Skip to content
This repository has been archived by the owner on May 3, 2023. It is now read-only.

Wrong syscalls reported for i386 binaries #25

Open
pothos opened this issue Dec 12, 2019 · 0 comments
Open

Wrong syscalls reported for i386 binaries #25

pothos opened this issue Dec 12, 2019 · 0 comments

Comments

@pothos
Copy link
Member

pothos commented Dec 12, 2019

When a 32 bit binary is run via

podman run --rm -ti i386/alpine

and, for example, just the Enter key is hit a few times, I get wrong syscalls reported (expected is poll and read(0):

sudo -E ./traceloop cgroups /sys/fs/cgroup/user.slice/user-1000.slice/[email protected]/user.slice/libpod-66540563be22be03c226f6f0c5d0f1d4f92eda982412c61c4da1218397f9ded7.scope
00:00.519821885 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531230324 cpu#5 pid 776610 [sh] close(0) = 1
00:00.531236722 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531240220 cpu#5 pid 776610 [sh] close(0) = 1
00:00.531243272 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531246027 cpu#5 pid 776610 [sh] close(0) = 1
00:00.531249071 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531251834 cpu#5 pid 776610 [sh] close(0) = 1
00:00.531254858 cpu#5 pid 776610 [sh] swapoff(4287264624) = 1
00:00.531257615 cpu#5 pid 776610 [sh] close(0) = 1

because i386's read is interpreted as amd64's close and poll is interpreted as swapoff since they have the same syscall number:

grep close /usr/include/asm/unistd_64.h 
#define __NR_close 3
grep ' 3$' /usr/include/asm/unistd_32.h
#define __NR_read 3
grep swapoff /usr/include/asm/unistd_64.h 
#define __NR_swapoff 168
grep 168 /usr/include/asm/unistd_32.h
#define __NR_poll 168
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant