facebookincubator / below

A time traveling resource monitor for modern Linux systems
Apache License 2.0
1.01k stars 59 forks source link

question of bpf code #8231

Open xixiliguo opened 1 month ago

xixiliguo commented 1 month ago

below/src/bpf/exitstat.bpf.c Comment show that code logic will check tas->signal.live as last thread, but I never found it in all files so comment is wrong?

// sched:sched_process_exit is triggered right before process/thread exits. At
// this point we capture last taskstats to account resource usage of short-lived
// processes. We also check tas->signal.live counter to determine if this thread
// is the last thread in a process and thus is also a process exit.
SEC("tracepoint/sched/sched_process_exit")
int tracepoint__sched__sched_process_exit(
    struct trace_event_raw_sched_process_template* args
) {
  struct task_struct* task = (struct task_struct*)bpf_get_current_task();
  u64 pid_tgid = bpf_get_current_pid_tgid();
  u64 now = bpf_ktime_get_ns();
brianc118 commented 1 month ago

Good catch. sched_process_exit is triggered on thread exit and we aren't checking signal.live so this means we end up catching threads not just processes. Now I think about it, it may be a bit confusing since this means we are showing threads not just processes in the process view.