> > plink = (struct bpf_link *const *) link; > > kplink = container_of(plink, struct bpf_link_kprobe, link); > > Did you check if this works? Also how that could ever even work for > non-kprobe but perf_event-based cases, like tracepoint? And why are we > even discussing these "alternatives"? What's wrong with the way I > proposed earlier? For container_of() to work you have to do it the way > I described in my previous email with one struct being embedded in > another one. Nevermind. Sorry for the noise. I'll do the container encapsulation like you said so. I was being lazy and trying to find a way to change just the kprobes path instead of thinking in the overall project. Sorry again, will come up with what you said in the first place.