kernel 5.15.26, crash: cannot resolve "sys_open"

[well-disordered]

$ crash vmlinux vmcore

crash 8.0.0
...
crash: cannot resolve "sys_open"

Do I need to provide more info? Kernel is 5.15.26 with Gentoo patches, arch is x86. crash --minimal vmlinux vmcore works with reduced functionality as expected. Another symbol renamed in the kernel sources ? There are many similar symbols but no exact match.

$ grep sys_open System.map
c10856e0 W compat_sys_open_by_handle_at
c1283590 t do_sys_openat2
c12836c0 T __ia32_sys_openat2
c12837a0 T __ia32_sys_open
c1283830 T __ia32_sys_openat
c1283b00 T do_sys_open
c12aa3f0 T __ia32_sys_open_tree
c1308e20 T __ia32_sys_open_by_handle_at
c1327da0 t proc_sys_open
c1e78da0 d sys_open_test
c1fa6a48 d _eil_addr___ia32_sys_openat2
c1fa6a50 d _eil_addr___ia32_sys_openat
c1fa6a58 d _eil_addr___ia32_sys_open
c1fa6d10 d _eil_addr___ia32_sys_open_tree
c1fa6f48 d _eil_addr___ia32_sys_open_by_handle_at

[well-disordered]

Is this patch okay ? I just folded into x86.c the fix that was already in x86_64.c . Works locally.

--- x86.c.orig	2022-03-27 15:38:55.520744910 -0400
+++ x86.c	2022-03-27 17:04:14.099323650 -0400
@@ -4482,12 +4482,18 @@ x86_omit_frame_pointer(void)
 {
         ulonglong push_bp_mov_esp_bp;
         int i;
-        char *checkfuncs[] = {"sys_open", "sys_fork", "sys_read"};
+        char *checkfuncs[] = {
+                "sys_open", "sys_fork", "sys_read"
+                "__ia32_sys_open", "__ia32_sys_fork", "__ia32_sys_read"
+        };
 
         if (pc->flags & KERNEL_DEBUG_QUERY)
                 return FALSE;
 
         for (i = 0; i < 2; i++) {
+                if(!kernel_symbol_exists(checkfuncs[i]))
+                        continue;
+
                 if (!readmem(symbol_value(checkfuncs[i]), KVADDR,
                     &push_bp_mov_esp_bp, sizeof(ulonglong),
                     "x86_omit_frame_pointer", RETURN_ON_ERROR))

crash-patch.txt

[k-hagio]

Thanks for the report.

The following change will be needed:

-          for (i = 0; i < 2; i++) {
+          for (i = 0; i < 6; i++) {

And is it possible for you to post the patch with your Signed-off-by: tag to the crash-utility mailing list? https://github.com/crash-utility/crash/wiki#submitting-patches

[well-disordered]

GAAH ! How did I miss that.

I almost wrote

    const int nfuncs= (sizeof checkfuncs)/(sizeof checkfuncs[0]);
    for (i= 0; i<nfuncs; i++) {

but I decided against it as an unwarranted style change. Maybe it's warranted, hint hint ? Or else use a NULL sentinel ?

[k-hagio]

const int nfuncs= (sizeof checkfuncs)/(sizeof checkfuncs[0]);

This is good, or x86_64_framepointer_init() uses a literal, so that is also good. Either one will be acceptable.

[vt-alt]

We have the same error for i586 architecture on ALT Linux. Can you apply the fix?