2

Is is possible to have ebpf program generate event, for example packet counter reached a predefined threshold value and ebpf would generate some notification/event to user, something similar to what netlink provides.

I see that currently the only way to signal this event/state is via maps which can be polled by the user application.

pchaigno
  • 11,313
  • 2
  • 29
  • 54
Mark
  • 6,052
  • 8
  • 61
  • 129

1 Answers1

1

No, there isn't a way currently to signal userspace or other programs without polling maps.

This has been briefly discussed on the iovisor-dev mailing list before. If you have a use case for this, you might try to bring it on the mailing list.

pchaigno
  • 11,313
  • 2
  • 29
  • 54
  • thank you for the link! It suggests interesting idea to use `ftrace` to trace the map update calls, I should try it. – Mark May 07 '18 at 12:33
  • Glad I could help! Note that you can also use BPF directly instead of ftrace to trace calls to `bpf_map_update_elem`. Anything you want me to add in the answer to accept it? – pchaigno May 07 '18 at 13:00
  • I have another question. Is the tracing the calls (with `ftrace`, `tracepoints`) considered async mechanism? – Mark May 11 '18 at 12:16
  • I'm not sure what you mean by "async."...? – pchaigno May 12 '18 at 06:37
  • For example, I can subscribe ip events (add/delete FIB rules), or network interfaces events (link up/down) via `setsockopt`, events will show up on the netlink socket, where I run `select()`, so there is no need to continuously poll the socket. How does ftrace work compared to my example? – Mark May 12 '18 at 13:58
  • As far as I know you'll have to poll with ftrace too. – pchaigno May 12 '18 at 17:40