modify_ldt

Partial in Antinomie 0.7.0 · Syscall list

Synopsis

long modify_ldt(int func, void *ptr, unsigned long bytecount);

Number (x86-64)	154
ABI	common
Kernel entry point	sys_modify_ldt

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Reads or writes the process’s local descriptor table, an x86 segmentation feature.

Arguments

Name	Type	Meaning
func (arg0)	int	Sub-operation selector.
ptr (arg1)	void *	Pointer.
bytecount (arg2)	unsigned long	Size in bytes.

Return value

On success: a command-specific value.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-14	EFAULT	A pointer argument points outside the accessible address space.
-22	EINVAL	An argument is invalid.

Man page

modify_ldt(2) on man7.org

Captured by Antinomie

Coverage mark: Partial. Commands that read or write the LDT decode their data. An unknown command records a modify_ldt.unknown_selector “no decoder” gap.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
func (arg0)	Entry	raw scalar word	args.0, args.func
ptr (arg1)	Entry	the pointer itself, as a raw word	args.1, args.raw[1]
↳ pointee	Entry	structure user_desc	arg1.ldt_entry	func writes an entry (1 or 0x11)
↳ pointee	Exit	the descriptor table bytes, length min(bytecount (arg2), result)	arg1.ldt	func reads the table (0 or 2) and result is 0 or greater
bytecount (arg2)	Entry	raw scalar word	args.2, args.bytecount

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.func (arg0), args.ptr (arg1), args.bytecount (arg2); args.0 to args.5 by position.
• Structure user_desc behind ptr (arg1): args.ptr.<member> for base_addr, contents, entry_number, limit, limit_in_pages, lm, read_exec_only, seg_32bit, seg_not_present, useable.

See Syscall Trace filter for the full syntax.

Known gaps

• An unknown func records modify_ldt.unknown_selector with the “no decoder” status.
• See the coverage mark above for the code paths that record a gap.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.