Failed to attach BPF program b'oncpu' to kprobe b'finish_task_switch' offcputime-bpfcc

[p0mvn]

I'm on Ubuntu 5.15.0-100-generic

built using the instructions for Ubuntu

I run:

/sbin/offcputime-bpfcc

3 warnings generated.
cannot attach kprobe, probe entry may not exist
Traceback (most recent call last):
  File "/sbin/offcputime-bpfcc", line 234, in <module>
    b.attach_kprobe(event="finish_task_switch", fn_name="oncpu")
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 683, in attach_kprobe
    raise Exception("Failed to attach BPF program %s to kprobe %s" %
Exception: Failed to attach BPF program b'oncpu' to kprobe b'finish_task_switch'

Would appreciate any help on this

[yonghong-song]

Maybe kernel function finish_task_switch is completely inlined? You can cat /proc/kallsyms to see whether this is the case or not.

[portnov]

Hello
I have a similar problem.
I looked into /proc/kallsyms. There are records like "finish_task_switch.isra.0.cold" and several similar. Should it be this way?
If not, what to do in order for offcputime to work? recompile kernel with disabled optimizations? :)

[yonghong-song]

Unfortunately, finish_task_switch is a static function so indeed it could be easily inlined. In the above, it is lined with gcc. in order for offcputime to work, yes, you need to add 'noline' attribute to offcputime function in the kernel.