Re: Usage of kfuncs in tracepoints

[Alan Maguire <alan.maguire@oracle.com>]

On 12/01/2026 16:57, David wrote:
> Hi
> 
> I'm trying to use `bpf_strstr` in a program that's running on kernel 6.18.2,
> but I'm getting the following error on load:
> 
>> failed to find BTF for extern 'bpf_strstr' [53] section: -2
> 
> A minimal reproducer for this is:
> 
> ```
> extern int bpf_strstr(const char *s1__ign, const char *s2__ign);

I think you need to add "__ksym __weak";" here i.e.

extern int bpf_strstr(const char *s1__ign, const char *s2__ign) __ksym __weak;

If these aren't already defined you'll need:

#ifndef __ksym
#define __ksym __attribute__((section(".ksyms")))
#endif

#ifndef __weak
#define __weak __attribute__((weak))
#endif

Most of the examples use a bpftool-generated vmlinux.h which has
kfunc declarations of that form; if you want to use a generated vmlinux.h 
(created from the running kernel's BTF) yourself you'd need to 

bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h

Anyway, hopefully the ksym/weak attributes should be enough to get things 
working.

Alan

> SEC("tracepoint/syscalls/sys_enter_sendto")
> int trace_sendto_entry(struct trace_event_raw_sys_enter *ctx)
> {
>       char buf[128];
>       int pos = bpf_strstr(buf, "A");
> }
> ```
> 
> My kernel was initially built with CONFIG_DEBUG_INFO_BTF=n, rebuilding with
> CONFIG_DEBUG_INFO_BTF=y did not change the error.
> 
> I've only tried this with a stripped kernel image, which is 4MiB larger than
> the image with no BTF info.
> 
> Running `bpftool btf dump` on the stripped iamge does show the kfunc:
> 
> ```
> $ bpftool btf dump file ~/git/linux-6.18.2/vmlinux | grep strstr
> [26877] FUNC 'bpf_strstr' type_id=26855 linkage=static
> [60337] FUNC 'strstr' type_id=60336 linkage=static
> ```
> 
> I'm running this program in a virtual machine with a custom init; running
> through strace shows a failed load of `/proc/version_signature`, but I assume a
> fallback to `uname`.
> 
> ```
> faccessat2(AT_FDCWD, "/proc/version_signature", R_OK, AT_EACCESS) = -1 ENOENT (No such file or directory)
> uname({sysname="Linux", nodename="(none)", ...}) = 0
> mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3fe6630000
> mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3fe662f000
> mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3fe662e000
> munmap(0x7f3fe662e000, 4096) = 0
> munmap(0x7f3fe6630000, 8192 <unfinished ...>
> nanosleep({tv_sec=0, tv_nsec=10000000} <unfinished ...>
> futex(0x7f3fe6a44858, FUTEX_WAKE_PRIVATE, 1) = 1
> munmap(0x7f3fe6839000, 16384 <unfinished ...>
> sendto(3, "\1", 1, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
> futex(0x7f3fe6a43b70, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...>
> sendto(3, "@", 1, MSG_NOSIGNAL, NULL, 0) = 1
> sendto(3, "libbpf: failed to find BTF for e"..., 64, MSG_NOSIGNAL, NULL, 0) = 64
> close(3)
> ```
> 
> Maybe there's another dependency I'm not aware of for kfuncs?
> 
> I'm not sure what I'm doing wrong, can you point me in the right direction?
> 
> 
> David
> 
>