Dumping kernel data structures with BPF
Dumping kernel data structures with BPF
Posted Apr 28, 2020 13:17 UTC (Tue) by Paf (subscriber, #91811)In reply to: Dumping kernel data structures with BPF by Karellen
Parent article: Dumping kernel data structures with BPF
Looking at the field names, it looks to me like the full length ones are pointers, and the others are, well, not pointers. Or possibly empty pointers(?).
That’s an interesting choice, but seems sensible I guess. It might be really nice to have a version that optionally printed type info - basically type size and whatever else. For the cases where you’re not quite sure what got compiled in to your running kernel.
