How do I get the previous process id

[cyy-tag]

I am writing an example of logging offcputime by binding finish_task_switch， failed to obtain pid.
I used the following three methods to get the id, and the pid val was 0
How to get the previous pid ?

SEC("kprobe/finish_task_switch")
int BPF_KPROBE(kprobe__finish_task_switch, struct task_struct *prev) {
__u32 pid = 1, tgid = 1;
__u64 ts, tsp;
const char fmt_update[] = "update pid %u";
const char fmt_read[] = "read pid %u";
//method 1
// struct task_struct prev = (struct task_struct )(PT_REGS_PARM1_CORE(ctx));
//bpf_core_read(&pid, sizeof(pid), &prev->pid);
//bpf_core_read(&tgid, sizeof(tgid), &prev->tgid);
// //method 2
struct task_struct * tatk = (struct task_struct)bpf_get_current_task();
pid = BPF_CORE_READ(prev, pid);
tgid = BPF_CORE_READ(prev, tgid);
////method 3
// const char *prev = (void *) PT_REGS_PARM1_CORE(ctx);
// bpf_probe_read_kernel(&pid, sizeof(pid), (const void *)prev);
// bpf_probe_read_kernel(&tgid, sizeof(tgid), (const void *)(prev + 4));
// record previous thread sleep time
ts = bpf_ktime_get_ns();
bpf_trace_printk(fmt_update, sizeof(fmt_update), tgid);
bpf_map_update_elem(&starts, &pid, &ts, BPF_ANY);
// get the current thread's start time
pid = bpf_get_current_pid_tgid();
tgid = bpf_get_current_pid_tgid() >> 32;
tsp = bpf_map_lookup_elem(&starts, &pid);
bpf_trace_printk(fmt_read, sizeof(fmt_read), pid);

buidl:go run github.com/cilium/ebpf/cmd/bpf2go -target amd64 -cc clang bpf kprobe_finish_task.c -- -I../headers
uanme -a: Linux 5.15.133.1-microsoft-standard-WSL2 #1 SMP Thu Oct 5 21:02:42 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

The current pid is correct and the previous pid is always zero
output:
<...>-35802 [013] d...1 5617.331150: bpf_trace_printk: update pid 0
<...>-35802 [013] d...1 5617.331162: bpf_trace_printk: read pid 35802
<...>-35803 [013] d...1 5617.332364: bpf_trace_printk: update pid 0
<...>-35803 [013] d...1 5617.332376: bpf_trace_printk: read pid 35803
<...>-35804 [013] d...1 5617.333124: bpf_trace_printk: update pid 0
<...>-35804 [013] d...1 5617.333135: bpf_trace_printk: read pid 35804
<...>-35805 [006] d...1 5617.333793: bpf_trace_printk: update pid 0
<...>-35805 [006] d...1 5617.333805: bpf_trace_printk: read pid 35805
<...>-35806 [005] d...1 5617.674144: bpf_trace_printk: update pid 0
<...>-35806 [005] d...1 5617.674206: bpf_trace_printk: read pid 35806
grep-35808 [013] d...1 5617.677395: bpf_trace_printk: update pid 0
grep-35808 [013] d...1 5617.677413: bpf_trace_printk: read pid 35808
<...>-35807 [006] d...1 5617.678258: bpf_trace_printk: update pid 0
<...>-35807 [006] d...1 5617.678292: bpf_trace_printk: read pid 35807
<...>-35809 [011] d...1 5618.228761: bpf_trace_printk: update pid 0
<...>-35809 [011] d...1 5618.228854: bpf_trace_printk: read pid 35809
<...>-35810 [013] d...1 5618.231616: bpf_trace_printk: update pid 0
<...>-35810 [013] d...1 5618.231649: bpf_trace_printk: read pid 35810
<...>-35812 [011] d...1 5618.233857: bpf_trace_printk: update pid 0
<...>-35812 [011] d...1 5618.233881: bpf_trace_printk: read pid 35812
<...>-35814 [002] d...1 5618.235730: bpf_trace_printk: update pid 0
<...>-35814 [002] d...1 5618.235748: bpf_trace_printk: read pid 35814
<...>-35816 [002] d...1 5618.237190: bpf_trace_printk: update pid 0
<...>-35816 [002] d...1 5618.237208: bpf_trace_printk: read pid 35816
<...>-35818 [013] d...1 5618.336265: bpf_trace_printk: update pid 0
<...>-35818 [013] d...1 5618.336315: bpf_trace_printk: read pid 35818
<...>-35819 [013] d...1 5618.338652: bpf_trace_printk: update pid 0
<...>-35819 [013] d...1 5618.338683: bpf_trace_printk: read pid 35819
<...>-35821 [005] d...1 5618.340835: bpf_trace_printk: update pid 0
<...>-35821 [005] d...1 5618.340858: bpf_trace_printk: read pid 35821

[ti-mo]

This is an eBPF-specific question not related to the Go side of things. You may have more success getting a reply on StackOverflow or on the Cilium Slack.