Re: HASH_OF_MAPS inner map allocation from BPF

["Toke Høiland-Jørgensen" <toke@redhat.com>]

Borna Cafuk <borna.cafuk@sartura.hr> writes:

> On Sat, Sep 5, 2020 at 12:47 AM Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
>>
>> On Fri, Sep 4, 2020 at 7:57 AM Borna Cafuk <borna.cafuk@sartura.hr> wrote:
>> >
>> > Hello everyone,
>> >
>> > Judging by [0], the inner maps in BPF_MAP_TYPE_HASH_OF_MAPS can only be created
>> > from the userspace. This seems quite limiting in regard to what can be done
>> > with them.
>> >
>> > Are there any plans to allow for creating the inner maps from BPF programs?
>> >
>> > [0] https://stackoverflow.com/a/63391528
>>
>> Did you ask that question or your use case is different?
>> Creating a new map for map_in_map from bpf prog can be implemented.
>> bpf_map_update_elem() is doing memory allocation for map elements.
>> In such a case calling this helper on map_in_map can, in theory, create a new
>> inner map and insert it into the outer map.
>
> No, it wasn't me who asked that question, but it seemed close enough to
> my issue. My use case calls for modifying the syscount example from BCC[1].
>
> The idea is to have an outer map where the keys are PIDs, and inner maps where
> the keys are system call numbers. This would enable tracking the number of
> syscalls made by each process and the makeup of those calls for all processes
> simultaneously.
>
> [1] https://github.com/iovisor/bcc/blob/master/libbpf-tools/syscount.bpf.c

Well, if you just want to count, map-in-map seems a bit overkill? You
could just do:

struct {
  u32 pid;
  u32 syscall;
} map_key;

and use that?

-Toke