot = {
        pgprot = 0x25      
      },
      vm_flags = 0x1875,
      vm_avl_height = 0x2,   
      vm_avl_left = 0xc30fe200,
      vm_avl_right = 0xc30fed00,
      vm_next_share = 0x0,       
      vm_pprev_share = 0xc1e44a30,
      vm_ops = 0xc0215ca0,
      vm_offset = 0x0,       
      vm_file = 0xc0bfdc70,
      vm_pte = 0   
    }

  Display the definition and size of a vm_area_struct structure.  This first
  example below displays just the structure and size.  The second example
  uses the -o option to also display member offsets.  Both examples were
  run with the output radix set to 10 (decimal):

    crash> struct vm_area_struct
    struct vm_area_struct {
        struct mm_struct *vm_mm;
        long unsigned int vm_start;
        long unsigned int vm_end;
        struct vm_area_struct *vm_next;
        pgprot_t vm_page_prot;
        short unsigned int vm_flags;
        short int vm_avl_height;
        struct vm_area_struct *vm_avl_left;
        struct vm_area_struct *vm_avl_right;
        struct vm_area_struct *vm_next_share;
        struct vm_area_struct **vm_pprev_share;
        struct vm_operations_struct *vm_ops;
        long unsigned int vm_offset;
        struct file *vm_file;
        long unsigned int vm_pte;
    }
    SIZE: 56

    crash> struct vm_area_struct -o
    struct vm_area_struct {
       [0] struct mm_struct *vm_mm;
       [4] long unsigned int vm_start;
       [8] long unsigned int vm_end;
      [12] struct vm_area_struct *vm_next;
      [16] pgprot_t vm_page_prot;
      [20] short unsigned int vm_flags;
      [22] short int vm_avl_height;
      [24] struct vm_area_struct *vm_avl_left;
      [28] struct vm_area_struct *vm_avl_right;
      [32] struct vm_area_struct *vm_next_share;
      [36] struct vm_area_struct **vm_pprev_share;
      [40] struct vm_operations_struct *vm_ops;
      [44] long unsigned int vm_offset;
      [48] struct file *vm_file;
      [52] long unsigned int vm_pte;
    }
    SIZE: 56

  Display the pgd member of the mm_struct at address c2857bd0:

    crash> struct mm_struct.pgd c2857bd0
      pgd = 0xc168c000,

  Display the definition and offset of the pgd member of an mm_struct:

    crash> struct mm_struct.pgd
    struct mm_struct {
       [12] pgd_t *pgd;
    }

  Display the array of tcp_sl_timer structures declared by tcp_slt_array[]:

    crash> struct tcp_sl_timer tcp_slt_array 4
    struct tcp_sl_timer {
      count = {
        counter = 0x0       
      },
      period = 0x32,      
      last = 0x1419e4,  
      handler = 0xc0164854  <tcp_syn_recv_timer>
    }
    struct tcp_sl_timer {
      count = {
        counter = 0x2       
      },
      period = 0x753,     
      last = 0x14a6df,  
      handler = 0xc01645b0  <tcp_keepalive>
    }
    struct tcp_sl_timer {
      count = {
        counter = 0x0       
      },
      period = 0x2ee,     
      last = 0x143134,  
      handler = 0xc016447c  <tcp_twkill>
    }
    struct tcp_sl_timer {
      count = {
        counter = 0x0       
      },
      period = 0x64,      
      last = 0x143198,  
      handler = 0xc0164404  <tcp_bucketgc>
    }
 
  Without using the "struct" command name, display the the "d_child" 
  list_head member from a dentry structure:

    crash> dentry.d_child 0xe813cb4
      d_child = {
        next = 0x3661344,
        prev = 0xdea4bc4
      },
 
  Display the child dentry structure referenced by the "next" pointer above.
  Since the "next" address of 0x3661344 above is a pointer to an embedded
  list_head structure within the child dentry structure, the -l option
  is required:

    crash> dentry -l dentry.d_child 0x3661344
    struct dentry {
      d_count = {
        counter = 1
      }, 
      d_flags = 0, 
      d_inode = 0xf9aa604, 
      d_parent = 0x11152b1c, 
      d_hash = {
        next = 0x11fb3fc0, 
        prev = 0x11fb3fc0
      }, 
      d_lru = {
        next = 0x366133c, 
        prev = 0x366133c
      }, 
      d_child = {
        next = 0x36613cc, 
        prev = 0xe813cd4
      }, 
      d_subdirs = {
        next = 0x366134c, 
        prev = 0x366134c
      }, 
      d_alias = {
        next = 0xf9aa614, 
        prev = 0xf9aa614
      }, 
      d_mounted = 0, 
      d_name = {
        name = 0x3661384 "boot.log", 
        len = 8, 
        hash = 1935169207
      }, 
      d_time = 1515870810, 
      d_op = 0x0, 
      d_sb = 0x11fc9c00, 
      d_vfs_flags = 0, 
      d_fsdata = 0x0, 
      d_extra_attributes = 0x0, 
      d_iname = "boot.log\000"
    }

NOTE
  If the structure name does not conflict with any crash command name, the
  "struct" command may be dropped.  Accordingly, the examples above could
  also have been accomplished like so:

    crash> vm_area_struct c1e44f10
    crash> vm_area_struct
    crash> vm_area_struct -o
    crash> mm_struct.pgd c2857bd0
    crash> mm_struct.pgd
    crash> tcp_sl_timer tcp_slt_array 4

  Lastly, the short-cut "*" pointer-to command may also be used to negate
  the need to enter the "struct" command name (enter "help *" for details).


Contents