On Wed, 9 Oct 2024 at 18:31, Steven Rostedt <[email protected]> wrote: > > On Wed, 9 Oct 2024 18:25:25 +0200 > Ard Biesheuvel <[email protected]> wrote: > > > > Say we have code of: > > > > > > pushq r10 > > > pushq r11 > > > call foo > > > popq r11 > > > popq r10 > > > > > > Where we add a kprobe to the start of foo, the callback should be able to > > > see what r10 and r11 were. > > > > Why exactly is that? The contents of R10 and R11 have no purpose going > > forward, so is it just to see what some previous code may have left in > > them? > > Because the probe is on the call. Unless they were used between the push > and the call, they still have the value you may be looking for. >
Right. So putting a probe on foo() is a way to inspect the register values during the execution if its caller. Fair enough. > > > > > But the restore part is for the function foo to > > > see. It shouldn't care about r10 or r11 and if a kprobe updates them, it > > > should not have any effect. > > > > > > What does restoring r10 and r11 give us? > > > > > > > Nothing. Which is why I don't understand why you would need to record > > them in the first place. > > As I mentioned above. Unless they are used after they are pushed, you still > have access to them on the call (or the kprobe attached to ftrace). > OK. I just didn't imagine this usage mode, where you probe foo() to capture the values of dead registers in its callers. I'll send a v2 and drop the first hunk.
