Search code examples
ebpf

What is the difference between BPF_MAP_TYPE_QUEUE and BPF_MAP_TYPE_RINGBUF in eBPF


The title says it all: what is the exact difference between maps of types BPF_MAP_TYPE_QUEUE and BPF_MAP_TYPE_RINGBUF respectively in eBPF. It would seem that both have FIFO semantics, so the distinction must be somewhat subtle.


Solution

  • The BPF_MAP_TYPE_QUEUE is a generic queue, during creation you specify the type of the values stored inside the queue. You can enqueue and dequeue from userspace and eBPF, very similar to other generic maps such as array maps and hash maps. An example usage would be a freelist of port numbers.

    The BPF_MAP_TYPE_RINGBUF is more specialized, it is made to be a high performance eBPF to userspace channel. The values sent over the buffer are of arbitrary size and mixed dynamically. The userspace application has to do a bit more complex setup evolving mmap'ing memory, but afterwards no syscalls are needed to read from the map, which is why its fast. Userspace can't write to the map and eBPF can't read from it. (The BPF_MAP_TYPE_USER_RINGBUF map is basically the reverse, userspace producer, eBPF consumer). Examples where you would use it is for packet capture, custom logging, tracing execution, ect.