Implement libbpf bpf_create_map

[kakkoyun]

@parca-dev contributor here. First of all, thanks for the fantastic work you are doing here. We are glad libbpf exists.

To be able to use BPF_MAP_TYPE_ARRAY_OF_MAPS and BPF_MAP_TYPE_HASH_OF_MAPS map types and create maps in user-space we need to access the libbpf#bpf_create_map function (and maybe bpf_map__set_inner_map_fd).

I would be happy to give it a try if you don't have enough capacity. However, I don't know what I don't know, so it would be slow.

bpf_create_map: https://github.com/libbpf/libbpf/blob/5b9d079c7f12d5c0b961623e56fdae17c721debf/src/bpf.c#L166-L178

The interactions I want to replicate can be seen here https://hechao.li/2019/03/19/Use-Map-in-Map-in-BPF-programs-via-Libbpf/

@yanivagman @eyakubovich @grantseltzer

cc @brancz

[grantseltzer]

Hi @kakkoyun! Thanks for the kind words.

Implementing libbpf APIs is a big priority going forward. I can certainly start with this API when I get to working on API implementation, likely next week!

In the meantime if you'd like to try implementing it yourself i'd be more than happy to help you with it. If you have any questions you can join our slack: aquasecurity.slack.com

[yanivagman]

Thanks @kakkoyun
Just want to bring to your attention a recent mail in the bpf mailing list:
https://lore.kernel.org/bpf/20211118003423.1885869-1-andrii@kernel.org/
which suggests to unify the different APIs of creating a map into one.

This should be considered when we create the libbpfgo API, as we want to make it stable

[kakkoyun]

Thanks @grantseltzer. I'll have look at it. It would be nice to join the slack I might have further questions. How can I join, though? It doesn't let me. Do I need an invite?

And thanks @yanivagman for the heads up.

[itaysk]

@kakkoyun did you try to self-invite at slack.aquasec.com ?

[kakkoyun]

@kakkoyun did you try to self-invite at slack.aquasec.com ?

Thanks @itaysk. This link actually helped.

[kakkoyun]

Hey 👋 Friendly ping. I couldn't find time to focus on this one but I can dedicate some time to make this happen next week. Any updates on your side or anything I need to know before jumping onto this?

[grantseltzer]

Hi @kakkoyun, I have not yet started working on this. Been focused on building out the latest release for libbpfgo and tracee, but was going to get to it afterwards. I was thinking i'll save this for you to work on if that's alright.

[kakkoyun]

Yes, thanks @grantseltzer. I would be happy to give it a try.

[kakkoyun]

I still haven't gotten to start this. Feel free to go for it :)

[grantseltzer]

I opened #138 for this, though I did come across quite a few gotcha's to using this API in libbpf, see mailing list thread: https://lore.kernel.org/bpf/CAO658oWagXsQDeFtRA2vZBzov7cwwVNTs5nHE9fMGrMOs6bbpQ@mail.gmail.com/

[kakkoyun]

Amazing @grantseltzer, I can't thank you enough. I'll check the PR and the mailing list.

[kakkoyun]

@grantseltzer I finally got to this :D bpf_map__set_inner_map_fd (mentioned in #16) is blocking us to use BPF_MAP_TYPE_HASH_OF_MAPS.

I'll give a shot at it

cc @javierhonduco @v-thakkar