Is is possible to have ebpf program generate event, for example packet counter reached a predefined threshold value and ebpf would generate some notification/event to user, something similar to what netlink provides.
I see that currently the only way to signal this event/state is via maps which can be polled by the user application.
No, there isn't a way currently to signal userspace or other programs without polling maps.
This has been briefly discussed on the iovisor-dev mailing list before. If you have a use case for this, you might try to bring it on the mailing list.