On Wed, May 28, 2025 at 8:37 PM Rong Tao <rt...@foxmail.com> wrote: > > From: Rong Tao <rong...@cestc.cn> > > It is a bit troublesome to get cwd based on pid in bpf program, such as > bpftrace example [1]. > > This patch therefore adds a new bpf_task_cwd_from_pid() kfunc which > allows BPF programs to get cwd from a pid. > > [1] https://github.com/bpftrace/bpftrace/issues/3314
Yes. This is cumbersome, but adding a very specific kfunc to the kernel is not a solution. This is tracing, no need for precise cwd. probe_read_kernel can do the job. bpftrace needs to have better C interop. Once that happens any kind of tracing extraction will be easy to write in C. Like this bpf_task_cwd_from_pid() can already be written as C bpf program.
