diff options
| author | 2020-01-16 12:10:54 -0300 | |
|---|---|---|
| committer | 2020-01-16 12:10:54 -0300 | |
| commit | 277c2b3d1b4a12c9d4c5297a99e1f0c352685d78 (patch) | |
| tree | 235f5fb7c42f3890e095c552647e1ae34ad2595e | |
| parent | 812c980b3f7666c480fdbbd5ac236dc8f0fd3392 (diff) | |
| download | pahole-277c2b3d1b4a12c9d4c5297a99e1f0c352685d78.tar.gz | |
man-pages: Add section about --hex + -E to locate offsets deep into sub structs
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
| -rw-r--r-- | man-pages/pahole.1 | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/man-pages/pahole.1 b/man-pages/pahole.1 index 2334a76..8c58ba1 100644 --- a/man-pages/pahole.1 +++ b/man-pages/pahole.1 @@ -376,6 +376,54 @@ $ .fi .P +OK, I know the offset that causes its a 'struct thread_struct' and that the offset is 0x178, +so must be in that 'fpu' struct... No problem, expand 'struct thread_struct' and combine with \fBgrep\fR: +.PP +.nf +$ pahole --hex -E thread_struct | egrep '(0x178|struct fpu)' -B4 -A4 + /* XXX 30 bits hole, try to pack */ + /* XXX 36 bytes hole, try to pack */ + + /* --- cacheline 3 boundary (192 bytes) --- */ + struct fpu { + unsigned int last_cpu; /* 0xc0 0x4 */ + + /* XXX 4 bytes hole, try to pack */ + +-- + /* typedef u8 -> __u8 */ unsigned char alimit; /* 0x171 0x1 */ + + /* XXX 6 bytes hole, try to pack */ + + struct math_emu_info * info; /* \fI0x178\fR 0x8 */ + /* --- cacheline 6 boundary (384 bytes) --- */ + /* typedef u32 -> __u32 */ unsigned int entry_eip; /* 0x180 0x4 */ + } soft; /* 0x100 0x88 */ + struct xregs_state { +$ +.fi + +.P +Want to know where 'struct thread_struct' is defined in the kernel sources? +.PP +.nf +$ pahole -I thread_struct | head -2 +/* Used at: /sys/kernel/btf/vmlinux */ +/* <0> (null):0 */ +$ +.fi + +.P +Not present in BTF, so use DWARF, takes a little bit longer, and assuming it finds the matching vmlinux file: +.PP +.nf +$ pahole -Fdwarf -I thread_struct | head -2 +/* Used at: /home/acme/git/linux/arch/x86/kernel/head64.c */ +/* <3333> /home/acme/git/linux/arch/x86/include/asm/processor.h:485 */ +$ +.fi + +.P To find the biggest data structures in the Linux kernel: .PP .nf |
