kprobe_multi should automatically add syscall wrapper prefix if necessary

[lmb]

In #1890 we worked around the fact that somehow the syscall name changed on arm64. @paulcacheux pointed out that for a plain Kprobe we have logic which automatically adds the syscall wrapper if necessary:

ebpf/link/kprobe.go

Lines 176 to 198 in e2c357d

	tp, err := pmuProbe(args)
	if errors.Is(err, os.ErrNotExist) || errors.Is(err, unix.EINVAL) {
	if prefix := linux.PlatformPrefix(); prefix != "" {
	args.Symbol = prefix + symbol
	tp, err = pmuProbe(args)
	}
	}
	if err == nil {
	return tp, nil
	}
	if !errors.Is(err, ErrNotSupported) {
	return nil, fmt.Errorf("creating perf_kprobe PMU (arch-specific fallback for %q): %w", symbol, err)
	}
	// Use tracefs if kprobe PMU is missing.
	args.Symbol = symbol
	tp, err = tracefsProbe(args)
	if errors.Is(err, os.ErrNotExist) || errors.Is(err, unix.EINVAL) {
	if prefix := linux.PlatformPrefix(); prefix != "" {
	args.Symbol = prefix + symbol
	tp, err = tracefsProbe(args)
	}
	}

I think it could make sense to have the same logic for kprobe_multi. Unfortunately this involves making a copy of the slice.

It's unfortunate that the logic currently means that new kernels are penalised due to having to retry creating the kprobe. Maybe it's possible to reverse this.

[lmb]

@mmat11 points out that doing this for kprobe_multi is somewhat tedious, since not all probed functions will be syscall entrypoints. This is also the reason why the fallback is the way it is in the current code.

The real fix to this is probably exporting a method which allows the caller to derive the syscall wrapper name. That also allows the sophisticated user to avoid the EINVAL fallback.