On Mon, Jun 21, 2021 at 02:01:18PM +1200, Michael Schmitz wrote: > Hi Eric, > > instrumenting get_reg on m68k and using a similar patch to yours to warn > when unsaved registers are accessed on the switch stack, I get a hit from > getegid and getegid32, just by running a simple ptrace on ls. > > Going to wack those two moles now ... Explain, please. get_reg() is called by tracer; whose state are you checking? Because you are *not* accessing the switch stack of the caller of get_reg(). And tracee should be in something like syscall_trace() or do_notify_resume(); both have SAVE_SWITCH_STACK done by the glue...
