Re: Notification when an eBPF map is modified

Fulvio Risso

On 17/02/2018 08:41, Y Song wrote:
On Fri, Feb 16, 2018 at 11:19 PM, Fulvio Risso <fulvio.risso@...> wrote:

On 17/02/2018 08:02, Y Song via iovisor-dev wrote:

On Fri, Feb 16, 2018 at 7:59 AM, Francesco Picciariello via
iovisor-dev <iovisor-dev@...> wrote:

Hello all,
Is there a way to receive asynchronous notification each time an eBPF map

When map is modified in kernel, you can send something into a ring buffer
and userspace can poll on this ring buffer to get notification.
Got it.
We were looking for a mechanism transparent to the eBPF program, though.
A possible rational is to have an hot-standby copy of the program (including the state) in some other location, but I don't want my dataplane to be aware of that.


When you say "you" means "the dataplane program"?

In other words, the dataplane must be collaborative and send a notification
to userspace when the map has been modified?
Yes. Not just notification, may be actual data or part of actual data, or
aggregated data if modification is too frequent.



I used bpf_obj_pin() in order to save a specific map on filesystem, and I
called linux inotify() on the pinned object.

The inotify API provides a mechanism for monitoring filesystem events,
the goal is to notice when a pinned eBPF map is modified, but it seems
inotify() does not work properly with bpf filesystem. In fact it's able
detect the creation and the deletion, but not the modification of the

The inotify takes vfs_read/write for read/write operations.
Here bpf map read/write happens inside
bpf program, or through bpf syscall, and hence inotify mechanism won't


iovisor-dev mailing list
iovisor-dev mailing list

Join to automatically receive all group messages.