The function pointer to symbol comparison for checking get_fields fails with ARM kernels built with the Thumb-2 instruction set. Ignore the least significant bit for the comparison since it stores information about the ARM/Thumb state. Do this unconditionally since it shouldn't cause any problems for other architectures. crash-arm> extend trace.so ... <readmem: 80d57cbc, KVADDR, "read ftrace_event_call get_fields", 4, (ROE), ff87ffa4> <read_kdump: addr: 80d57cbc paddr: d57cbc cnt: 4> Unkown get_fields function extend: /usr/lib/crash-arm/extensions/trace.so: no commands registered: shared object unloaded crash-arm> rd 80d57cbc 80d57cbc: 801db565 e... crash-arm> sym syscall_get_enter_fields 801db564 (t) syscall_get_enter_fields Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com&gt; --- trace.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/trace.c b/trace.c index c33907f..bdb086a 100644 --- a/trace.c +++ b/trace.c @@ -1029,9 +1029,9 @@ int ftrace_get_event_type_fields(ulong call, ulong *fields) get_fields_offset = MAX(MEMBER_OFFSET("ftrace_event_class", "get_fields"), MEMBER_OFFSET("trace_event_class", "get_fields")); if ((sp = symbol_search("syscall_get_enter_fields")) != NULL) - syscall_get_enter_fields_value = sp->value; + syscall_get_enter_fields_value = sp->value & ~1; if ((sp = symbol_search("syscall_get_exit_fields")) != NULL) - syscall_get_exit_fields_value = sp->value; + syscall_get_exit_fields_value = sp->value & ~1; work: if (fields_offset < 0) @@ -1056,6 +1056,8 @@ work: return 0; } + get_fields &= ~1; + if (get_fields == syscall_get_enter_fields_value) return syscall_get_enter_fields(call, fields); --- base-commit: 153629a96b07a8ae96b0b28cce100fde9ea1398d change-id: 20230612-thumb2-2431fd10df56 Best regards, -- Vincent Whitchurch <vincent.whitchurch(a)axis.com&gt;