Function return hook integration with Function graph tracer
summary
Current kernel has two independent return-hook systems—kretprobe and function graph tracer—that both overwrite return addresses and keep per-task shadow storage, wasting memory and causing duplicate hooks. Patches attempt a single shared shadow stack under function graph tracer, move the fprobe exit handler into fgraph, and drop an intermediate RedHook that failed in testing; the result reduces preallocated objects, simplifies tracing usership, and targets removing kretprobe (especially on arm64 because of pt_regs differences). BPF, perf and LTTng users need minimal adapter work.
AI-written summary · about
chapters (5)
- 0:00Introduction to return hooks
- 1:33Shadow stack and trampolines
- 4:13Current F probe limitations
- 7:28Cleanup and backward compatibility
- 12:48Q&A on probe usage
