Displaying directory and file information from dentry structures (lsdentry)¶
The lsdentry program can be used to display directory and file information from the kernel's dentry tree. It can be used to display output similar to running "ls -l" or display fields from the dentry structures.
Options provided by 'lsdentry':
crash> lsdentry --help
usage: lsdentry [-h] [-R] [-l] [--params FIELDS] [-x] [--negative] [--partial] dentry
positional arguments:
dentry absolute file path or dentry address to "ls"
optional arguments:
-h, --help show this help message and exit
-R, --recursive List subdirectories
-l, --no-addr Show ls -l like output with no dentry address
--params FIELDS Show values of given fields in the dentrys
-x, --hex Display fields in hex
--negative show negative dentrys too
--partial Produce partial output with normally fatal errors
lsdentry requires a single parameter. This parameter may be a dentry address or may be an absolute path (i.e. must start with /) to use as the starting point for its data display. If the path or dentry is a directory, then the program will display any entries in the directory. The default output is patterned after the "ls -l" command with the addition of the dentry address as the first column.
crash> lsdentry /sys
ffff99f3c0578c00 dr-xr-xr-x 13 0 0 0 Dec 21 09:26 .
ffff99f3c05a6cc0 drwxr-xr-x 2 0 0 0 Dec 21 09:26 block
ffff99f3c0605c00 drwxr-xr-x 4 0 0 0 Dec 21 09:26 dev
ffff99f3c05ff780 drwxr-xr-x 42 0 0 0 Dec 21 09:26 bus
ffff99f3c05806c0 drwxr-xr-x 6 0 0 0 Dec 21 09:26 firmware
ffff99f3c057a900 drwxr-xr-x 209 0 0 0 Dec 21 09:26 module
ffff99f3c0579cc0 drwxr-xr-x 17 0 0 0 Dec 21 09:26 devices
ffff99f3c0579e40 drwxr-xr-x 72 0 0 0 Dec 21 09:26 class
ffff99f3c0578a80 drwxr-xr-x 9 0 0 0 Dec 21 09:26 fs
ffff99f3c0578d80 drwxr-xr-x 17 0 0 0 Dec 21 09:26 kernel
Recursive display (-R, --recursive)¶
The -R option works like the -R option to "ls" and will recursively walk and display the tree of directories under the start directory.
crash> lsdentry -R /run/log
Directory /run/log:
ffff99f3c0531540 drwxr-xr-x 3 0 0 60 Dec 21 09:26 .
ffff99f3c05ff6c0 drwxr-sr-x 2 0 190 40 Dec 21 09:26 journal
Directory /run/log/journal:
ffff99f3c05ff6c0 drwxr-sr-x 2 0 190 40 Dec 21 09:26 .
Mimic "ls -l" (-l, --no-addr)¶
The -l option removes the added column for the dentry address, displaying output that closely resembles output from "ls -l".
crash> lsdentry -l /sys
dr-xr-xr-x 13 0 0 0 Dec 21 09:26 .
drwxr-xr-x 2 0 0 0 Dec 21 09:26 block
drwxr-xr-x 4 0 0 0 Dec 21 09:26 dev
drwxr-xr-x 42 0 0 0 Dec 21 09:26 bus
drwxr-xr-x 6 0 0 0 Dec 21 09:26 firmware
drwxr-xr-x 209 0 0 0 Dec 21 09:26 module
drwxr-xr-x 17 0 0 0 Dec 21 09:26 devices
drwxr-xr-x 72 0 0 0 Dec 21 09:26 class
drwxr-xr-x 9 0 0 0 Dec 21 09:26 fs
drwxr-xr-x 17 0 0 0 Dec 21 09:26 kernel
Display dentry fields and parameters (--params)¶
The "--params" option can be used to alter the normal display information and instead walk and display the various fields of the displayed dentry.
crash> lsdentry --params d_flags /sys
ffff99f3c0578c00 dr-xr-xr-x 13 0 0 0 Dec 21 09:26 . d_flags: 2097152
ffff99f3c05a6cc0 drwxr-xr-x 2 0 0 0 Dec 21 09:26 block d_flags: 2097156
ffff99f3c0605c00 drwxr-xr-x 4 0 0 0 Dec 21 09:26 dev d_flags: 2097156
ffff99f3c05ff780 drwxr-xr-x 42 0 0 0 Dec 21 09:26 bus d_flags: 2097156
ffff99f3c05806c0 drwxr-xr-x 6 0 0 0 Dec 21 09:26 firmware d_flags: 2097156
ffff99f3c057a900 drwxr-xr-x 209 0 0 0 Dec 21 09:26 module d_flags: 2097156
ffff99f3c0579cc0 drwxr-xr-x 17 0 0 0 Dec 21 09:26 devices d_flags: 2097156
ffff99f3c0579e40 drwxr-xr-x 72 0 0 0 Dec 21 09:26 class d_flags: 2097156
ffff99f3c0578a80 drwxr-xr-x 9 0 0 0 Dec 21 09:26 fs d_flags: 2097156
ffff99f3c0578d80 drwxr-xr-x 17 0 0 0 Dec 21 09:26 kernel d_flags: 2097156
Force hexadecimal (-x, --hex)¶
The "-x" option, when used with the "--params" option, changes the default output format for the fields shown by "--params" to use hexadecimal values.
crash> lsdentry --params d_flags -x /sys
ffff99f3c0578c00 dr-xr-xr-x 13 0 0 0 Dec 21 09:26 . d_flags: 0x200000
ffff99f3c05a6cc0 drwxr-xr-x 2 0 0 0 Dec 21 09:26 block d_flags: 0x200004
ffff99f3c0605c00 drwxr-xr-x 4 0 0 0 Dec 21 09:26 dev d_flags: 0x200004
ffff99f3c05ff780 drwxr-xr-x 42 0 0 0 Dec 21 09:26 bus d_flags: 0x200004
ffff99f3c05806c0 drwxr-xr-x 6 0 0 0 Dec 21 09:26 firmware d_flags: 0x200004
ffff99f3c057a900 drwxr-xr-x 209 0 0 0 Dec 21 09:26 module d_flags: 0x200004
ffff99f3c0579cc0 drwxr-xr-x 17 0 0 0 Dec 21 09:26 devices d_flags: 0x200004
ffff99f3c0579e40 drwxr-xr-x 72 0 0 0 Dec 21 09:26 class d_flags: 0x200004
ffff99f3c0578a80 drwxr-xr-x 9 0 0 0 Dec 21 09:26 fs d_flags: 0x200004
ffff99f3c0578d80 drwxr-xr-x 17 0 0 0 Dec 21 09:26 kernel d_flags: 0x200004
Process negative dentrys (--negative)¶
With the "--negative" option, even negative dentrys (ones which have no inode) will be displayed instead of being ignored. As a negative dentry does not have most of the information normally shown by the default display information, its display is non-standard.
crash> lsdentry --negative /sys
ffff99f3c0578c00 dr-xr-xr-x 13 0 0 0 Dec 21 09:26 .
ffff99f3d9d7e3c0 ---negative-dentry--- 4:0:0:0
ffff99f3c05a6cc0 drwxr-xr-x 2 0 0 0 Dec 21 09:26 block
ffff99f3c0605c00 drwxr-xr-x 4 0 0 0 Dec 21 09:26 dev
ffff99f3c05ff780 drwxr-xr-x 42 0 0 0 Dec 21 09:26 bus
ffff99f3c05806c0 drwxr-xr-x 6 0 0 0 Dec 21 09:26 firmware
ffff99f3c057a900 drwxr-xr-x 209 0 0 0 Dec 21 09:26 module
ffff99f3c0579cc0 drwxr-xr-x 17 0 0 0 Dec 21 09:26 devices
ffff99f3c0579e40 drwxr-xr-x 72 0 0 0 Dec 21 09:26 class
ffff99f3c0578a80 drwxr-xr-x 9 0 0 0 Dec 21 09:26 fs
ffff99f3c0578d80 drwxr-xr-x 17 0 0 0 Dec 21 09:26 kernel
Partial output (--partial)¶
The "--partial" option can be used to try and continue displaying any data the program can find, even after encountering severe errors that would normally cause the program to quit. It does not alter the output format, only attempts to ignore errors instead of failing.