ringbuf

Documentation

Overview

Package ringbuf allows interacting with Linux BPF ring buffer.

BPF allows submitting custom events to a BPF ring buffer map set up by userspace. This is very useful to push things like packet samples from BPF to a daemon running in user space.

Index

• Variables
• type Reader
  • func NewReader(ringbufMap *ebpf.Map) (*Reader, error)
  • func (r *Reader) BufferSize() int
  • func (r *Reader) Close() error
  • func (r *Reader) Flush() error
  • func (r *Reader) Read() (Record, error)
  • func (r *Reader) ReadInto(rec *Record) error
  • func (r *Reader) SetDeadline(t time.Time)
• type Record

Variables

var (
	ErrClosed  = os.ErrClosed
	ErrFlushed = epoll.ErrFlushed
)

Types

type Reader

type Reader struct {
	// contains filtered or unexported fields
}

Reader allows reading bpf_ringbuf_output from user space.

func NewReader

func NewReader(ringbufMap *ebpf.Map) (*Reader, error)

NewReader creates a new BPF ringbuf reader.

func (*Reader) BufferSize

func (r *Reader) BufferSize() int

BufferSize returns the size in bytes of the ring buffer

func (*Reader) Close

func (r *Reader) Close() error

Close frees resources used by the reader.

It interrupts calls to Read.

func (*Reader) Flush

func (r *Reader) Flush() error

Flush unblocks Read/ReadInto and successive Read/ReadInto calls will return pending samples at this point, until you receive a ErrFlushed error.

func (*Reader) Read

func (r *Reader) Read() (Record, error)

Read the next record from the BPF ringbuf.

Calling [Close] interrupts the method with os.ErrClosed. Calling [Flush] makes it return all records currently in the ring buffer, followed by ErrFlushed.

Returns os.ErrDeadlineExceeded if a deadline was set and after all records have been read from the ring.

See [ReadInto] for a more efficient version of this method.

func (*Reader) ReadInto

func (r *Reader) ReadInto(rec *Record) error

ReadInto is like Read except that it allows reusing Record and associated buffers.

func (*Reader) SetDeadline

func (r *Reader) SetDeadline(t time.Time)

SetDeadline controls how long Read and ReadInto will block waiting for samples.

Passing a zero time.Time will remove the deadline.

type Record

type Record struct {
	RawSample []byte

	// The minimum number of bytes remaining in the ring buffer after this Record has been read.
	Remaining int
}