On Wed, Dec 27, 2023 at 2:01 AM Philo Lu <lulie@xxxxxxxxxxxxxxxxx> wrote: > > +__bpf_kfunc int bpf_relay_output(struct bpf_map *map, > + void *data, u64 data__sz, u32 flags) > +{ > + struct bpf_relay_map *rmap; > + > + /* not support any flag now */ > + if (unlikely(!map || flags)) > + return -EINVAL; > + > + rmap = container_of(map, struct bpf_relay_map, map); > + if (!rmap->relay_chan->has_base_filename) > + return -ENOENT; > + > + relay_write(rmap->relay_chan, data, data__sz); > + return 0; This just opens a can of worms. Above is not nmi safe. relay_write() can be used only out of known context which effectively makes it unusable out of bpf tracing progs that can kprobe attach anywhere in the kernel. perf_event buffer is the only sure way to deliver events to user space with overwrite. bpf ringbuf is a best effort due to if (in_nmi()) if (!spin_trylock_irqsave Sorry, but it's a nack to allow bpf progs interface with relay.