Re: Usage of kfuncs in tracepoints

[David <david@davidv.dev>]

On 12/01/2026 19:03, Alan Maguire wrote:

 > Most of the examples use a bpftool-generated vmlinux.h

I am using a generated header, but not seeing bpf_strstr in the output:

```

$ bpftool btf dump file ~/git/linux-6.18.2/vmlinux.unstripped | grep strstr
[42254] FUNC 'strstr' type_id=42253 linkage=static
[51220] FUNC 'bpf_strstr' type_id=51198 linkage=static
$ bpftool btf dump file ~/git/linux-6.18.2/vmlinux.unstripped format c  
| grep -c strstr
0
```

I am generating my header with an older bpftool:

```
$ bpftool --version
bpftool v7.4.0
using libbpf v1.4
features:
```

But I'm using libbpf v1.6.2 on my custom loader.

> I think you need to add "__ksym __weak";" here i.e.

This change let me load the program, however, libbpf cannot find a 
kernel image at
/sys/kernel/btf/vmlinux, because /sys/kernel/btf is not populated on my 
system.

My kernel _is_ built with CONFIG_DEBUG_INFO_BTF=y, is there something 
else I need to do
  to get this path populated?

Because this path is missing, libbpf reports:

```
kernel BTF is missing at '/sys/kernel/btf/vmlinux', was 
CONFIG_DEBUG_INFO_BTF enabled?
```

But I see from strace that it tries a few fallback paths.
In the meantime, I copied my kernel into /boot/vmlinux-6.18.2 so libbpf 
can find it, but
now the loader says

```
calling kernel function is not supported without CONFIG_DEBUG_INFO_BTF
```

with strace showing a return value of ENOTSUPP + error 524:

```
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACEPOINT, insn_cnt=6, 
insns=0x7f6ab777c230, license="GPL", log_level=0, log_size=0, 
log_buf=NULL, kern_version=KERNEL_VERSION(6, 18, 2), prog_flags=0, 
prog_name="trace_sendto
_en", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, 
prog_btf_fd=8, func_info_rec_size=8, func_info=0x7f6ab777d280, 
func_info_cnt=1, line_info_rec_size=16, line_info=0x7f6ab777ed40, 
line_info_cnt=2, attach_btf_id=0, a
ttach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, 
core_relo_rec_size=0, log_true_size=0, prog_token_fd=0, fd_array_cnt=0}, 
152) = -1 ENOTSUPP (Unknown error 524)
```

Can I not use `bpf_strstr` on a tracepoint? To validate, I tried a 
`raw_tp` but
had the same result.

David