Allow working with entire `args` for tracepoints
Author: viktormalikCreated Jul 20, 2023Updated Aug 29, 2026
Labelsgood first issuepriority: mediumdifficulty: easy
#2477 added support for working with entire args as a record containing all probe arguments for kfuncs and uprobes. Extend this to tracepoints.
Tracepoints have several specifics:
- The passed context is a pointer to a struct containing all arguments, similar to kfuncs. The difference is that the struct contains additional data which shouldn't be a part of the final struct in bpftrace.
Consider the tracepoint entry for the read syscall:
# cat /sys/kernel/tracing/events/syscalls/sys_enter_read/format
name: sys_enter_read
ID: 730
format:
field:unsigned short common_type; offset:0; size:2; signed:0;
field:unsigned char common_flags; offset:2; size:1; signed:0;
field:unsigned char common_preempt_count; offset:3; size:1; signed:0;
field:int common_pid; offset:4; size:4; signed:1;
field:int __syscall_nr; offset:8; size:4; signed:1;
field:unsigned int fd; offset:16; size:8; signed:0;
field:char * buf; offset:24; size:8; signed:0;
field:size_t count; offset:32; size:8; signed:0;
print fmt: "fd: 0x%08lx, buf: 0x%08lx, count: 0x%08lx", ((unsigned long)(REC->fd)), ((unsigned long)(REC->buf)), ((unsigned long)(REC->count))The first four fields (common_type, common_flags, common_preempt_count, and pid) are in each tracepoint and should not be present in the args struct.
- There are two special kinds of fields not appearing as arguments of other probes - bitfields and
__data_locentries - which may require special handling (this is already done in multiple places in bpftrace).
Source: bpftrace/bpftrace