Regarding the ebpf question, bpf_ringbuf_submit is not in effect

Why does the user-mode callback function fail to respond to a successful call to kernel mode bpf_ringbuf_submit(data, 0)? but the user-mode callback function responds successfully when the parameter is changed to bpf_ringbuf_submit(data, 2),thank you!

Solution

That second argument is a flag to determine if/when notifications for new data are sent. From the helpers man page:

void bpf_ringbuf_submit(void *data, u64 flags)

    Description
        Submit reserved ring buffer sample, pointed to by
        data.  If BPF_RB_NO_WAKEUP is specified in flags,
        no notification of new data availability is sent.
        If BPF_RB_FORCE_WAKEUP is specified in flags,
        notification of new data availability is sent
        unconditionally.

Value 2 is BPF_RB_FORCE_WAKEUP and forces the notification.

Behavior of each flag

We can find the logic for the different flag in bpf_ringbuf_commit():

BPF_RB_FORCE_WAKEUP (2): The consumer is immediately notified by bpf_ringbuf_commit(). There is no batching.
BPF_RB_NO_WAKEUP (1): The consumer is never notified by bpf_ringbuf_commit().
default (0): The consumer is notified if it already caught up on past events shared on the ring buffer. If it didn't yet consume the previous batch of events, it won't be notified. This is sometimes referred to as adaptive notifications or adaptive batching.