The task_current_syscall function can be used on any valid struct task_struct at any time, and does not even require that utrace_attach_task was used at all.

The other ways to access the registers and other machine-dependent state of a task can only be used on a task that is at a known safe point. The safe points are all the places where utrace_set_events can request callbacks (except for the DEATH and REAP events). So at any event callback, it is safe to examine current.

One task can examine another only after a callback in the target task that returns UTRACE_STOP so that task will not return to user mode after the safe point. This guarantees that the task will not resume until the same engine uses utrace_control, unless the task dies suddenly. To examine safely, one must use a pair of calls to utrace_prepare_examine and utrace_finish_examine surrounding the calls to struct user_regset functions or direct examination of task data structures. utrace_prepare_examine returns an error if the task is not properly stopped, or is dead. After a successful examination, the paired utrace_finish_examine call returns an error if the task ever woke up during the examination. If so, any data gathered may be scrambled and should be discarded. This means there was a spurious wake-up (which should not happen), or a sudden death.