How to use ringbuffer to send data from user space to kernel space

[windy-purple]

Hello,I'm trying to send data from user space to kernel space in order to dynamically update the kernel layer's pid filter conditions,But I only found examples from kernel space to user space

[florianl]

The ringbuffer provided by this package currently only supports kernel to user-space communication.
For user-space to kernel communication a new eBPF map type/user ringbuffer was introduced with BPF_MAP_TYPE_USER_RINGBUF. So far, this package does not yet support this kind of new eBPF map type/user ringbuffer

[windy-purple]

thanks

[dorkamotorka]

Any plans to have this supported?

[ouvaa]

@windy-purple can u quickly use chatgpt to generate a quick example? ebpf is too new for me and though i've done some work on ebpf c file, it's more like doing lots of tries before getting it to work.

i understand what u said but i cant wrap my head around the implementation of it without some examples or code framework to follow.

possible to show some outline of it? pls use chatgpt to do as best as u can for this. i can buy u coffees for this.

p.s. : been trying to find a solution for 1 week and u seemed to be the rare few who understand how this shld be done

[windy-purple]

@ouvaa I'm not sure if the dilemma we encountered is the same. My goal is to pass in a specified pid as a global filter condition. I used the specified file name to get the PID.
Kernel layer code

SEC("kprobe/do_sys_openat2")
int kprobe_openat(struct pt_regs *ctx)
{
	char *fp = (char *)(ctx->si);
    char uidfile[25] = {0};
    char flag[] = {'/','f','l','a','g','0','0','0','/'};
    int k;
	int PID = -1;
	
	for(int i = 0; i < 9; i++)
	{
	    if(flag[i] != uidfile[i])
	    {
	        k = 0;
	        break;
	    }
	}
	if(k == 1)
	{
	    if(uidfile[14] <= 57 && uidfile[14] >= 48)
	    {
	        PID = (uidfile[14] - 48) + ((uidfile[13] - 48) * 10) + ((uidfile[12] - 48) * 100) + ((uidfile[11] - 48) * 1000) + ((uidfile[10] - 48) * 10000) + ((uidfile[9] - 48) * 100000);
	    }
	    else if(uidfile[14] == 0 && uidfile[13] <= 57 && uidfile[13] >= 48)
	    {
	        PID = (uidfile[13] - 48) + ((uidfile[12] - 48) * 10) + ((uidfile[11] - 48) * 100) + ((uidfile[10] - 48) * 1000) + ((uidfile[9] - 48) * 10000);
	    }
	    else if(uidfile[14] == 0 && uidfile[13] == 0 && uidfile[12] <= 57 && uidfile[12] >= 48)
	    {
	        PID = (uidfile[12] - 48) + ((uidfile[11] - 48) * 10) + ((uidfile[10] - 48) * 100) + ((uidfile[9] - 48) * 1000);
	    }
	    else if(uidfile[14] == 0 && uidfile[13] == 0 && uidfile[12] == 0 && uidfile[11] <= 57 && uidfile[11] >= 48)
	    {
	        PID = (uidfile[11] - 48) + ((uidfile[10] - 48) * 10) + ((uidfile[9] - 48) * 100);
	    }
	    else if(uidfile[14] == 0 && uidfile[13] == 0 && uidfile[12] == 0 && uidfile[11] == 0 && uidfile[10] <= 57 && uidfile[10] >= 48)
	    {
	        PID = (uidfile[10] - 48) + ((uidfile[9] - 48) * 10);
	    }
	    else if(uidfile[14] == 0 && uidfile[13] == 0 && uidfile[12] == 0 && uidfile[11] == 0 && uidfile[10] == 0 && uidfile[9] <= 57 && uidfile[9] >= 48)
	    {
	        PID = uidfile[9] - 48;
	    }
	    else
	    {
	        PID = -1;
	    }
	    bpf_printk("PID: %d, filename: %s",PID,uidfile);
	}
}

User level code

func main() {
	stopper := make(chan os.Signal,1)
    signal.Notify(stopper,os.Interrupt,syscall.SIGTERM)

    if err := rlimit.RemoveMemlock(); err != nil {
        log.Fatal(err);
    }
    
    objs := bpfObjects{}
    if err := loadBpfObjects(&objs,nil); err != nil {
        log.Fatal(err);
    }
    defer objs.Close()
    
    se, err := link.Kprobe("do_sys_openat2",objs.KprobeOpenat,nil)
    if err != nil {
        log.Fatal(err)
    }
    defer se.Close()
	
	rd, err := ringbuf.NewReader(objs.Events)
    if err != nil {
        log.Fatal(err)
    }
    defer rd.Close()
    
    go func() {
        <-stopper
        
        if err := rd.Close(); err != nil {
            log.Fatal(err)
        }
    }()
	
	pidfile := fmt.Sprintf("/flag000/%s",10159)
    file, err := os.Open(pidfile)
    if err != nil {
        fmt.Println(err)
    }
    defer file.Close()
	
	for {
	    ....
	}
}

[ouvaa]

@windy-purple i'm trying to pass variable to ebpf c function program and return the results. this is given by chatgpt and it does not work as expected. u know any work arounds?

in ebpf c program

#include <linux/bpf.h>
#include <linux/pkt_cls.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <bpf/bpf_helpers.h>

struct bpf_map_def SEC("maps") ip_counter = {
    .type = BPF_MAP_TYPE_PERCPU_LRU,
    .key_size = sizeof(uint32_t),
    .value_size = sizeof(uint64_t),
    .max_entries = 10240,
};

SEC("classifier")
int ipcounter(struct __sk_buff *skb) {
    struct ethhdr *eth = bpf_hdr_pointer(skb, 0);
    struct iphdr *ip = (struct iphdr *)(eth + 1);
    uint32_t key = ip->saddr;
    uint64_t *count;

    count = bpf_map_lookup_elem(&ip_counter, &key);
    if (count) {
        (*count)++;
    } else {
        uint64_t one = 1;
        bpf_map_update_elem(&ip_counter, &key, &one, BPF_ANY);
    }

    return TC_ACT_OK;
}

char _license[] SEC("license") = "GPL";

main.go

package main

/*
#cgo CFLAGS: -I/usr/include
#cgo LDFLAGS: -lelf

#include <stdlib.h>
#include "bpf_load.h"

extern int ipcounter(char *ip);

int load_bpf_program() {
    char filename[] = "path/to/compiled/ebpf_prog.o";
    return bpf_load_file(filename);
}
*/
import "C"
import (
    "fmt"
    "unsafe"
)

func main() {
    // Load the eBPF program
    ret := C.load_bpf_program()
    if ret != 0 {
        fmt.Println("Error loading eBPF program")
        return
    }

    // Call the ipcounter function with an IP address
    ip := "192.168.1.1"
    cIP := C.CString(ip)
    defer C.free(unsafe.Pointer(cIP))
    C.ipcounter(cIP)

    fmt.Printf("Incremented IP counter for IP: %s\n", ip)
}

[windy-purple]

@ouvaa I can't figure it out, if you want to change the map in the kernel at user level, maybe you can consider using bpftool

[ti-mo]

@ouvaa Instead of using chatgpt, I'd recommend learning how the tech actually works. 🙂 GPT won't help you here.

You don't need a ring buffer to pass values to kernel space at all. The user->kernel ring buffer is so new I didn't even know about it yet, and it will take a while before it ships in most Linux distributions. If you just want to pass down a few config values into your bpf programs, create an array or hash map and write your values to it from user space.

If you haven't done so, I'd recommend walking through our getting started guide: https://ebpf-go.dev/guides/getting-started. This example only reads values from the map in user space, but user space can write to them as well. As I mentioned before, see the examples/ folder in the repository for many examples on passing data between kernel and userspace in both directions. All examples are runnable and recompilable, so they provide a decent jumping-off point.

Reading and writing to maps from userspace is incredibly common (see the (Map API)[https://pkg.go.dev/github.com/cilium/ebpf#Map]) and doesn't require external CLI tools like bpftool. That would require the map to be pinned to bpffs and completely defeats the point of using ebpf-go. Again, please read and understand the getting started guide before you proceed with anything else. (also, be wary of taking advice from newcomers)

To me it feels like you've spent days getting GPT to do the right thing instead of reading a bit of documentation and walking through examples. ChatGPT in particular doesn't really know about ebpf-go in my experience and will only regurgitate vaguely related things from the upstream bpf mailing list, usually dated things at that. Consider using the resources at your disposal (also look at the GitHub Discussions here on the repository) to make some progress instead of getting GPT to write it for you, it simply won't work.

As far as I'm concerned, the question in this discussion has been answered: user ringbufs are not implemented yet, as they are a very new feature and haven't shipped in popular distributions. I'm considering closing the discussion and locking it if it goes farther off-topic. Thank you.