Arrays are known in the core as AVs. Their structure can be found in av.h:

struct xpvav {
    char*   xav_array;  /* pointer to first array element */
    SSize_t xav_fill;   /* Index of last element present */
    SSize_t xav_max;    /* max index for which array has space */
    IV      xof_off;    /* ptr is incremented by offset */
    NV      xnv_nv;     /* numeric value, if any */
    MAGIC*  xmg_magic;  /* magic for scalar array */
    HV*     xmg_stash;  /* class package */
    SV**    xav_alloc;  /* pointer to malloced string */
    SV*     xav_arylen;
    U8      xav_flags;
};

We're going to skip over xmg_magic and xmg_stash for now, and come back to them in [#var.complex the section called “More Complex Types”].

Let's use Devel::Peek as before to examine the AV, but we must remember that we can only give one argument to Devel::Peek::Dump; hence, we must pass it a reference to the AV:

% perl -MDevel::Peek -e '@a=(1,2,3); Dump(\@a)'
SV = RV(0x8106ce8) at 0x80fb380      
  REFCNT = 1
  FLAGS = (TEMP,ROK)
  RV = 0x8105824
  SV = PVAV(0x8106cb4) at 0x8105824  
    REFCNT = 2
    FLAGS = ()
    IV = 0
    NV = 0
    ARRAY = 0x80f7de8                
    FILL = 2                         
    MAX = 3                          
    ARYLEN = 0x0                     
    FLAGS = (REAL)                   
    Elt No. 0
    SV = IV(0x80fc1f4) at 0x80f1460  
      REFCNT = 1
      FLAGS = (IOK,pIOK,IsUV)
      UV = 1
    Elt No. 1
    SV = IV(0x80fc1f8) at 0x80f1574
      REFCNT = 1
      FLAGS = (IOK,pIOK,IsUV)
      UV = 2
    Elt No. 2
    SV = IV(0x80fc1fc) at 0x80f1370
      REFCNT = 1
      FLAGS = (IOK,pIOK,IsUV)
      UV = 3

Hashes are represented in the core as, you guessed it, HVs. Before we look at how this is implemented, we'll first see what a hash actually is...

    register const char *s_PeRlHaSh = str;
    register I32 i_PeRlHaSh = len;
    register U32 hash_PeRlHaSh = 0;
    while (i_PeRlHaSh--) {
        hash_PeRlHaSh += *s_PeRlHaSh++;
        hash_PeRlHaSh += (hash_PeRlHaSh << 10);
        hash_PeRlHaSh ^= (hash_PeRlHaSh >> 6);
    }
    hash_PeRlHaSh += (hash_PeRlHaSh << 3);
    hash_PeRlHaSh ^= (hash_PeRlHaSh >> 11);
    (hash) = (hash_PeRlHaSh += (hash_PeRlHaSh << 15));

    sub hash {
        my $string = shift;
        my $hash;
        for (map {ord $_} split //, $string) {
             $hash += $_; $hash += $hash << 10; $hash ^= $hash >> 6;
        }
        $hash += $hash << 3; $hash ^= $hash >> 1;
        return ($hash + $hash << 15);
    }

    push @{$hash->[hash("red") % 8]},
        { key   => "red",
          value => "rouge",
          hash  => hash("red")
        };

/* entry in hash value chain */
struct he {
    HE      *hent_next; /* next entry in chain */
    HEK     *hent_hek;  /* hash key */
    SV      *hent_val;  /* scalar value that was hashed */
};

/* hash key -- defined separately for use as shared pointer */
struct hek {
    U32     hek_hash;   /* hash of key */
    I32     hek_len;    /* length of hash key */
    char    hek_key[1]; /* variable-length hash key */
};

% perl -MDevel::Peek -e '%a = (red => "rouge", blue => "bleu"); Dump(\%a);'
SV = RV(0x8106c80) at 0x80f1370
  REFCNT = 1
  FLAGS = (TEMP,ROK)
  RV = 0x81057a0
  SV = PVHV(0x8108328) at 0x81057a0
    REFCNT = 2
    FLAGS = (SHAREKEYS)
    IV = 2
    NV = 0
    ARRAY = 0x80f7748  (0:6, 1:2)
    hash quality = 150.0%
    KEYS = 2
    FILL = 2
    MAX = 7
    RITER = -1
    EITER = 0x0
    Elt "blue" HASH = 0x8a5573ea
    SV = PV(0x80f17b0) at 0x80f1574
      REFCNT = 1
      FLAGS = (POK,pPOK)
      PV = 0x80f5288 "bleu"\0
      CUR = 4
      LEN = 5
    Elt "red" HASH = 0x201ed
    SV = PV(0x80f172c) at 0x80f1460
      REFCNT = 1
      FLAGS = (POK,pPOK)
      PV = 0x80ff370 "rouge"\0
      CUR = 5
      LEN = 6

Objects are represented relatively simply. As we know from ordinary Perl programming, an object is a reference to some data which happens to know which package it's in. In the definitions of AVs and HVs above, we saw the line

    HV*     xmg_stash;  /* class package */

As we'll see in [#var.stash the section called “Globs and Stashes”], packages are known as "stashes" internally and are represented by hashes. The xmg_stash field in AVs and HVs is used to store a pointer to the stash which "owns" the value.

Hence, in the case of an object which is an array reference, the dump looks like this:

% perl -MDevel::Peek -e '$a=bless [1,2]; Dump($a)'
SV = RV(0x81586d4) at 0x815b7a0
  REFCNT = 1
  FLAGS = (ROK)
  RV = 0x8151b0c
  SV = PVAV(0x8153074) at 0x8151b0c
    REFCNT = 1
    FLAGS = (OBJECT)
    IV = 0
    NV = 0
    STASH = 0x8151a34	"main"
    ARRAY = 0x815fcf8
    FILL = 1
    MAX = 1
    ARYLEN = 0x0
    FLAGS = (REAL)
    Elt No. 0
    SV = IV(0x815833c) at 0x8151bc0
      REFCNT = 1
      FLAGS = (IOK,pIOK)
      IV = 1
    Elt No. 1
    SV = IV(0x8158340) at 0x8151c44
      REFCNT = 1
      FLAGS = (IOK,pIOK)
      IV = 2

This works for AVs and HVs which have a STASH field, but what about ordinary scalars? There is an additional, more complex type of scalar, which can hold both stash information and also permits us to hang additional, miscellaneous information onto the SV. This miscellaneous information is called "magic", (partially because it allows for clever things to happen, and partially because nobody really knows how it works) and the complex SV structure is a PVMG. We can create a PVMG by blessing a scalar reference:

% perl -MDevel::Peek -le '$b="hi";$a=bless \$b, main; print Dump($a)'
SV = RV(0x8106ca4) at 0x810586c
  REFCNT = 1
  FLAGS = (ROK)
  RV = 0x81058c0
  SV = PVMG(0x810e628) at 0x81058c0
    REFCNT = 2
    FLAGS = (OBJECT,POK,pPOK)
    IV = 0
    NV = 0
    PV = 0x80ff698 "hi"\0
    CUR = 2
    LEN = 3
    STASH = 0x80f1388	"main"

As you can see, this is similar to the PVNV structure we saw in [#var.pvnv the section called “Floating point numbers”], with the addition of the STASH field. There's also another field, which we can see if we look at the definition of xpvmg:

struct xpvmg {
    char *  xpv_pv;     /* pointer to malloced string */
    STRLEN  xpv_cur;    /* length of xpv_pv as a C string */
    STRLEN  xpv_len;    /* allocated size */
    IV      xiv_iv;     /* integer value or pv offset */
    NV      xnv_nv;     /* numeric value, if any */
    MAGIC*  xmg_magic;  /* linked list of magicalness */
    HV*     xmg_stash;  /* class package */
};

The xmg_magic field provides us with somewhere to put a magic structure. What's a magic structure, then? For this, we need to look in mg.h:

struct magic {
    MAGIC*  mg_moremagic;
    MGVTBL* mg_virtual; /* pointer to magic functions */
    U16     mg_private;
    char    mg_type;
    U8      mg_flags;
    SV*     mg_obj;
    char*   mg_ptr;
    I32     mg_len;
};

What happens when the value of an SV with magic is retrieved? Firstly, a function should call SvGETMAGIC(sv) to cause any magic to be performed. This in turn calls mg_get which walks over the linked list of magic. For each piece of magic, it looks in the magic virtual table, and calls the magical "get" function if there is one.

Let's assume that we're dealing with one of Perl's special variables, which has only one piece of magic, "\0" magic. The appropriate magic virtual table for "\0" magic is PL_vtbl_sv, which is defined as follows: (in perl.h)

EXT MGVTBL PL_vtbl_sv = {MEMBER_TO_FPTR(Perl_magic_get),
                         MEMBER_TO_FPTR(Perl_magic_set),
                         MEMBER_TO_FPTR(Perl_magic_len),
                         0,      0};

Magic virtual tables have five elements, as seen in mg.h:

struct mgvtbl {
    int     (CPERLscope(*svt_get))  (pTHX_ SV *sv, MAGIC* mg);
    int     (CPERLscope(*svt_set))  (pTHX_ SV *sv, MAGIC* mg);
    U32     (CPERLscope(*svt_len))  (pTHX_ SV *sv, MAGIC* mg);
    int     (CPERLscope(*svt_clear))(pTHX_ SV *sv, MAGIC* mg);
    int     (CPERLscope(*svt_free)) (pTHX_ SV *sv, MAGIC* mg);
};

So the above virtual table means "call Perl_magic_set when we want to get the value of this SV; call Perl_magic_set when we want to set it; call Perl_magic_len when we want to find its length; do nothing if we want to clear it or when it is freed from memory."

In this case, we are getting the value, so magic_get is called. ^{#ftn.id2482392 1} This function looks at the value of mg_ptr, which, as noted above, is often the name of the variable. Depending on the name of the variable, it determines what to do: for instance, if mg_ptr is "!", then the current value of the C variable errno is retrieved.

A similar process is performed by SvSETMAGIC(sv) to call functions that need to be called when the value of an SV changes.

Tied arrays and hashes are implementing by adding type "P" magic to their AVs and HVs; individual elements of the arrays and hashes have "p" magic. Tied scalars and filehandles have type "q" magic. The virtual tables for, for instance, "p" magic scalars look like this:

EXT MGVTBL PL_vtbl_packelem =   {MEMBER_TO_FPTR(Perl_magic_getpack),
                                 MEMBER_TO_FPTR(Perl_magic_setpack),
                                 0,
                                 MEMBER_TO_FPTR(Perl_magic_clearpack),
                                 0}

That's to say, the function magic_getpack is called when the value of an element of a tied array or hash is retrieved. This function in turn performs a FETCH method call on the object stored in mg_obj.

We can invent our own "pseudo-tied" variables, using the user-defined "U" magic. "U" magic only works on scalars, and allows us to call a function when the value of the scalar is got or set. The virtual table for "U" magic scalars is as follows:

EXT MGVTBL PL_vtbl_uvar =   {MEMBER_TO_FPTR(Perl_magic_getuvar),
                             MEMBER_TO_FPTR(Perl_magic_setuvar),
                             0,  0,  0};

As you should by now expect, these functions are called when the value of the scalar is accessed. They in turn call our user-defined functions. But how do we tell them what our functions are? In this case, we pass a pointer to a special structure in the mg_ptr field; the structure is defined in perl.h, and looks like this:

struct ufuncs {
    I32 (*uf_val)(IV, SV*);
    I32 (*uf_set)(IV, SV*);
    IV uf_index;
};

Here are our two function pointers: uf_val is called with the value of uf_index and the scalar when the value is sought, and uf_set is called with the same parameters when it is set.

Hence, the following code allows us to emulate $!:

I32 get_errno(IV index, SV* sv) {
    sv_setiv(sv, errno);
}

I32 set_errno(IV index, SV* sv) {
    errno = SvIV(sv); /* Some Cs don't like us setting errno, but hey */
}

struct ufuncs uf;

/* This is XS code */

void
magicify(sv)
    SV *sv;
CODE:
    uf.uf_val = &get_errno;
    uf.uf_set = &set_errno;
    uf.uf_index = 0;
    sv_magic(sv, 0, 'U', (char*)&uf, sizeof(uf));

If you need any more flexibility than that, it's time to look into "~" magic.

SVs that represent variables are kept in the symbol table; as you'll know from your Perl programming, the symbol table starts at %main:: and is an ordinary Perl hash, with the package and variable names as hash keys. But what are the hash values? Let's have a look:

% perl -le '$a=5; print ${main::}{a}'
 *main::a

Well, that doesn't tell us very much - at first sight it just looks like an ordinary string. But if we use Devel::Peek on it, we find it's actually something else - a glob, or GV:

% perl -MDevel::Peek -e '$a=5; Dump ${main::}{a}'
SV = PVGV(0x80fe3e0) at 0x80fb3ec
  REFCNT = 2
  FLAGS = (GMG,SMG)
  IV = 0
  NV = 0
  MAGIC = 0x80fea50
    MG_VIRTUAL = &PL_vtbl_glob
    MG_TYPE = '*'
    MG_OBJ = 0x80fb3ec
    MG_LEN = 1
    MG_PTR = 0x81081d8 "a"
  NAME = "a"
  NAMELEN = 1
  GvSTASH = 0x80f1388	"main"
  GP = 0x80ff2b0
    SV = 0x810592c
    REFCNT = 1
    IO = 0x0
    FORM = 0x0
    AV = 0x0
    HV = 0x0
    CV = 0x0
    CVGEN = 0x0
    GPFLAGS = 0x0
    LINE = 1
    FILE = "-e"
    FLAGS = 0x0
    EGV = 0x80fb3ec	"a"

Symbol tables are considered some of the hairiest voodoo in the Perl internals. <advanced>

From C, the variable PL_defstash is the HV representing the main:: stash; PL_curstash contains the current package's stash.

The final data type we will examine is the CV, a code value used for storing subroutines. Both Perl and XSUB subroutines are stored in CVs, and blocks are also stored in CVs. The CV structure can be found in cv.h:

struct xpvcv {
     char *  xpv_pv;     /* pointer to malloced string */
     STRLEN  xpv_cur;    /* length of xp_pv as a C string */
     STRLEN  xpv_len;    /* allocated size */
     IV      xof_off;    /* integer value */
     NV      xnv_nv;     /* numeric value, if any */
     MAGIC*  xmg_magic;  /* magic for scalar array */
     HV*     xmg_stash;  /* class package */
 
     HV *    xcv_stash;
     OP *    xcv_start;
     OP *    xcv_root;
     void    (*xcv_xsub) (pTHXo_ CV*);
     ANY     xcv_xsubany;
     GV *    xcv_gv;
     char *  xcv_file;
     long    xcv_depth;  /* >= 2 indicates recursive call */
     AV *    xcv_padlist;
     CV *    xcv_outside;
 #ifdef USE_THREADS
     perl_mutex *xcv_mutexp;
     struct perl_thread *xcv_owner;  /* current owner thread */
 #endif /* USE_THREADS */
     cv_flags_t  xcv_flags;
 }

package First;
sub Second::mysub { ...}

package One;
$x = "In One";
package Two;
$x = "In Two";
sub One::test { print $x }
package main;
One::test();

{
   my $x = 0;
   sub counter { return ++$x; }
}

Global variables live, as we've seen, in symbol tables or "stashes". Lexical variables, on the other hand, are tied to blocks rather than packages, and so are stored inside the CV representing their enclosing block.

As mentioned briefly above, the xcv_padlist element holds a pointer to an AV. This array, the padlist, contains the names and values of lexicals in the current code block. Again, a diagram is the best way to demonstrate this:

The first element of the padlist - called the "padname" - is an array containing the names of the variables, and the other elements are lists of the current values of those variables. Why do we have several lists of current values? Because a CV may be entered several times - for instance, when a subroutine recurses. Having, essentially, a stack of frames ensures that we can restore the previous values when a recursive call ends. Hence, the current values of lexical variables are stored in the last element on the padlist.

<advanced>

From inside perl, you can get at the current pad as PL_curpad. Note that this is the pad itself, not the padlist. To get the padlist, you need to perform some awkwardness:

I32 cxix    = dopoptosub(cxstack_ix) /* cxstack_ix is a macro */
AV* padlist = cxix ? CvPADLIST(cxstadck[ix].blk_sub.cv) : PL_comppadlist;