4 ms·
> rr does not monitor processes outside the children of what it is recording, and misses any communication through shared memory to an outside process. The cur
by cesarb 6y ago
> rr does not monitor processes outside the children of what it is recording, and misses any communication through shared memory to an outside process.
The current tendency seems to be moving towards communication through ring buffers in shared memory, not only with outside processes but also with the kernel (io_uring), so unless they find a workaround, rr is going to become less useful as time goes on.
- Asooka 6y agoFor sure, the fact it cannot support shared memory is one of the biggest drawbacks. Maybe catching shared memory setup and marking the pages as not readable, then catching read accesses would work.
- tobyld 6y agoUDB [1] from Undo has support for recording processes which use shared memory with outside processes. Although, unlike rr it isn't open source. [1] https://undo.io/solutions/products/udb/ https://undo.io/solutions/products/udb/
- roca 6y agoI think we can support io_uring with some work. Basically we need to have rr manage the real ring buffers and give the application fake ring buffers, then have rr copy data between the fake and real ring buffers at defined times.
- souprock 6y agoI think it's easier to put the entire system into the reverse debugger. The downside is some complexity seeing into the system to view individual processes. Here is one such tool: https://www.raytheonintelligenceandspace.com/capabilities/products/dejavm https://www.raytheonintelligenceandspace.com/capabilities/pr... An extra benefit is that you can reverse debug the kernel.
- roca 6y agoThat is cool stuff but having to run your application in a VM is annoying for users (it was for VMWare). Also a problem in AWS where you don't have nested virtualization.