On rawhide (4.2.0-0.rc6.git1.1.fc24.x86_64), the nfsd.close probe alias no longer resolves: ==== # stap -p4 -e 'probe nfsd.close {}' semantic error: while resolving probe point: identifier 'nfsd' at <input>:1:7 source: probe nfsd.close {} ^ semantic error: no match Pass 2: analysis failed. [man error::pass2] ==== This is because of the following kernel commit: ==== commit fd891454609ec036dc23e34536e45d655b4ca4db Author: Christoph Hellwig <hch@lst.de> Date: Tue Apr 28 15:41:16 2015 +0200 nfsd: remove nfsd_close Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: J. Bruce Fields <bfields@redhat.com> ==== Here's a link to the actual patch: <https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/nfsd/vfs.c?id=fd891454609ec036dc23e34536e45d655b4ca4db> As you can see in that patch, the nfsd_close() function was replace with a call to fput(). We can't just move the nfsd.close probe to probe fput(), since fput() is called all over the kernel. So, basically this function we were probing is gone. The only solution I see at this point is to make the nfsd.close probe point optional.
Note that I've looked through fput()'s source, but couldn't find a suitable callback to probe instead of nfsd_close(). fsnotify_close() might be a candidate, but it is an inline and its arg isn't available on some kernels. The other candidate would be file->f_op->release(), but the nfsd subsystem seems to use generic callbacks there.
Fixed (really the problem was just worked around) in commit 3fc11ed.