tools: filter/display using PID instead of TID
As mentioned in #3407, several BCC tools misuse bpf_get_current_pid_tgid(),
bpf_get_current_pid_tgid() returns process ID in the upper 32bits, and
thread ID in lower 32 bits (both from userspace's perspective).
In this commit, we return process ID to userspace for display, and use
thread ID as BPF map key so that we can avoid event loss or data corruption.
The following tools are fixed in the commit:
* bashreadline
* cachetop
* dcsnoop
* killsnoop
* llcstat
* mdflush
* mysqld_qslower
* wakeuptime
See also #3411, #3427, #3433 .
Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>
diff --git a/tools/bashreadline.py b/tools/bashreadline.py
index ad9cfdc..908a145 100755
--- a/tools/bashreadline.py
+++ b/tools/bashreadline.py
@@ -50,7 +50,7 @@
u32 pid;
if (!PT_REGS_RC(ctx))
return 0;
- pid = bpf_get_current_pid_tgid();
+ pid = bpf_get_current_pid_tgid() >> 32;
data.pid = pid;
bpf_probe_read_user(&data.str, sizeof(data.str), (void *)PT_REGS_RC(ctx));