Re: stap/eBPF language features brainstorm

[Serhei Makarov <me@serhei.io>]

On Thu, Jul 19, 2018, at 11:27 AM, William Cohen wrote:
> probe timer.ms(5000) {
>   /* write out data */
>   /* clear data */
>   delete io_stat
>   delete device
>   read_bytes = 0
>   write_bytes = 0  
> }
> 
> Is there some way to clear out all the previous entries in the bpf map 
> from the timer probe?
> 
> -Will

The only ways I can think of to 'clear out' a map from eBPF kernel space are fairly contrived.

However, in the case of scripts like iotop.stp, there is no reason to run that 5-second timer in kernel-space. I don't see why it would require perf-like precision, so it could be handled by the userspace eBPF interpreter, where such operations are easier to support by iterating through the map elements.

Last time we discussed this, Aaron mentioned some plans to implement support for userspace stapBPF timer probes. I'm not sure what the best option would be for specifying which timer probes should run in userspace and which ones should be handled in the kernel. Perhaps it could be decided automatically depending on whether userspace-only operations such as foreach or map_clear are detected in the probe body.

All the best,
      Serhei