Borna Cafuk <borna.cafuk@xxxxxxxxxx> writes: > On Sat, Sep 5, 2020 at 12:47 AM Alexei Starovoitov > <alexei.starovoitov@xxxxxxxxx> wrote: >> >> On Fri, Sep 4, 2020 at 7:57 AM Borna Cafuk <borna.cafuk@xxxxxxxxxx> wrote: >> > >> > Hello everyone, >> > >> > Judging by [0], the inner maps in BPF_MAP_TYPE_HASH_OF_MAPS can only be created >> > from the userspace. This seems quite limiting in regard to what can be done >> > with them. >> > >> > Are there any plans to allow for creating the inner maps from BPF programs? >> > >> > [0] https://stackoverflow.com/a/63391528 >> >> Did you ask that question or your use case is different? >> Creating a new map for map_in_map from bpf prog can be implemented. >> bpf_map_update_elem() is doing memory allocation for map elements. >> In such a case calling this helper on map_in_map can, in theory, create a new >> inner map and insert it into the outer map. > > No, it wasn't me who asked that question, but it seemed close enough to > my issue. My use case calls for modifying the syscount example from BCC[1]. > > The idea is to have an outer map where the keys are PIDs, and inner maps where > the keys are system call numbers. This would enable tracking the number of > syscalls made by each process and the makeup of those calls for all processes > simultaneously. > > [1] https://github.com/iovisor/bcc/blob/master/libbpf-tools/syscount.bpf.c Well, if you just want to count, map-in-map seems a bit overkill? You could just do: struct { u32 pid; u32 syscall; } map_key; and use that? -Toke
