bcc: funccount: "cannot attach kprobe" warning instead of failing?

I just got this error:

$ ./funccount.py 'serio*'
cannot attach kprobe, Invalid argument
Failed to attach BPF program trace_count_38 to kprobe serio_raw_drv_exit

It looks like serio_raw_drv_exit is a function defined in the __exit section (module cleanup function), therefore attaching a kprobe fails (EINVAL).

Ideally, it’d be nice to blacklist all functions defined in the __exit section (somehow…), but more in general I was wondering if it’d be better to simply report a warning when a single kprobe can’t be attached with funccount and keep going, instead of failing.

In practice, something like this:

diff --git a/tools/funccount.py b/tools/funccount.py
index 69dd01c8cada..22ae31c3397b 100755
--- a/tools/funccount.py
+++ b/tools/funccount.py
@@ -88,9 +88,12 @@ class Probe(object):
     def attach(self):
         if self.type == b"p" and not self.library:
             for index, function in self.trace_functions.items():
-                self.bpf.attach_kprobe(
-                        event=function,
-                        fn_name="trace_count_%d" % index)
+                try:
+                    self.bpf.attach_kprobe(
+                            event=function,
+                            fn_name="trace_count_%d" % index)
+                except Exception as e:
+                    print("warning: " + str(e))
         elif self.type == b"p" and self.library:
             for index, function in self.trace_functions.items():
                 self.bpf.attach_uprobe(

What do you think?

About this issue

Original URL
State: open
Created 6 years ago
Reactions: 1
Comments: 18 (9 by maintainers)

Most upvoted comments

Great. Thanks. Just merged.

yonghong-song on Dec 23, 2021

@yonghong-song here’s the PR #3772

achilles-git on Dec 23, 2021

I also just stumbled over this on Debian buster:

host ~ # funccount-bpfcc '*mkdir*'                  
cannot attach kprobe, Invalid argument
Failed to attach BPF program trace_count_18 to kprobe instance_mkdir

As a workaround, you use can use a regex and specifically exclude the failing kprobe with a negative look-ahead assertion:

host ~ # funccount-bpfcc -r '(?!^instance_mkdir$).*mkdir.*'
Tracing 30 functions for "(?!^instance_mkdir$).*mkdir.*"... Hit Ctrl-C to end.
^C
FUNC                                    COUNT
apparmor_path_mkdir                         1
vfs_mkdir                                   1
do_mkdirat                                  1
ext4_mkdir                                  1
security_path_mkdir                         1
__x64_sys_mkdir                             1
security_inode_mkdir                        1
Detaching...

martinvonwittich on Aug 25, 2021

I’m hitting this error on Linux 4.20 and bcc git master.

$ sudo /usr/share/bcc/tools/funccount '*interrupt*'
cannot attach kprobe, Invalid argument
Failed to attach BPF program trace_count_6 to kprobe intel_threshold_interrupt.cold.6

sdht0 on Feb 25, 2019