removed two bpf_hash args_pid/sig

tools/killsnoop.py

@@ -45,6 +45,8 @@
 struct val_t {
  u64 pid;
  u64 ts;
+ int sig;
+ int tpid;
  char comm[TASK_COMM_LEN];
 };
 
@@ -58,8 +60,6 @@
  char comm[TASK_COMM_LEN];
 };
 
-BPF_HASH(args_pid, u32, int);
-BPF_HASH(args_sig, u32, int);
 BPF_HASH(infotmp, u32, struct val_t);
 BPF_PERF_OUTPUT(events);
 
@@ -72,10 +72,10 @@
  if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) {
  val.pid = bpf_get_current_pid_tgid();
  val.ts = bpf_ktime_get_ns();
+ val.tpid = tpid;
+ val.sig = sig;
  infotmp.update(&pid, &val);
  }
- args_pid.update(&pid, &tpid);
- args_sig.update(&pid, &sig);
 
  return 0;
 };
@@ -84,16 +84,9 @@
 {
  struct data_t data = {};
  struct val_t *valp;
- int *tpidp, *sigp;
  u32 pid = bpf_get_current_pid_tgid();
  u64 tsp = bpf_ktime_get_ns();
 
- tpidp = args_pid.lookup(&pid);
- sigp = args_sig.lookup(&pid);
- if (tpidp == 0 || sigp == 0) {
- return 0; // missed entry
- }
-
  valp = infotmp.lookup(&pid);
  if (valp == 0) {
  // missed entry
@@ -104,14 +97,12 @@
  data.pid = pid;
  data.delta = tsp - valp->ts;
  data.ts = tsp / 1000;
- data.tpid = *tpidp;
+ data.tpid = valp->tpid;
  data.ret = ctx->ax;
- data.sig = *sigp;
+ data.sig = valp->sig;
 
  events.perf_submit(ctx, &data, sizeof(data));
  infotmp.delete(&pid);
- args_pid.delete(&pid);
- args_sig.delete(&pid);
 
  return 0;
 }