anakryiko / retsnoop

Investigate kernel error call stacks
BSD 2-Clause "Simplified" License
186 stars 32 forks source link

Consult one question about cards_found #7

Closed mzhan017 closed 2 years ago

mzhan017 commented 2 years ago

Hello, I capture one trace with this kind of: entry_SYSCALL_64_after_hwframe+0x65 do_syscall_64+0x5b x64_sys_sendto+0x24 sys_sendto+0xee 27us [-EAGAIN] sock_sendmsg+0x5 cards_found.85860+0x1a4 sock_sendmsg+0x3e 24us [-EAGAIN] tcp_sendmsg+0x5 cards_found.85860+0x1ac tcp_sendmsg+0x27 3us [-EAGAIN] tcp_sendmsg_locked+0x5 cards_found.85860+0x1c6 cards_found.85860+0x125 cards_found.85860+0x1fb cards_found.85860+0x19e cards_found.85860+0x19e

But there is something that I cannot find from vmlinux :( How to check the cards_found.85860?

Thanks, Mark

mzhan017 commented 2 years ago

strings ./kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko | grep card

cards_found.85860

nm /lib/modules/4.18.0-348.7.1.el8_5.x8664/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko | grep cards

000000000000002c b cards_found.85860 Seems this is one variable in bss secion of this kernel module. What's the meaning of the number after the "cards_found.85860"?

anakryiko commented 2 years ago

As you can see captured stack trace has 000000000000002c entries in it, which retsnoop is symbolizing relative to closes (non-function) symbol cards_found.85860. Which is wrong and confusing, I think it would be better to just print out unsymbolized 0x1f2 (or whatever the original value was) in this case.

But as to why the stack trace is corrupted -- no idea, it's tracing, there is always something that might not work.