modify_ldt(2) + LSL = divergence
Open
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 10.7k
- Forks
- 662
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 2
Description
We talked about this a few days ago but so that we don't forget ...
It should be possible to trigger divergence by using modify_ldt(2) to change the LDT state and then reading said state via the LSL instruction. The state changes that modify_ldt makes are not replayed, and the LSL instruction happens entirely in userspace with no chance for us to intervene.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing rr's handling of modify_ldt(2) during recording and replay, then investigate how the LSL instruction reads LDT state in userspace. Reproduce the described divergence and determine what replay behavior must change so the LDT state observed by LSL remains consistent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, linux
- Domain
- devtools, operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100