#2688·bpftrace

Allow working with entire `args` for tracepoints

Author: viktormalikCreated Jul 20, 2023Updated Aug 29, 2026
Labelsgood first issuepriority: mediumdifficulty: easy

#2477 added support for working with entire args as a record containing all probe arguments for kfuncs and uprobes. Extend this to tracepoints.

Tracepoints have several specifics:

  • The passed context is a pointer to a struct containing all arguments, similar to kfuncs. The difference is that the struct contains additional data which shouldn't be a part of the final struct in bpftrace.

Consider the tracepoint entry for the read syscall:

# cat /sys/kernel/tracing/events/syscalls/sys_enter_read/format
name: sys_enter_read
ID: 730
format:
	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
	field:int common_pid;	offset:4;	size:4;	signed:1;

	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
	field:unsigned int fd;	offset:16;	size:8;	signed:0;
	field:char * buf;	offset:24;	size:8;	signed:0;
	field:size_t count;	offset:32;	size:8;	signed:0;

print fmt: "fd: 0x%08lx, buf: 0x%08lx, count: 0x%08lx", ((unsigned long)(REC->fd)), ((unsigned long)(REC->buf)), ((unsigned long)(REC->count))

The first four fields (common_type, common_flags, common_preempt_count, and pid) are in each tracepoint and should not be present in the args struct.

  • There are two special kinds of fields not appearing as arguments of other probes - bitfields and __data_loc entries - which may require special handling (this is already done in multiple places in bpftrace).