From: 6b65726e656c@gmail.com (Buland Kumar Singh)
To: kernelnewbies@lists.kernelnewbies.org
Subject: How to get object virtual address from a kernel core dump
Date: Wed, 23 Mar 2016 09:11:18 +0530 [thread overview]
Message-ID: <CAKLDxDqtk+m-HGokWwo-HeG8=ecBz15dkO-HVy3LEkdin1iivw@mail.gmail.com> (raw)
In-Reply-To: <CA+9drc69Rwbyi31ixFdmTqGu9yptpPS3qvD7BnDaKHNK8W11vA@mail.gmail.com>
On 18 March 2016 at 15:28, Mohammad Y. Zachariah <eng.myz@gmail.com> wrote:
>
> Hello everyone,
>
> I'm taking the way of analysing kernel core dumps as a learning approach using 'crash tool'. One of the interesting crash commands is 'struct' which can print kernel struct definition and/or the actual contents of the structure.
>
> According to struct help page, I need the virtual address of the struct in order to view/print its contents, for example:
>
> crash> mm_struct.pgd ffff810022e7d080 -px
> pgd_t *pgd = 0xffff81000e3ac000
> -> {
> pgd = 0x2c0a6067
> }
>
> My question is how to find the mm_struct address "ffff810022e7d080" in the above example in the first place??
>
Hello Zach,
1) Determine the struct task_struct * from ps or set command of crash.
Eg:
crash> set 1
PID: 1
COMMAND: "init"
TASK: ffff881029867500 [THREAD_INFO: ffff882029b32000]
CPU: 2
STATE: TASK_INTERRUPTIBLE
crash> ps 1
PID PPID CPU TASK ST %MEM VSZ RSS COMM
1 0 2 ffff881029867500 IN 0.0 24852 1632 init
In above example, struct task_struct * is 0xffff881029867500
2) Determine struct mm_struct * from struct task_struct *
crash> task_struct.mm -ox
struct task_struct {
[0x480] struct mm_struct *mm;
}
crash> task_struct.mm ffff881029867500
mm = 0xffff882026b68700
In above example, struct mm_struct * is 0xffff882026b68700
3) Finally determine pgd_t from struct mm_struct *
crash> mm_struct.pgd -ox
struct mm_struct {
[0x50] pgd_t *pgd;
}
crash> mm_struct.pgd 0xffff882026b68700
pgd = 0xffff882026a9e000
You achieve the above steps in one line;
Eg:
crash> px ((struct task_struct *)0xffff881029867500)->mm.pgd
$1 = (pgd_t *) 0xffff882026a9e000
--
BKS
next prev parent reply other threads:[~2016-03-23 3:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-18 9:58 How to get object virtual address from a kernel core dump Mohammad Y. Zachariah
2016-03-22 11:39 ` Arun Sudhilal
2016-03-23 3:41 ` Buland Kumar Singh [this message]
2016-03-22 11:03 Manoj Nayak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKLDxDqtk+m-HGokWwo-HeG8=ecBz15dkO-HVy3LEkdin1iivw@mail.gmail.com' \
--to=6b65726e656c@gmail.com \
--cc=kernelnewbies@lists.kernelnewbies.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.