rr-debugger / rr-debugger/rr

Emulate vsyscalls without patching

Open
#2,940 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
10.7k
Forks
662
Avg merge
2d 3h
Merged PRs (30d)
2

Description

Currently we "support" vsyscalls by patching the vsyscall call site to do a regular syscall (via syscallbuf if possible). This only works when the call site matches the known patch template. In issue #2939 it seems that IFUNC tricks are used to make time@plt select the vsyscall as the implementation function, which means we can't safely recognize and patch the actual call site. In issue #2929 we seem to have a function making a direct vsyscall, but with code that doesn't match the template. For the latter case we probably can (and probably should) simply add a new template that matches that code. To handle the former case, we could emulate vsyscalls in rr, which is what this issue is about. (This would also fix #2929 but it would be unnecessarily slow during recording.)

There are three vsyscalls: gettimeofday, time, and getcpu. (See Linux arch/x86/entry/vsyscall/vsyscall_64.c.) Basically we would AutoRemoteSyscall the required syscall, write appropriate syscall entry/exit records to the trace (with the right recorded-memory records), and fix up tracee registers to match the results of executing the vsyscall (i.e. including the implied ret after the syscall).

One special case is if the tracee's seccomp policy disallows the syscall. Linux handles this case, but for us to handle it would be extra work, and tricky too. Probably we can just ignore it since no sane sandboxing policy would block any of those syscalls.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read Linux arch/x86/entry/vsyscall/vsyscall_64.c to understand the three vsyscalls, then inspect rr's existing vsyscall call-site patching and AutoRemoteSyscall paths. Trace how syscall entry/exit and recorded-memory records are written and how tracee registers are fixed up. Done means all three vsyscalls can be emulated without patching, including the implied ret behavior and documented handling of seccomp restrictions.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux
Domain
operating-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.