Dumping kernel data structures with BPF

Posted Apr 28, 2020 11:30 UTC (Tue) by Karellen (subscriber, #67644)
Parent article: Dumping kernel data structures with BPF

Arnaldo Carvalho de Melo suggested that an additional "z" option could suppress the printing of fields whose value is zero, making the output much more compact;

Looking at the example output, omitting leading zeros for non-zero values would also help with compactness.

I am slightly curious also - there are a bunch of hex values without a leading '0x', but also quite a lot of values with a leading '0x'. Notably, there are a few '=0' and '=0x0'. I wonder why some are one way, and some another?

Dumping kernel data structures with BPF

Posted Apr 28, 2020 13:17 UTC (Tue) by Paf (subscriber, #91811) [Link]

Looking at the field names, it looks to me like the full length ones are pointers, and the others are, well, not pointers. Or possibly empty pointers(?).

That’s an interesting choice, but seems sensible I guess. It might be really nice to have a version that optionally printed type info - basically type size and whatever else. For the cases where you’re not quite sure what got compiled in to your running kernel.