> Well, I have to switch between maps based on an "entity switch" in the > producing the event. > The map type and format is fixed and pinned. Say it could be one per > pid, if pid is the entity > switch. /sys/bpf/pidno could be the pinned location. Based on the > pid at the time of event, > I want to consult the map of that pid so I can > filter/aggregate/histogram events sent to user space. > The "entity switch" could be major:minor:inode, or other such as well > (not easy to get from bpf now, but > you get the idea). I can't have one or just a few maps because the > key value pairs will be > different for different entity switches. I might not filter if > /sys/pid/pidno map is not present. > Thanks for your suggestion (Zvi and Daniel). I will explore > BPF_TYPE_ARRAY_OF_MAPS if it > can fit this case. It sounds like BPF_TYPE_HASH_OF_MAPS might be more of what you need, then. It's the same as BPF_TYPE_ARRAY_OF_MAPS, only it allows for a key instead of an index. You could use the major:minor:inode or whatever as the key, and then your problem becomes how the eBPF program can calculate the key. Good luck! --Zvi
|