retsnoop icon indicating copy to clipboard operation
retsnoop copied to clipboard

Published 20 hours ago • verified publisher icon anakryiko

sidecar: functions with isra * are ignored

Open zf1575192187 opened this issue 2 years ago • 3 comments

Use retsnoop -e 'sys_sendto' -a ':net/ipv4/.c' -S -T -l -vv

cat /proc/kallsyms | grep udp_send_skb ffffffff9e2b5630 t udp_send_skb.isra.49

nm vmlinux | grep udp_send_skb ffffffff816b45e0 t udp_send_skb.isra.49

GCC has optimized udp_send_skb to udp_send_skb.isra. 49 Cause in DWARF debug information, udp_send_skb inline, so not hook

run log: Function udp_send_skb.isra. 49 'doesn't match any allow glob, skipping.

zf1575192187 avatar Feb 03 '23 08:02 zf1575192187

Yes, this is a problem and it would be nice to solve this. Do you have a proposal on how to do this?

anakryiko avatar Feb 07 '23 04:02 anakryiko

I'm not familiar with this piece, and I don't know how to solve it for the time being.

zf1575192187 avatar Feb 07 '23 08:02 zf1575192187

yeah, let's keep this issue open. I see in DWARF that for those .isra and .const functions, there is DWARF entry with no DW_AT_inline attribute, but somehow currently sidecar doesn't even encounter them, so they might be outside of requested CU in DWARF or something like that. We'll need to understand this and see how we can use that to our advantage.

anakryiko avatar Feb 07 '23 22:02 anakryiko