On 2026/1/17 07:32, Andrii Nakryiko wrote:

On Thu, Jan 15, 2026 at 11:18 PM Menglong Dong [off-list ref] wrote:

quoted

For now, bpf_get_func_arg() and bpf_get_func_arg_cnt() is not supported by
the BPF_TRACE_RAW_TP, which is not convenient to get the argument of the
tracepoint, especially for the case that the position of the arguments in
a tracepoint can change.

The target tracepoint BTF type id is specified during loading time,
therefore we can get the function argument count from the function
prototype instead of the stack.

Signed-off-by: Menglong Dong <redacted>
---
v2:
- for nr_args, skip first 'void *__data' argument in btf_trace_##name
  typedef
---
 kernel/bpf/verifier.c    | 36 ++++++++++++++++++++++++++++++++----
 kernel/trace/bpf_trace.c |  4 ++--
 2 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index faa1ecc1fe9d..422d35c100ff 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c

@@ -23316,8 +23316,22 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
                /* Implement bpf_get_func_arg inline. */
                if (prog_type == BPF_PROG_TYPE_TRACING &&
                    insn->imm == BPF_FUNC_get_func_arg) {
-                       /* Load nr_args from ctx - 8 */
-                       insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
+                       if (eatype == BPF_TRACE_RAW_TP) {
+                               int nr_args;
+
+                               if (!prog->aux->attach_func_proto)
+                                       return -EINVAL;

can this happen? can we have tp_btf program without attach_func_proto
properly set?

I saw it can be NULL in some case, such as bpf2bpf. Maybe it can't
happen for tp_btf, and I'll do further analysis on this point.

Thanks!
Menglong Dong

quoted

+                               /*
+                                * skip first 'void *__data' argument in btf_trace_##name
+                                * typedef
+                                */
+                               nr_args = btf_type_vlen(prog->aux->attach_func_proto) - 1;
+                               /* Save nr_args to reg0 */
+                               insn_buf[0] = BPF_MOV64_IMM(BPF_REG_0, nr_args);
+                       } else {
+                               /* Load nr_args from ctx - 8 */
+                               insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
+                       }
                        insn_buf[1] = BPF_JMP32_REG(BPF_JGE, BPF_REG_2, BPF_REG_0, 6);
                        insn_buf[2] = BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 3);
                        insn_buf[3] = BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1);

@@ -23369,8 +23383,22 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
                /* Implement get_func_arg_cnt inline. */
                if (prog_type == BPF_PROG_TYPE_TRACING &&
                    insn->imm == BPF_FUNC_get_func_arg_cnt) {
-                       /* Load nr_args from ctx - 8 */
-                       insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
+                       if (eatype == BPF_TRACE_RAW_TP) {
+                               int nr_args;
+
+                               if (!prog->aux->attach_func_proto)
+                                       return -EINVAL;
+                               /*
+                                * skip first 'void *__data' argument in btf_trace_##name
+                                * typedef
+                                */
+                               nr_args = btf_type_vlen(prog->aux->attach_func_proto) - 1;
+                               /* Save nr_args to reg0 */
+                               insn_buf[0] = BPF_MOV64_IMM(BPF_REG_0, nr_args);
+                       } else {
+                               /* Load nr_args from ctx - 8 */
+                               insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
+                       }

                        new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, 1);
                        if (!new_prog)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 6e076485bf70..9b1b56851d26 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c

@@ -1734,11 +1734,11 @@ tracing_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_d_path:
                return &bpf_d_path_proto;
        case BPF_FUNC_get_func_arg:
-               return bpf_prog_has_trampoline(prog) ? &bpf_get_func_arg_proto : NULL;
+               return &bpf_get_func_arg_proto;
        case BPF_FUNC_get_func_ret:
                return bpf_prog_has_trampoline(prog) ? &bpf_get_func_ret_proto : NULL;
        case BPF_FUNC_get_func_arg_cnt:
-               return bpf_prog_has_trampoline(prog) ? &bpf_get_func_arg_cnt_proto : NULL;
+               return &bpf_get_func_arg_cnt_proto;
        case BPF_FUNC_get_attach_cookie:
                if (prog->type == BPF_PROG_TYPE_TRACING &&
                    prog->expected_attach_type == BPF_TRACE_RAW_TP)
--

2.52.0