{"id":19327544,"url":"https://github.com/deepflowio/show-kernel-struct-offset","last_synced_at":"2026-02-14T14:04:38.569Z","repository":{"id":161455558,"uuid":"613652601","full_name":"deepflowio/show-kernel-struct-offset","owner":"deepflowio","description":null,"archived":false,"fork":false,"pushed_at":"2024-11-19T06:05:02.000Z","size":6,"stargazers_count":0,"open_issues_count":0,"forks_count":3,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-09-02T18:46:57.952Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/deepflowio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-03-14T01:58:23.000Z","updated_at":"2024-11-19T06:05:07.000Z","dependencies_parsed_at":"2024-05-08T17:16:34.690Z","dependency_job_id":"987e6184-66f1-4599-99af-028b44889010","html_url":"https://github.com/deepflowio/show-kernel-struct-offset","commit_stats":null,"previous_names":["deepflowio/show-kernel-struct-offset"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/deepflowio/show-kernel-struct-offset","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepflowio%2Fshow-kernel-struct-offset","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepflowio%2Fshow-kernel-struct-offset/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepflowio%2Fshow-kernel-struct-offset/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepflowio%2Fshow-kernel-struct-offset/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/deepflowio","download_url":"https://codeload.github.com/deepflowio/show-kernel-struct-offset/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepflowio%2Fshow-kernel-struct-offset/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29446346,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-14T12:43:28.304Z","status":"ssl_error","status_checked_at":"2026-02-14T12:43:14.160Z","response_time":53,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-10T02:17:33.311Z","updated_at":"2026-02-14T14:04:38.563Z","avatar_url":"https://github.com/deepflowio.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Show Kernel Struct Offset\n\n用于提取 Linux 内核结构体成员偏移的小工具。\n\nDeepFlow 依赖这些偏移，以支持多版本内核的兼容和正确运行。\n\n## 依赖环境\n\n请确保系统已安装以下工具和包：\n\n- gcc\n- make\n- objdump\n- 当前运行内核对应的内核头文件（kernel-devel）\n- 内核调试符号包（kernel-debuginfo），包含 `vmlinux`\n\n## 编译方法\n\n```bash\nmake\n```\n会得到如下内容：\n\n```bash\nmake -C /lib/modules/4.19.17-1.el7.x86_64/build M=/home/jiping/struct-member/show-kernel-struct-offset modules\nmake[1]: 进入目录“/usr/src/kernels/4.19.17-1.el7.x86_64”\n  CC [M]  /home/jiping/struct-member/show-kernel-struct-offset/skso.o\n  Building modules, stage 2.\n  MODPOST 1 modules\n  CC      /home/jiping/struct-member/show-kernel-struct-offset/skso.mod.o\n  LD [M]  /home/jiping/struct-member/show-kernel-struct-offset/skso.ko\nmake[1]: 离开目录“/usr/src/kernels/4.19.17-1.el7.x86_64”\nobjdump -d skso.ko\n\nskso.ko：     文件格式 elf64-x86-64\n\n\nDisassembly of section .text:\n\n0000000000000000 \u003cstruct_tcp_sock__copied_seq_offset\u003e:\n   0:   e8 00 00 00 00          callq  5 \u003cstruct_tcp_sock__copied_seq_offset+0x5\u003e\n   5:   b8 3c 05 00 00          mov    $0x53c,%eax\n   a:   c3                      retq   \n   b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000010 \u003cstruct_tcp_sock__write_seq_offset\u003e:\n  10:   e8 00 00 00 00          callq  15 \u003cstruct_tcp_sock__write_seq_offset+0x5\u003e\n  15:   b8 ac 06 00 00          mov    $0x6ac,%eax\n  1a:   c3                      retq   \n  1b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000020 \u003cstruct_tcp_sock__snd_nxt_offset\u003e:\n  20:   e8 00 00 00 00          callq  25 \u003cstruct_tcp_sock__snd_nxt_offset+0x5\u003e\n  25:   b8 44 05 00 00          mov    $0x544,%eax\n  2a:   c3                      retq   \n  2b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000030 \u003cstruct_task_struct__files_offset\u003e:\n  30:   e8 00 00 00 00          callq  35 \u003cstruct_task_struct__files_offset+0x5\u003e\n  35:   b8 c8 0a 00 00          mov    $0xac8,%eax\n  3a:   c3                      retq   \n  3b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000040 \u003cstruct_sock____sk_flags_offset_offset\u003e:\n  40:   e8 00 00 00 00          callq  45 \u003cstruct_sock____sk_flags_offset_offset+0x5\u003e\n  45:   b8 f8 01 00 00          mov    $0x1f8,%eax\n  4a:   c3                      retq   \n  4b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000050 \u003cstruct_files_struct_fdt_offset\u003e:\n  50:   e8 00 00 00 00          callq  55 \u003cstruct_files_struct_fdt_offset+0x5\u003e\n  55:   b8 20 00 00 00          mov    $0x20,%eax\n  5a:   c3                      retq   \n  5b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000060 \u003cSTRUCT_FILES_PRIVATE_DATA_OFFSET\u003e:\n  60:   e8 00 00 00 00          callq  65 \u003cSTRUCT_FILES_PRIVATE_DATA_OFFSET+0x5\u003e\n  65:   b8 c8 00 00 00          mov    $0xc8,%eax\n  6a:   c3                      retq   \n  6b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000070 \u003cstruct_file_f_op_offset\u003e:\n  70:   e8 00 00 00 00          callq  75 \u003cstruct_file_f_op_offset+0x5\u003e\n  75:   b8 28 00 00 00          mov    $0x28,%eax\n  7a:   c3                      retq   \n  7b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000080 \u003cstruct_file_operations_read_iter_offset\u003e:\n  80:   e8 00 00 00 00          callq  85 \u003cstruct_file_operations_read_iter_offset+0x5\u003e\n  85:   b8 20 00 00 00          mov    $0x20,%eax\n  8a:   c3                      retq   \n  8b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000090 \u003cstruct_file__f_inode_offset\u003e:\n  90:   e8 00 00 00 00          callq  95 \u003cstruct_file__f_inode_offset+0x5\u003e\n  95:   b8 20 00 00 00          mov    $0x20,%eax\n  9a:   c3                      retq   \n  9b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n00000000000000a0 \u003cstruct_file_f_pos_offset\u003e:\n  a0:   e8 00 00 00 00          callq  a5 \u003cstruct_file_f_pos_offset+0x5\u003e\n  a5:   b8 68 00 00 00          mov    $0x68,%eax\n  aa:   c3                      retq   \n  ab:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n00000000000000b0 \u003cstruct_inode__i_mode_offset\u003e:\n  b0:   e8 00 00 00 00          callq  b5 \u003cstruct_inode__i_mode_offset+0x5\u003e\n  b5:   31 c0                   xor    %eax,%eax\n  b7:   c3                      retq   \n  b8:   0f 1f 84 00 00 00 00    nopl   0x0(%rax,%rax,1)\n  bf:   00 \n\n00000000000000c0 \u003cstruct_inode_i_sb_offset\u003e:\n  c0:   e8 00 00 00 00          callq  c5 \u003cstruct_inode_i_sb_offset+0x5\u003e\n  c5:   b8 28 00 00 00          mov    $0x28,%eax\n  ca:   c3                      retq   \n  cb:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n00000000000000d0 \u003cstruct_super_block_s_dev_offset\u003e:\n  d0:   e8 00 00 00 00          callq  d5 \u003cstruct_super_block_s_dev_offset+0x5\u003e\n  d5:   b8 10 00 00 00          mov    $0x10,%eax\n  da:   c3                      retq   \n  db:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n00000000000000e0 \u003cstruct_file__dentry__sum_offset\u003e:\n  e0:   e8 00 00 00 00          callq  e5 \u003cstruct_file__dentry__sum_offset+0x5\u003e\n  e5:   b8 18 00 00 00          mov    $0x18,%eax\n  ea:   c3                      retq   \n  eb:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n00000000000000f0 \u003cstruct_dentry_name__sum__offset\u003e:\n  f0:   e8 00 00 00 00          callq  f5 \u003cstruct_dentry_name__sum__offset+0x5\u003e\n  f5:   b8 28 00 00 00          mov    $0x28,%eax\n  fa:   c3                      retq   \n  fb:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000100 \u003cstruct_dentry__d_parent__offset\u003e:\n 100:   e8 00 00 00 00          callq  105 \u003cstruct_dentry__d_parent__offset+0x5\u003e\n 105:   b8 18 00 00 00          mov    $0x18,%eax\n 10a:   c3                      retq   \n 10b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000110 \u003cstruct_sock_common__skc_family_offset\u003e:\n 110:   e8 00 00 00 00          callq  115 \u003cstruct_sock_common__skc_family_offset+0x5\u003e\n 115:   b8 10 00 00 00          mov    $0x10,%eax\n 11a:   c3                      retq   \n 11b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000120 \u003cstruct_sock_common__skc_rcv_saddr_offset\u003e:\n 120:   e8 00 00 00 00          callq  125 \u003cstruct_sock_common__skc_rcv_saddr_offset+0x5\u003e\n 125:   b8 04 00 00 00          mov    $0x4,%eax\n 12a:   c3                      retq   \n 12b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000130 \u003cstruct_sock_common__skc_daddr_offset\u003e:\n 130:   e8 00 00 00 00          callq  135 \u003cstruct_sock_common__skc_daddr_offset+0x5\u003e\n 135:   31 c0                   xor    %eax,%eax\n 137:   c3                      retq   \n 138:   0f 1f 84 00 00 00 00    nopl   0x0(%rax,%rax,1)\n 13f:   00 \n\n0000000000000140 \u003cstruct_sock_common__skc_v6_rcv_saddr_offset\u003e:\n 140:   e8 00 00 00 00          callq  145 \u003cstruct_sock_common__skc_v6_rcv_saddr_offset+0x5\u003e\n 145:   b8 48 00 00 00          mov    $0x48,%eax\n 14a:   c3                      retq   \n 14b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000150 \u003cstruct_sock_common__skc_v6_daddr_offset\u003e:\n 150:   e8 00 00 00 00          callq  155 \u003cstruct_sock_common__skc_v6_daddr_offset+0x5\u003e\n 155:   b8 38 00 00 00          mov    $0x38,%eax\n 15a:   c3                      retq   \n 15b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000160 \u003cstruct_sock_common__skc_dport_offset\u003e:\n 160:   e8 00 00 00 00          callq  165 \u003cstruct_sock_common__skc_dport_offset+0x5\u003e\n 165:   b8 0c 00 00 00          mov    $0xc,%eax\n 16a:   c3                      retq   \n 16b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000170 \u003cstruct_sock_common__skc_num_offset\u003e:\n 170:   e8 00 00 00 00          callq  175 \u003cstruct_sock_common__skc_num_offset+0x5\u003e\n 175:   b8 0e 00 00 00          mov    $0xe,%eax\n 17a:   c3                      retq   \n 17b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000180 \u003cstruct_sock_common__skc_state_offset\u003e:\n 180:   e8 00 00 00 00          callq  185 \u003cstruct_sock_common__skc_state_offset+0x5\u003e\n 185:   b8 12 00 00 00          mov    $0x12,%eax\n 18a:   c3                      retq   \n 18b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n0000000000000190 \u003cstruct_sock_common__skc_ipv6only_offset\u003e:\n 190:   e8 00 00 00 00          callq  195 \u003cstruct_sock_common__skc_ipv6only_offset+0x5\u003e\n 195:   b8 13 00 00 00          mov    $0x13,%eax\n 19a:   c3                      retq   \n 19b:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n00000000000001a0 \u003cstruct_file_f_path_offset\u003e:\n 1a0:   e8 00 00 00 00          callq  1a5 \u003cstruct_file_f_path_offset+0x5\u003e\n 1a5:   b8 10 00 00 00          mov    $0x10,%eax\n 1aa:   c3                      retq   \n 1ab:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n00000000000001b0 \u003cstruct_path_mnt_offset\u003e:\n 1b0:   e8 00 00 00 00          callq  1b5 \u003cstruct_path_mnt_offset+0x5\u003e\n 1b5:   31 c0                   xor    %eax,%eax\n 1b7:   c3                      retq   \n 1b8:   0f 1f 84 00 00 00 00    nopl   0x0(%rax,%rax,1)\n 1bf:   00 \n\n00000000000001c0 \u003cstruct_ns_common_inum_offset\u003e:\n 1c0:   e8 00 00 00 00          callq  1c5 \u003cstruct_ns_common_inum_offset+0x5\u003e\n 1c5:   b8 10 00 00 00          mov    $0x10,%eax\n 1ca:   c3                      retq   \n 1cb:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)\n\n00000000000001d0 \u003cinit_module\u003e:\n 1d0:   e8 00 00 00 00          callq  1d5 \u003cinit_module+0x5\u003e\n 1d5:   31 c0                   xor    %eax,%eax\n 1d7:   c3                      retq   \n 1d8:   0f 1f 84 00 00 00 00    nopl   0x0(%rax,%rax,1)\n 1df:   00 \n\n00000000000001e0 \u003ccleanup_module\u003e:\n 1e0:   e8 00 00 00 00          callq  1e5 \u003ccleanup_module+0x5\u003e\n 1e5:   c3                      retq  \n```\n\n## 注意\n\n内核结构体 `struct mount` 和 `struct mnt_namespace` 定义在：`linux/source/fs/mount.h`\n\n\n但此文件通常不包含在 `kernel-devel` 包中，导致无法直接通过头文件获取结构体成员偏移。\n\n## 解决方案\n\n利用 `kernel-debuginfo` 包中的 `vmlinux` 文件和 `pahole` 工具，通过 DWARF 调试信息提取结构体成员的偏移。\n\n## 示例\n\n以 CentOS / RHEL 7，内核版本 4.19.17 为例，使用如下命令：\n\n```c\npahole -C mount /usr/lib/debug/lib/modules/4.19.17-1.el7.x86_64/vmlinux\nstruct mount {\n    ...\n    struct vfsmount            mnt;        /*    32    24 */\n    ...\n    struct mnt_namespace *     mnt_ns;     /*   224     8 */\n    ...\n    int                        mnt_id;     /*   284     4 */\n};\npahole -C mnt_namespace /usr/lib/debug/lib/modules/4.19.17-1.el7.x86_64/vmlinux\nstruct mnt_namespace {\n    ...\n    struct ns_common           ns;         /*     8    24 */\n    ...\n};\n```\n通过上面的方式得到 mnt、mnt_ns、mnt_id、ns 的偏移。\n\n## 如果遇到问题\n\n如果遇到问题或你的系统还未支持，请新建 issue，运行 `make` 并将完整输出和 `pahole` 得到的偏移值粘贴到 issue 中。\n提交地址：\nhttps://github.com/deepflowio/deepflow/issues\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeepflowio%2Fshow-kernel-struct-offset","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdeepflowio%2Fshow-kernel-struct-offset","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeepflowio%2Fshow-kernel-struct-offset/lists"}