On Mon, Mar 2, 2026 at 7:48 AM Jakub Sitnicki <[email protected]> wrote: > > On Fri, Feb 27, 2026 at 03:40 PM -05, Andrey Grodzovsky wrote: > > - Patch 1: libbpf detects exact function names (no wildcards) in > > bpf_program__attach_kprobe_multi_opts() and bypasses kallsyms parsing, > > passing the symbol directly to the kernel via syms[] array. > > ESRCH is normalized to ENOENT for API consistency. > > FWIW, Ivan was also trying to make it faster from the kernel side: > > https://urldefense.com/v3/__https://lore.kernel.org/bpf/[email protected]/__;!!BmdzS3_lV9HdKG8!zla5HijIg6Vbdu0M8yoWocdwUD_o1-XyD5HUD7ZHbjKt9D846oT35Srz6_uXjkfS4eSc_i-lOw6IllBHvfaZgPHdXrKp$ > > But, IIUC, with this change we're not hitting get_ksymbol_bpf at all.
Exactly. Also, note plz that patch [2/3] includes an extra optimisation in the kernel ftrace path too. Andrey
