tools: filter/display using PID instead of TID
As mentioned in #3407, several BCC tools misuse bpf_get_current_pid_tgid(),
bpf_get_current_pid_tgid() returns process ID in the upper 32bits, and
thread ID in lower 32 bits (both from userspace's perspective).
In this commit, we return process ID to userspace for display, and use
thread ID as BPF map key so that we can avoid event loss or data corruption.
The following tools are fixed in the commit:
* bashreadline
* cachetop
* dcsnoop
* killsnoop
* llcstat
* mdflush
* mysqld_qslower
* wakeuptime
See also #3411, #3427, #3433 .
Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>
diff --git a/tools/cachetop.py b/tools/cachetop.py
index 803e2a0..fe6a9a9 100755
--- a/tools/cachetop.py
+++ b/tools/cachetop.py
@@ -157,8 +157,8 @@
u32 uid = bpf_get_current_uid_gid();
key.ip = PT_REGS_IP(ctx);
- key.pid = pid & 0xFFFFFFFF;
- key.uid = uid & 0xFFFFFFFF;
+ key.pid = pid >> 32;
+ key.uid = uid;
bpf_get_current_comm(&(key.comm), 16);
counts.increment(key);