eBPF’s User Ring Buffer: Introducing BPF_MAP_TYPE_USER_RINGBUF
Lately, I’ve been spending a good amount of time tinkering with eBPF, trying out various features to understand all the different ways I could use it for my applications. In this post, I want to shed a light on a new eBPF Map type — the User Ring Buffer. When I experimented with it a bit and I couldn’t find many examples or documentation on it, so I decided to share my findings in this post.
User vs. Kernel Ring Buffer
In case you’re not new to eBPF, you have probably already encountered the Ring Buffer or its predecessor, the Perf Buffer feature. The User Ring Buffer differs in that it facilitates data transfer from user space to the kernel, rather than the other way around, distinguishing it from both the Ring Buffer and Perf Buffer. It was only introduced in kernel version 6.1, so its current use cases are somewhat limited.
⚠️ Note: It’s worth noting that this feature isn’t yet implemented in
cilium/ebpf, so the example below will utilize thelibbpfC library directly.
But in case you find yourself in need of it, here’s an example that may not be readily available elsewhere. I had to dive into the Linux Kernel code myself to grasp it fully, as examples are scarce if any at all.
Kernel Space code
User Space Code
⚠️ Note: Note: The following code snippet is intentionally partial, as its implementation heavily relies on your specific eBPF setup. Be sure to read the comments for crucial details..
I hope you find this resource as enlightening as I did. Stay tuned for more exciting developments and updates in the world of eBPF in next week's newsletter.
Until then, keep 🐝-ing!
Warm regards, Teodor