On Fri, Feb 27, 2026 at 03:40 PM -05, Andrey Grodzovsky wrote: > - Patch 1: libbpf detects exact function names (no wildcards) in > bpf_program__attach_kprobe_multi_opts() and bypasses kallsyms parsing, > passing the symbol directly to the kernel via syms[] array. > ESRCH is normalized to ENOENT for API consistency.
FWIW, Ivan was also trying to make it faster from the kernel side: https://lore.kernel.org/bpf/[email protected]/ But, IIUC, with this change we're not hitting get_ksymbol_bpf at all.
