tools: filter/display using PID instead of TID
As mentioned in #3407, several BCC tools misuse bpf_get_current_pid_tgid(),
bpf_get_current_pid_tgid() returns process ID in the upper 32bits, and
thread ID in lower 32 bits (both from userspace's perspective).
In this commit, we return process ID to userspace for display, and use
thread ID as BPF map key so that we can avoid event loss or data corruption.
The following tools are fixed in the commit:
* bashreadline
* cachetop
* dcsnoop
* killsnoop
* llcstat
* mdflush
* mysqld_qslower
* wakeuptime
See also #3411, #3427, #3433 .
Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>
diff --git a/tools/mdflush.py b/tools/mdflush.py
index 2abe15c..8a23520 100755
--- a/tools/mdflush.py
+++ b/tools/mdflush.py
@@ -32,7 +32,7 @@
int kprobe__md_flush_request(struct pt_regs *ctx, void *mddev, struct bio *bio)
{
struct data_t data = {};
- u32 pid = bpf_get_current_pid_tgid();
+ u32 pid = bpf_get_current_pid_tgid() >> 32;
data.pid = pid;
bpf_get_current_comm(&data.comm, sizeof(data.comm));
/*