Re: stap/eBPF language features brainstorm

[William Cohen <wcohen at redhat dot com>]

On 07/19/2018 01:32 PM, Serhei Makarov wrote:
> On Thu, Jul 19, 2018, at 11:27 AM, William Cohen wrote:
>> probe timer.ms(5000) {
>>   /* write out data */
>>   /* clear data */
>>   delete io_stat
>>   delete device
>>   read_bytes = 0
>>   write_bytes = 0  
>> }
>>
>> Is there some way to clear out all the previous entries in the bpf map 
>> from the timer probe?
>>
>> -Will
> 
> The only ways I can think of to 'clear out' a map from eBPF kernel space are fairly contrived.
> 
> However, in the case of scripts like iotop.stp, there is no reason to run that 5-second timer in kernel-space. I don't see why it would require perf-like precision, so it could be handled by the userspace eBPF interpreter, where such operations are easier to support by iterating through the map elements
> 
> Last time we discussed this, Aaron mentioned some plans to implement support for userspace stapBPF timer probes. I'm not sure what the best option would be for specifying which timer probes should run in userspace and which ones should be handled in the kernel. Perhaps it could be decided automatically depending on whether userspace-only operations such as foreach or map_clear are detected in the probe body.
> 
> All the best,
>       Serhei
> 


The delete in userspace timer could keep a shadow array of the array and use the delta between the live bpf map array and the shadow array to allow behavior like the current delete operation.  However, this doesn't address the problem where the bpf array get full.

-Will