On Mon, Jun 21, 2021 at 02:01:18PM +1200, Michael Schmitz wrote:
Hi Eric, instrumenting get_reg on m68k and using a similar patch to yours to warn when unsaved registers are accessed on the switch stack, I get a hit from getegid and getegid32, just by running a simple ptrace on ls. Going to wack those two moles now ...
Explain, please. get_reg() is called by tracer; whose state are you checking? Because you are *not* accessing the switch stack of the caller of get_reg(). And tracee should be in something like syscall_trace() or do_notify_resume(); both have SAVE_SWITCH_STACK done by the glue...