Re: [RFC PATCH bpf-next v2 2/3] libbpf: Add FEAT_KPROBE_MULTI_LINK feature probe.

[Varun R Mallya]

On Mon, Mar 30, 2026 at 04:52:46PM +0200, Jiri Olsa wrote:
> > +
> > +	/* attaching to a valid symbol should succeed */
> > +	link_opts.kprobe_multi.syms = &sym;
> > +	link_opts.kprobe_multi.cnt = 1;
> 
> maybe we could set cnt > MAX_KPROBE_MULTI_CNT and check if the fail
> is E2BIG ? this could save some cycles, but haven't tried that
> 
> jirka
>
Thanks for the suggestion!
I tested this out on an older kernel (<5.8) to see if it fails with a different error
code and it did. On newer kernels it always fails with -E2BIG.
Implemented this in my latest version (which I will send out in a while).

> > +	link_fd = bpf_link_create(prog_fd, -1, BPF_TRACE_KPROBE_MULTI, &link_opts);
> > +	err = -errno;
> > +	if (link_fd >= 0)
> > +		close(link_fd);
> > +	close(prog_fd);
> > +	/* if kprobe_multi is supported, link creation either succeeds or
> > +	 * fails with something other than -EINVAL due to permissions,
> > +	 */
> > +	return link_fd >= 0 || (err != -EINVAL);
> > +}
> > +
> 
> SNIP