[DTrace-devel] [PATCH] Implementation of the exit() action

[Eugene Loh]

On 04/08/2020 09:51 PM, Kris Van Hees wrote:

> On Wed, Apr 08, 2020 at 08:10:02PM -0700, Eugene Loh wrote:
>> Also, and I need to think about this more, I think "alignment" means
>> something different for the BPF code writing the perf buffer and the
>> user code reading it.  Off the top of my head, I think the issue was
>> that for PERF_SAMPLE_RAW, we get a perf_event_header (8 bytes), then u32
>> size, then data.  Since the header is on 8-byte alignment in userspace,
>> the data is 4-byte aligned.  So what's 4-byte aligned when BPF writes
>> the perf buffer is 8-byte aligned when read in userspace and
>> vice-versa.  So those pesky 1- and 2-byte alignments can be cleaned up
>> with confidence.  The 8-byte alignments... depends on whether you want
>> that alignment on the write or on the read end.
> THe way the code is laid out, we effectively put in a 4-byte filler (all 0s)
> after the size, which means that the EPID will appear on an 8-byte boundary
> on the reading side.  The EPID is 4 bytes, and it is followed by a tag (which
> is currently 0) of 4 bytes, so the first data item will also be (on the
> reading side) at an 8-byte boundary.
>
> The way this is done is by storing the 4-byte gap at the beginning of our
> output data buffer, and adjusting the base pointer for the data record pat
> this gap.  Then we start writing the EPID etc.  When we are done with the
> probe processing, we call bpf_perf_event_output() with the output buffer,
> which causes the 4-byte gap to be written directly after the size, and then
> the rest of the data will be at an 8-byte boundary in the perf event buffer.

Ah, bingo.  Okay, yes, I see this now in
         e063d979f73b Implement perf event buffer management for DTrace
Thanks for the explanation though.