bpftrace ustack() pid packing

Daniel Xu

I'm reading through codegen_llvm.cpp[0] and I noticed that ustack
map keys are packed with a PID. From what I understand, if you run

bpftrace -e 'uprobe:/lib64/libc.so.6:usleep /comm == "a.out"/ { @[ustack(2)] = count() }'

and a.out has forked, it would cause duplicate stack traces to be outputted.
This has caused some confusion in the past with users.

I'm wondering what the intention behind PID packing is.

[0]: https://github.com/iovisor/bpftrace/blob/master/src/ast/codegen_llvm.cpp#L748-L756

Join iovisor-dev@lists.iovisor.org to automatically receive all group messages.