Skip to content

Latest commit

 

History

History
A NOTE ON STRUCT ALIGNMENT AND PADDING
======================================

For performance reasons, the Go userspace accesses the ebpf ringbuffers
directly, allowing zero-copy access to the event data. As such, struct member
alignment and ordering play a key role on ensuring optimal memory reads from
the ring buffer data.

Packed structs are therefore discouraged. In addition to imposing a higher
cognitive load when it comes to alignment, they are not compatible with the
Go-side structs generated by bpf2go, which will always add padding. Only use
packed structures if you really know what you are doing.

On top of that, we've enabled explicit padding via `-Wpadded` to foster sane
layouts in our ebpf structs and optimal object size.