bpftrace ustack() pid packing
Daniel Xu
I'm reading through codegen_llvm.cpp[0] and I noticed that ustack
map keys are packed with a PID. From what I understand, if you run bpftrace -e 'uprobe:/lib64/libc.so.6:usleep /comm == "a.out"/ { @[ustack(2)] = count() }' and a.out has forked, it would cause duplicate stack traces to be outputted. This has caused some confusion in the past with users. I'm wondering what the intention behind PID packing is. Thanks, Daniel --- [0]: https://github.com/iovisor/bpftrace/blob/master/src/ast/codegen_llvm.cpp#L748-L756 |
|