# Crash Compatibility

drgn provides a compatibility mode emulating the crash utility. Many commands have been ported from crash. Output is not byte-identical, but it generally closely resembles crash output.

These commands can be run directly from the drgn CLI as subcommands of the `crash` command:

    >>> %crash sys
    KERNEL: ...

Crash commands take an additional `--drgn` option instructing them to print example drgn code that does the equivalent of the command. This is useful for learning about drgn helpers and APIs. It can also be used to generate a template for doing something more advanced than the command supports. You can copy and paste the output or even write it to a file and edit it before running it:

    >>> %crash mount --drgn > mount.py
    >>> %sh $EDITOR mount.py
    >>> %source mount.py

## Interactive Crash Prompt

Calling the `crash` command with no arguments enters an interactive prompt where crash commands can be called directly:

    >>> %crash
    %crash> sys
    KERNEL: ...
    %crash>

drgn code can be executed from the interactive crash prompt with the `drgn` command:

    %crash> drgn stack_trace(1)[0]["next"].pid
    (pid_t)0

Calling the `drgn` command with no arguments returns to the drgn CLI:

    %crash> drgn
    >>>

The interactive prompt can also be entered directly from a shell with the drgn-crash script:

    $ drgn-crash
    KERNEL: ...
    %crash>

## Commands

### *

shortcut for struct or union

#### Synopsis

* [struct or union command arguments]

#### Description

This is a shortcut that allows typing, e.g., `*list_head` instead of `struct list_head`. Note that if the type name is not also the name of a command, then the `*` can also be omitted, e.g., `list_head`.

### ascii

translate a hexadecimal value to ASCII

#### Synopsis

ascii [--drgn] [value …]

#### Description

Translates 32-bit or 64-bit hexadecimal values to ASCII. If no argument is entered, an ASCII chart is displayed.

#### Positional Arguments

value

  hexadecimal value

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

### bpf

display loaded eBPF programs and maps

#### Synopsis

bpf [-p PROG_ID] [-m MAP_ID] [--drgn]

#### Options

-p PROG_ID

  display additional information for the specified BPF program ID

-m MAP_ID

  display additional information for the specified BPF map ID

--drgn

  print how to do the equivalent operation using drgn APIs

### bt

print stack traces

#### Synopsis

bt [pid|task [pid|task …] | -c CPUS | -a | -p] [-f | -F] [-l] [-d] [-V] [--drgn]

#### Description

Print the kernel stack trace for a given PID or task

If no PID or task is given, print the stack trace for the current context task.

#### Positional Arguments

pid|task

  print stack trace for task(s), given as a decimal process ID or hexadecimal `task_struct` address.

#### Options

-c CPUS

  print stack trace for one or more CPUs, which can be specified using the format ‘3’, ‘1,8,9’, ‘1-23’, or ‘1,8,9-14’.

-a

  print stack trace for all CPUs

-p

  print stack trace for the panic task

-f

  display all stack data contained in a frame

-F

  similar to -f, except that the stack data is displayed symbolically where appropriate; if the stack data references a slab cache object, the name of the slab cache will be displayed in brackets. If -F is entered twice, and the stack data references a slab cache object, then both the address and the name of the slab cache will be displayed in brackets

-l

  show file and line number of each stack trace text location

-d

  format the stack frames in drgn’s style rather than crash’s

-V

  print any local variable values which drgn can determine

--drgn

  print how to do the equivalent operation using drgn APIs

### btop

bytes to page

#### Synopsis

btop [--drgn] address [address …]

#### Description

Convert byte numbers (usually physical addresses) to page numbers.

#### Positional Arguments

address

  hexadecimal byte number/physical address

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

### dev

devices

#### Synopsis

dev [-i | -p | -d | -D] [--drgn]

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

#### Type

What type of devices to display. If not given, display registered character and block device majors.

-i

  display I/O port regions

-p

  display PCI devices

-d

  display all disks and their number of in-progress requests

-D

  like -d, but only display disks that have in-progress requests

### drgn

run drgn code or enter drgn interactive mode

#### Synopsis

drgn [code]

#### Description

If code is given, execute the given drgn Python code, up to the first shell redirection or pipeline.

Otherwise, enter drgn’s interactive mode.

### eval

evaluate an expression

#### Synopsis

eval [-b] [-l] [–drgn] (expression)

#### Description

Evaluate an expression and print the result in various formats.

#### Positional Arguments

expression

  expression to evaluate.

  Expressions are of the form `value` or `value operator value`, where value is a number optionally prefixed by zero or more unary operators and optionally suffixed by a unit.

  Numbers may be decimal or hexadecimal. The “0x” prefix is optional for hexadecimal numbers.

  The following binary operators are supported:

  `+ - & | ^ * % / << >>`

  The following unary operators are supported:

  `- ~`

  Units may be “K” or “k” to multiply by 1024, “M” or “m” to multiply by 1024*1024, and “G” or “g” to multiply by 1024*1024*1024.

  Expressions may be enclosed in parentheses. Parentheses are only required when using the `|`, `<<`, or `>>` operators.

#### Options

-b

  show which bits are set in the result, where 0 is the least significant bit

-l

  use 64-bit values even on 32-bit architectures

--drgn

  print how to do the equivalent operation using drgn APIs

### exit

exit session

#### Synopsis

exit

### files

file information

#### Synopsis

files [-d DENTRY | -p INODE | pid|task [pid|task …]] [-c] [-R REFERENCE] [--drgn]

#### Description

Show file information. By default, display the root directory, current working directory, and all open files of one or more tasks, including the file descriptor, file structure, dentry, inode, file type, and path.

#### Positional Arguments

pid|task

  display open files for this task, given as either a decimal process ID or a hexadecimal `task_struct` address. May be given multiple times. Defaults to the current context

#### Options

-d DENTRY

  display the inode, super block, file type, and full path of a dentry, given as a hexadecimal address

-p INODE

  display the pages in the page cache of an inode, given as a hexadecimal address

-c

  for each open file, display the i_mapping and number of cached pages instead of the file structure and dentry

-R REFERENCE

  search for references to this file descriptor, path, or dentry, inode, address_space, or file structure address

--drgn

  print how to do the equivalent operation using drgn APIs

### foreach

run command on multiple tasks

#### Synopsis

foreach [--drgn] [pid | task | name …] [kernel | user | gleader] [active] [state] command [-option …]

#### Description

Run the given command on all tasks matching the given constraints (or all tasks in the system if no constraints are given).

#### Positional Arguments

pid

  run the command on the task with this decimal process ID

task

  run the command on the task with this hexadecimal task_struct address

name

  run the command on tasks with the given name. May be prefixed with `\` to disambiguate it as a literal command name. If single-quoted (`'`), then it is treated as a regular expression

kernel

  run the command on kernel threads

user

  run the command on user tasks

gleader

  run the command on thread group leaders

active

  run the command on the active task on each CPU

state

  run the command on tasks in this state (“R”, “D”, etc.)

command

  run this command on the selected tasks. Currently, bt, files, ps, set, sig, task, vm, and vtop are supported

#### Options

-option

  additional option to pass to the command

--drgn

  print how to do the equivalent operation using drgn APIs

### help

get help

#### Synopsis

help [command …]

#### Description

Print help about one or more commands.

If no commands are given, this lists available commands and prints general help.

#### Positional Arguments

command

  command to get help about, or `all` for all commands

### ipcs

System V IPC

#### Synopsis

ipcs [-s] [-m] [-q] [-n pid|task] [--drgn] [id|addr …]

#### Positional Arguments

id|addr

  search for IPC instances with the given decimal identifier or hexadecimal kernel address. May be given multiple times

#### Options

-n pid|task

  search in the IPC namespace of a task, given as either a decimal process ID or a hexadecimal `task_struct` address. Defaults to the IPC namespace of the current context

--drgn

  print how to do the equivalent operation using drgn APIs

#### Types

IPC types to display. If none are given, all three are displayed.

-s

  display semaphore arrays

-m

  display shared memory segments

-q

  display message queues

### irq

interrupt requests/descriptors

#### Synopsis

irq [-u | -d | -b | -a | -s | number [number …]] [-c CPU] [--drgn]

#### Description

Show interrupt information. By default, display all interrupt descriptors.

#### Positional Arguments

number

  display the interrupt descriptor for the given IRQ number. May be given multiple times

#### Options

-u

  display only allocated interrupt descriptors

-d

  display the x86 IDT (interrupt descriptor table)

-b

  display softirqs (a.k.a. bottom half)

-a

  display CPU affinity for in-use interrupts

-s

  display statistics for in-use interrupts

-c CPU

  when used with -s, restrict the output to one or more CPUs, which may be a comma-separated string of CPU numbers or ranges (e.g., ‘0,3-4’)

--drgn

  print how to do the equivalent operation using drgn APIs

### kmem

kernel memory

#### Synopsis

kmem [-f | -F | -i | -v | -V | -n | -z | -o | -h | -p | -m PAGE_MEMBERS | -s | -g [FLAGS]] [-I NAME[,NAME…]] [--drgn] [name …] [address …]

#### Description

Display information about various parts of the memory management subsystem.

#### Positional Arguments

name

  when used with -s, only display the slab caches with the given names

address

  addresses to identify as symbols, tasks, task stacks, vmalloc allocations, pages, and/or slab objects. Can be combined with -v, -p, -m, or -s to limit the search to their respective types

#### Options

-f

  display and verify page allocator free lists

-F

  like -f, but also display each page on the free lists

-i

  display general memory usage information

-v

  display memory regions allocated with vmalloc()/vmap()

-V

  display zone, node, NUMA, and VM event statistics

-n

  display NUMA nodes, SPARSEMEM sections, and memory blocks

-z

  display per-zone memory statistics

-o

  display each CPU’s per-CPU offset (the value added to convert a per-CPU symbol to a virtual address)

-h

  display HugeTLB state

-p

  display every valid struct page, including its physical address, mapping, index, refcount, and flags

-m PAGE_MEMBERS

  display the given comma-separated members of every valid struct page

-s

  display an overview of slab caches

-g [FLAGS]

  display the flags set on a hexadecimal page flags value, or display all of the possible flags if no value is given

-I NAME[,NAME...]

  when used with -s, comma-separated list of names of slab caches to ignore

--drgn

  print how to do the equivalent operation using drgn APIs

### list

linked list contents

#### Synopsis

list [-o OFFSET] [-s struct_name[.member[,member]]] [-l OFFSET] [-H | -h] [-O OFFSET] [-r] [-e END] [-x] [-d] [--drgn] start

#### Positional Arguments

start

  hexadecimal address of first list entry (but see -H, -h, and -O)

#### Options

-o OFFSET

  offset from a list entry to the pointer to the next entry, as either a number of bytes or a struct_name.member. This can also be passed as a positional argument (i.e., without “-o”) unless the offset could be confused for a kernel virtual address. Defaults to 0

-s struct_name[.member[,member]], -S struct_name[.member[,member]]

  type name of list entries. May include one or more comma-separated members (each of which can be nested and include array subscripts) to limit the output to those members

-l OFFSET

  only used with -s. Cannot be used with -o. Offset from a list entry to the list_head or similar structure linking entries together, as either a number of bytes or a struct_name.member

-H

  treat start as the address of an anchor list_head (e.g., a standalone LIST_HEAD())

-h

  treat start as the address of a list_head embedded in a list entry

-O OFFSET

  only used with -h. Treat start as the address of a structure that embeds an anchor list_head at this offset, given as either a number of bytes or a struct_name.member

-r

  with -h or -H, iterate in reverse order using list_head.prev

-e END

  hexadecimal address where to stop iterating in addition to the defaults of NULL, the start address, the address of the first entry, and the address of the current entry

-x

  output integers in hexadecimal format regardless of the default

-d

  output integers in decimal format regardless of the default

--drgn

  print how to do the equivalent operation using drgn APIs

### log

Dump kernel dmesg

#### Synopsis

log [-T | -t] [--drgn]

#### Options

-T

  Dump kernel dmesg in human readable time

-t

  Dump kernel dmesg without timestamp

--drgn

  print how to do the equivalent operation using drgn APIs

### mod

module information and loading debugging symbols

#### Synopsis

mod [-s MODULE [FILE …] | -S [DIRECTORY] | -t] [--drgn]

#### Options

-s MODULE [FILE ...]

  load debugging symbols for the given module from the given file, or from the default locations if no file is given

-S [DIRECTORY]

  load debugging symbols for all modules from the given directory, or from the default locations if no directory is given

-t

  display tainted modules

--drgn

  print how to do the equivalent operation using drgn APIs

### mount

mounted filesystems

#### Synopsis

mount [-n pid|task] [--drgn]

#### Description

List mounted filesystems.

#### Options

-n pid|task

  list mounted filesystems in the namespace of a task, given as either a decimal process ID or a hexadecimal `task_struct` address. Defaults to the mount namespace of the current context

--drgn

  print how to do the equivalent operation using drgn APIs

### p

print the value of an object

#### Synopsis

p [-x] [-d] [--drgn] object[:cpuspec]

#### Positional Arguments

object[:cpuspec]

  object to print. This may include member accesses and array subscripts. It does not support arbitrary expressions yet. For per-cpu variables, this may also contain a colon (‘:’) followed by a specification of which CPUs to print, which may be a comma-separated string of CPU numbers or ranges (e.g., ‘0,3-4’), ‘a’ or ‘all’ (meaning all possible CPUs), or an empty string (meaning the CPU of the current context)

#### Options

-x

  output integers in hexadecimal format regardless of the default

-d

  output integers in decimal format regardless of the default

--drgn

  print how to do the equivalent operation using drgn APIs

### ps

process information

#### Synopsis

ps [-k | -u] [-G] [-y POLICY] [-A] [-s | -p | -c | -t | -l | -m | -a | -g | -r | -S] [-C CPU] [-H] [--drgn] [pid|task|command …]

#### Description

display process status information

#### Positional Arguments

pid|task|command

  display only this task, given as a decimal process ID, hexadecimal `task_struct`, single- quoted (`'`) regular expression matching command names, or a literal command name (optionally prefixed with `\` to disambiguate it). May be given multiple times

#### Options

-k

  only display kernel threads

-u

  only display user tasks

-G

  only display the thread group leader in each thread group

-y POLICY

  only display tasks with the given scheduling policy, as a comma-separated list of the following (case-insensitive) policy names or their integer values:

NORMAL or OTHER (0) FIFO (1) RR (2) BATCH (3) IDLE (5) DEADLINE (6) EXT (7)

-A

  display only the active task on each CPU

-s

  display the kernel stack pointer instead of the task_struct

-p

  display the parental hierarchy of selected tasks

-c

  display the children of selected tasks

-t

  display the task run time, start time, cumulative user time, and cumulative system time

-l

  display the last_arrival timestamp of selected tasks, and sort from most-recent to least-recent

-m

  like -l, but display the difference between the current runqueue clock and the last_arrival timestamp as “days hours:minutes:seconds.milliseconds”

-a

  display the command line arguments and environment variables of selected userspace tasks

-g

  display threads in the thread groups of selected tasks and group threads by thread group

-r

  display resource limits (rlimits) of selected tasks

-S

  display a summary of the number of selected tasks in each task state

-C CPU

  for -l or -m, only display tasks on the given CPUs, which may be a comma-separated string of CPU numbers or ranges (e.g., ‘0,3-4’), and group selected tasks by CPU

-H

  do not print a header line

--drgn

  print how to do the equivalent operation using drgn APIs

### ptob

page to bytes

#### Synopsis

ptob [--drgn] pfn [pfn …]

#### Description

Convert page frame numbers to byte numbers (physical addresses).

#### Positional Arguments

pfn

  page frame number

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

### ptov

physical or per-CPU to virtual

#### Synopsis

ptov [--drgn] address|offset:cpuspec [address|offset:cpuspec …]

#### Description

This command translates a hexadecimal physical address into a kernel virtual address. Alternatively, a hexadecimal per-cpu offset and cpu specifier will be translated into kernel virtual addresses for each cpu specified.

#### Positional Arguments

address|offset:cpuspec

  hexadecimal physical address or hexadecimal per-CPU offset and CPU specifier

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

### rd

read memory

#### Synopsis

rd [-p | -u] [-d | -D] [-s] [-S] [-x] [-8 | -16 | -32 | -64 | -a] [-N] [-R] [-o OFFSET] [-e END] [-r RAW] [--drgn] address|symbol [count]

#### Description

This command displays the contents of memory, formatted in several different ways.

#### Positional Arguments

address|symbol

  starting hexadecimal address, or symbol of starting address

count

  decimal number of memory locations to display (default: 1)

#### Options

-p

  address argument is a physical address

-u

  address argument is a user virtual address; this is only required on processors or configurations where user and kernel virtual address spaces overlap, such as s390x, or 32-bit processors with 4G:4G kernel configurations. In other cases, this can still be used as a hint.

-d

  display output in signed decimal format (default is hexadecimal)

-D

  display output in unsigned decimal format (default is hexadecimal)

-s

  displays output symbolically where appropriate

-S

  displays output symbolically where appropriate; if the memory contents reference a slab cache object, the name of the slab cache will be displayed in brackets. If -S is entered twice, and the memory contents reference a slab cache object, both the memory contents and the name of the slab cache will be displayed in brackets

-x

  do not display ASCII translation at the end of each line

-8

  display output in 8-bit values

-16

  display output in 16-bit values

-32

  display output in 32-bit values (default on 32-bit machines)

-64

  display output in 64-bit values (default on 64-bit machines)

-a

  display output in ASCII characters if it contains printable ASCII characters

-N

  display output in network byte order

-R

  display memory in reverse order; memory will be displayed up to and including the address argument, requiring the count argument to be greater than 1 to display memory before the specified address. Conflicts with -e.

-o OFFSET

  offset applied to the starting address

-e END

  display memory until reaching this hexadecimal address

-r RAW

  dumps raw data to the specified output file; the number of bytes that are copied to the file must be specified either by a count argument or by the -e option

--drgn

  print how to do the equivalent operation using drgn APIs

### runq

CPU scheduler run queues

#### Synopsis

runq [-t | -T | -m | -g] [-c CPU] [--drgn]

#### Description

By default, display the tasks on each CPU’s runqueue.

#### Options

-t

  display the timestamp of each CPU’s runqueue and the timestamp of the active task on each CPU

-T

  display the difference between the timestamp of each CPU’s runqueue relative to the runqueue with the highest timestamp

-m

  display the amount of time that the active task on each CPU has been running

-g

  display the task_group hierarchy on each CPU’s runqueue

-c CPU

  restrict the output to one or more CPUs, which may be a comma-separated string of CPU numbers or ranges (e.g., ‘0,3-4’)

--drgn

  print how to do the equivalent operation using drgn APIs

### search

search memory

#### Synopsis

search [-p | -t | -T] [-s START] [-e END | -l LENGTH] [-c | -w | -h] [-x CONTEXT] [-m IGNORE_MASK] [--drgn] value [value …]

#### Description

Display every memory address where one or more values are found.

#### Positional Arguments

value

  value to search for. Unless -c is given, then this is a hexadecimal integer, or a symbol name to use its address. If -c is given, then this is an arbitrary string

#### Options

-p

  search physical addresses

-t

  search only kernel stacks of all tasks

-T

  search only kernel stacks of active tasks

-s START

  start searching at this hexadecimal address or symbol name

-e END

  stop searching at this hexadecimal address or symbol name

-l LENGTH

  search this many bytes

-x CONTEXT

  display this many extra units of memory before and after every found value. Cannot be used with -c

-m IGNORE_MASK

  ignore bits set in this hexadecimal mask. Cannot be used with -c

--drgn

  print how to do the equivalent operation using drgn APIs

#### Units

What unit the values to search for are in. The default is unsigned long.

-c

  search for strings

-w

  search for unsigned ints

-h

  search for unsigned shorts

### set

set current context or configuration

#### Synopsis

set [pid | task | -p | -c CPU | option [value]] [--drgn]

#### Description

Set/show the default context used by commands that target a task, or set/show configuration.

If no options are given, then the current context is displayed.

If given a configuration option name and a value, then the option is set to that value. If given a configuration option name only, then the current value is shown. The following options and values are supported:

- `scroll on | off`: enable (the default) or disable scrolling of long output.

- `scroll less | more`: set the pager program. The default is `less`.

- `radix 10 | 16`: set the default integer output base. The default is 10.

#### Positional Arguments

pid

  set the current context to the task with the given decimal process ID

task

  set the current context to the task with the hexadecimal `task_struct` address

option

  option to get or set

value

  value to set option to

#### Options

-c CPU

  set the current context to the active task on the given CPU

-p

  set the current context to the task that crashed (for core dumps) or the drgn process itself (for live kernels)

--drgn

  print how to do the equivalent operation using drgn APIs

### sig

signal handling

#### Synopsis

sig [-g | -l | -s SIGSET] [--drgn] [pid|task …]

#### Positional Arguments

pid|task

  display signal handlers and pending signals for this task, given as either a decimal process ID or a hexadecimal `task_struct` address. May be given multiple times. Defaults to the current context

#### Options

-g

  display pending signals for all threads

-l

  display all known signal numbers and names

-s SIGSET

  translate a hexadecimal signal set into a list of signal names

--drgn

  print how to do the equivalent operation using drgn APIs

### struct

structure contents

#### Synopsis

struct [-l OFFSET] [-x] [-d] [-c COUNT] [--drgn] struct_name[.member[,member]] [address_or_symbol[:cpuspec]] [count]

#### Positional Arguments

struct_name[.member[,member]]

  name of structure type; one or more comma-separated members (each of which can be nested and include array subscripts) may also be given to limit the output to those members

address_or_symbol[:cpuspec]

  hexadecimal address or symbol name of structure. If not given, the type and its size are printed instead. For per-cpu variables, this may also contain a colon (‘:’) followed by a specification of which CPUs to print, which may be a comma-separated string of CPU numbers or ranges (e.g., ‘0,3-4’), ‘a’ or ‘all’ (meaning all possible CPUs), or an empty string (meaning the CPU of the current context)

count

  number of consecutive structures

#### Options

-l OFFSET

  offset from the beginning of the desired structure to the given address or symbol, either as a number of bytes or a struct_name.member

-x

  output integers in hexadecimal format regardless of the default

-d

  output integers in decimal format regardless of the default

-c COUNT

  number of consecutive structures

--drgn

  print how to do the equivalent operation using drgn APIs

### swap

list swap devices

#### Synopsis

swap [--drgn]

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

### sym

symbol table lookup

#### Synopsis

sym (-l | -q STRING | name|address [name|address …]) [-p] [-n] [--drgn]

#### Positional Arguments

name|address

  symbol name or hexadecimal address to search for. May be given multiple times

#### Options

-l

  display all symbols and their values

-q STRING

  display all symbols whose name contains STRING. May be given multiple times

-p

  display the target symbol and the previous symbol

-n

  display the target symbol and the next symbol

--drgn

  print how to do the equivalent operation using drgn APIs

### sys

system information

#### Synopsis

sys [--drgn] [config]

#### Positional Arguments

config

  print kernel configuration (requires `CONFIG_IKCONFIG`)

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

### task

task_struct and thread_info contents

#### Synopsis

task [-R member[,member]] [-x] [-d] [--drgn] [pid|task …]

#### Positional Arguments

pid|task

  display this task, given as either a decimal process ID or a hexadecimal `task_struct` address. May be given multiple times. Defaults to the current context

#### Options

-R member[,member]

  display only these `task_struct` members, given as a comma-separated list. Each member can be nested and include array subscripts. The -R is optional

-x

  output integers in hexadecimal format regardless of the default

-d

  output integers in decimal format regardless of the default

--drgn

  print how to do the equivalent operation using drgn APIs

### timer

list kernel timers

#### Synopsis

timer [-r] [-C CPU] [--drgn]

#### Options

-r

  display high-resolution timers (hrtimers)

-C CPU

  restrict the output to one or more CPUs, which may be a comma-separated string of CPU numbers or ranges (e.g., ‘0,3-4’)

--drgn

  print how to do the equivalent operation using drgn APIs

### tree

red-black tree, radix tree, XArray, or maple tree contents

#### Synopsis

tree [-t {rbtree,radix,xarray,maple}] [-r OFFSET] [-o OFFSET] [-s struct_name[.member[,member]]] [-l] [-x] [-d] [--drgn] start

#### Positional Arguments

start

  address or symbol name of the rb_root, radix_tree_root, xarray, or maple_tree (or the structure containing it if -r is used)

#### Options

-t {rbtree,radix,xarray,maple}

  type of tree. This may also be abbreviated: “rb” for “rbtree”, “ra” for “radix”, “x” for “xarray”, or “m” for “maple”. Defaults to rbtree

-r OFFSET

  treat start as the address of a structure containing the tree root at the given offset as either a number of bytes or a struct_name.member

-o OFFSET

  for red-black trees, the offset of the rb_node in its containing structure as either a number of bytes or a struct_name.member. Defaults to 0

-s struct_name[.member[,member]], -S struct_name[.member[,member]]

  type name of tree entries. May include one or more comma-separated members (each of which can be nested and include array subscripts) to limit the output to those members

-l

  for red-black trees, print entries in sorted order instead of the default pre-order traversal

-x

  output integers in hexadecimal format regardless of the default

-d

  output integers in decimal format regardless of the default

--drgn

  print how to do the equivalent operation using drgn APIs

### union

union contents

#### Synopsis

union [-l OFFSET] [-x] [-d] [-c COUNT] [--drgn] union_name[.member[,member]] [address_or_symbol[:cpuspec]] [count]

#### Positional Arguments

union_name[.member[,member]]

  name of union type; one or more comma-separated members (each of which can be nested and include array subscripts) may also be given to limit the output to those members

address_or_symbol[:cpuspec]

  hexadecimal address or symbol name of union. If not given, the type and its size are printed instead. For per-cpu variables, this may also contain a colon (‘:’) followed by a specification of which CPUs to print, which may be a comma-separated string of CPU numbers or ranges (e.g., ‘0,3-4’), ‘a’ or ‘all’ (meaning all possible CPUs), or an empty string (meaning the CPU of the current context)

count

  number of consecutive unions

#### Options

-l OFFSET

  offset from the beginning of the desired union to the given address or symbol, either as a number of bytes or a union_name.member

-x

  output integers in hexadecimal format regardless of the default

-d

  output integers in decimal format regardless of the default

-c COUNT

  number of consecutive unions

--drgn

  print how to do the equivalent operation using drgn APIs

### vm

virtual memory

#### Synopsis

vm [--drgn] [pid|task …]

#### Description

This command displays basic virtual memory information of a context, consisting of a pointer to its mm_struct and page directory, its RSS and total virtual memory size; and a list of pointers to each vm_area_struct, its starting and ending address, vm_flags value, and file pathname. If no arguments are entered, the current context is used.

#### Positional Arguments

pid|task

  one or more process PIDs or hexadecimal task_struct pointers

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

### vtop

virtual to physical address

#### Synopsis

vtop [-u | -k] [-c TASK] [--drgn] address [address …]

#### Positional Arguments

address

  hexadecimal virtual address

#### Options

-c TASK

  PID or hexadecimal task_struct pointer of task whose address space should be used for translating virtual addresses

--drgn

  print how to do the equivalent operation using drgn APIs

#### Address Space

In some kernel configurations, whether an address belongs to kernel space or user space can be determined from only its value. In those cases, this command will automatically determine whether the address belongs to kernel or user space.

In other configurations (including s390x, SPARC, and 4G:4G), this is not possible, and one of these options is required.

-u

  treat addresses as user space virtual addresses

-k

  treat addresses as kernel space virtual addresses

### waitq

list tasks on a wait queue

#### Synopsis

waitq (symbol | address | struct.member struct_addr) [--drgn]

#### Positional Arguments

symbol

  symbol name of wait queue

address

  hexadecimal address of wait queue

struct.member

  name of structure type containing a wait queue member with the given name

struct_addr

  address of structure containing wait queue member

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs

### whatis

search symbol table for data or type information

#### Synopsis

whatis [--drgn] name

#### Description

Displays the definition of structures, unions, typedefs or text/data symbols.

#### Positional Arguments

name

  struct/union/typedef/enum/type name or symbol name

#### Options

--drgn

  print how to do the equivalent operation using drgn APIs