pt_regs - the good the bad and the ugly
summary
A history of struct pt_regs shows ptrace → kprobe → kretprobe → ftrace → fprobe → uprobe → redhook → eBPF → perf and a recurring problem: many users propagate sparse pt_regs (trampolines or wrappers that omit fields). ARM64 cannot supply PSTATE except at exception entry, so copying or inventing it (Fprobe making a PT_REGS from Ftrace) produces subtle corrupted state. A pragmatic fix is already deployed: the Ftrace regs wrapper exposes only needed fields with safe accessors; avoid spreading full PT_REGS from trampolines.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 0:21History of pt_regs
- 7:03Problems with pt_regs
- 12:44Recommendations and future
- 19:04Q&A
