Brussels / 31 January & 1 February 2015


Pretty-printing kernel data structures

Reusing D-Trace technology in unexpected places

Compact C Type Format (CTF) is a technology created during development of the D-Trace software to describe the C data types. With its second version it evolved into a fully expressive, yet space-wise efficient format that can be used outside of the D-Trace suite too. Compiling the FreeBSD kernel with the CDDL/CTF option triggers the creation of such CTF data that corresponds to the respective kernel objects. This dataset can be parsed and processed to become a source of information needed to pretty print all kernel data structures inside the on-line kernel debugger DDB.

In order to use the CTF technology a new implementation of the format had to be developed - truly multiplatform, freely licensed and supporting different endians. The project had to tackle many difficult problems such as transport of the CTF data to the kernel debugger, which itself is a very limited space. Pretty-printing recursive data structures can be very tricky, as they are implemented as nested struct pointers and the interpretation can lead into unmanageable indentation issues. The solution is to detect certain common types of data structures - lists, queues and trees - and adapt to such structures on a higher level of abstraction.

Apart from the DDB application, CTF data can be used inside user-space debuggers too. As a result of the slim binary design of the format storage, each binary in the whole system, even a production one, can contain the CTF data. To achieve even further minimisation of the space used, a concept of multilevel parent-child relationships was introduced, in which the parent contains the types used in both parent and child and its own, whereas the child has only its unique ones and references the parent set.

This talk is interesting outside of the BSD community too: since the libctf implementation is multiplatform and supports the Debian and OpenIndiana distributions, such pretty-printing functionality could be ported. The CTF toolset - ctfconvert, ctfmerge and ctfdump - is multiplatform as well. Thanks to the free BSD license, the inclusion of such library should not pose a legal problem. Some parts of the project are still work in progress and therefore the community support is much appreciated.


Daniel Lovasko