traceloop icon indicating copy to clipboard operation
traceloop copied to clipboard

Wrong syscalls reported for i386 binaries

Open pothos opened this issue 4 years ago • 0 comments

When a 32 bit binary is run via

podman run --rm -ti i386/alpine

and, for example, just the Enter key is hit a few times, I get wrong syscalls reported (expected is poll and read(0):

sudo -E ./traceloop cgroups /sys/fs/cgroup/user.slice/user-1000.slice/[email protected]/user.slice/libpod-66540563be22be03c226f6f0c5d0f1d4f92eda982412c61c4da1218397f9ded7.scope
00:00.519821885 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531230324 cpu#5 pid 776610 [sh] close(0) = 1
00:00.531236722 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531240220 cpu#5 pid 776610 [sh] close(0) = 1
00:00.531243272 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531246027 cpu#5 pid 776610 [sh] close(0) = 1
00:00.531249071 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531251834 cpu#5 pid 776610 [sh] close(0) = 1
00:00.531254858 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531257615 cpu#5 pid 776610 [sh] close(0) = 1

because i386's read is interpreted as amd64's close and poll is interpreted as swapoff since they have the same syscall number:

grep close /usr/include/asm/unistd_64.h 
#define __NR_close 3
grep ' 3$' /usr/include/asm/unistd_32.h
#define __NR_read 3
grep swapoff /usr/include/asm/unistd_64.h 
#define __NR_swapoff 168
grep 168 /usr/include/asm/unistd_32.h
#define __NR_poll 168

pothos avatar Dec 12 '19 16:12 pothos