Failed to attach BPF program b'oncpu' to kprobe b'finish_task_switch' offcputime-bpfcc

[Roman]

I'm on Ubuntu 5.15.0-100-generic

built using the instructions for Ubuntu

I run:

/sbin/offcputime-bpfcc

3 warnings generated.
cannot attach kprobe, probe entry may not exist
Traceback (most recent call last):
  File "/sbin/offcputime-bpfcc", line 234, in <module>
    b.attach_kprobe(event="finish_task_switch", fn_name="oncpu")
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 683, in attach_kprobe
    raise Exception("Failed to attach BPF program %s to kprobe %s" %
Exception: Failed to attach BPF program b'oncpu' to kprobe b'finish_task_switch'

Would appreciate any help on this

[yonghong-song]

Maybe kernel function finish_task_switch is completely inlined? You can cat /proc/kallsyms to see whether this is the case or not.

[Ilya V. Portnov]

Hello
I have a similar problem.
I looked into /proc/kallsyms. There are records like "finish_task_switch.isra.0.cold" and several similar. Should it be this way?
If not, what to do in order for offcputime to work? recompile kernel with disabled optimizations? :)

[yonghong-song]

Unfortunately, finish_task_switch is a static function so indeed it could be easily inlined. In the above, it is lined with gcc. in order for offcputime to work, yes, you need to add 'noline' attribute to offcputime function in the kernel.

[wangyong]

@yonghong-song
Does the below meaning to rebuild kernel image ?
you need to add 'noline' attribute to offcputime function in the kernel.

[Dmitry Davydov]

I got the same problem, in my case there were these functions:

$ sudo cat /proc/kallsyms | grep finish_task_switch 
ffffffffa7134a70 t __pfx_finish_task_switch.isra.0
ffffffffa7134a80 t finish_task_switch.isra.0
ffffffffa8031f86 t finish_task_switch.isra.0.cold

I've managed to get the output with these changes in /usr/sbin/offcputime-bpfcc

-b.attach_kprobe(event="finish_task_switch", fn_name="oncpu")
+b.attach_kprobe(event="finish_task_switch.isra.0", fn_name="oncpu")

[yonghong-song]

@yonghong-song Does the below meaning to rebuild kernel image ? you need to add 'noline' attribute to offcputime function in the kernel.

Adding 'noinline' to the function and rebuild the kernel definitely the safest option. But I do know it may not be possible. So you could use above 'finish_task_switch.isra.0' if it is available. If finish_task_switch is completely inlined in all occurrences, then the tool simply cannot be used.