AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/06/29 15:27	flow	patch-triage	4m Args: null Results: { "EnableConfigs": [ "SECCOMP", "SECCOMP_FILTER", "COMPAT" ], "FocusSymbols": [ "arch_syscall_is_vdso_sigreturn", "user_enable_single_step", "user_disable_single_step" ], "Reasoning": "The patch migrates arm64 to use the generic entry code for system calls, replacing custom arm64 syscall entry/exit tracing with generic hooks. It also modifies secure_computing() tree-wide to return a boolean. This is a major functional change to the core syscall path on arm64 and seccomp handling. Fuzzing should focus on the newly added arm64-specific generic entry hooks (e.g., arch_syscall_is_vdso_sigreturn) and ptrace single-step toggling which was modified to interact with generic entry. SECCOMP and COMPAT configs are required to exercise the modified seccomp logic and compat vdso checks.", "WorthFuzzing": true }
1/1	2026/06/29 15:27	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 03669f942eb53ede0f9214de36e8cf43b018989d\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Jun 29 15:27:46 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c\nindex 0687760ea46698..27d9847b108237 100644\n--- a/arch/alpha/kernel/ptrace.c\n+++ b/arch/alpha/kernel/ptrace.c\n@@ -387,7 +387,7 @@ asmlinkage unsigned long syscall_trace_enter(void)\n \t * If this fails, seccomp may already have set up the return value\n \t * (e.g. SECCOMP_RET_ERRNO / TRACE).\n \t /\n-\tif (secure_computing() == -1) {\n+\tif (!secure_computing()) {\n \t\tif (regs-\u003er19 == 0 \u0026\u0026 regs-\u003er0 == (unsigned long)-1)\n \t\t\tsyscall_set_return_value(current, regs, -ENOSYS, 0);\n \t\tsyscall_set_nr(current, regs, -1);\ndiff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c\nindex 7951b2c06fec60..5210745725ca7d 100644\n--- a/arch/arm/kernel/ptrace.c\n+++ b/arch/arm/kernel/ptrace.c\n@@ -855,7 +855,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs regs)\n \n \t/* Do seccomp after ptrace; syscall may have changed. /\n #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER\n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n #else\n \t/ XXX: remove this once OABI gets fixed /\ndiff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig\nindex b3afe0688919bd..aea686dce3d5ac 100644\n--- a/arch/arm64/Kconfig\n+++ b/arch/arm64/Kconfig\n@@ -128,9 +128,9 @@ config ARM64\n \tselect GENERIC_CPU_DEVICES\n \tselect GENERIC_CPU_VULNERABILITIES\n \tselect GENERIC_EARLY_IOREMAP\n+\tselect GENERIC_ENTRY\n \tselect GENERIC_IDLE_POLL_SETUP\n \tselect GENERIC_IOREMAP\n-\tselect GENERIC_IRQ_ENTRY\n \tselect GENERIC_IRQ_IPI\n \tselect GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD\n \tselect GENERIC_IRQ_PROBE\ndiff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h\nindex d2779d604c7be2..f43d4dea916a5b 100644\n--- a/arch/arm64/include/asm/elf.h\n+++ b/arch/arm64/include/asm/elf.h\n@@ -185,6 +185,7 @@ do {\t\t\t\t\t\t\t\t\t\\\n struct linux_binprm;\n extern int arch_setup_additional_pages(struct linux_binprm bprm,\n \t\t\t\t int uses_interp);\n+extern bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs);\n \n / 1GB of VA /\n #ifdef CONFIG_COMPAT\ndiff --git a/arch/arm64/include/asm/entry-common.h b/arch/arm64/include/asm/entry-common.h\nindex cab8cd78f69385..d8bf4bf342e80f 100644\n--- a/arch/arm64/include/asm/entry-common.h\n+++ b/arch/arm64/include/asm/entry-common.h\n@@ -3,14 +3,21 @@\n #ifndef _ASM_ARM64_ENTRY_COMMON_H\n #define _ASM_ARM64_ENTRY_COMMON_H\n \n+#include \u003clinux/ptrace.h\u003e\n #include \u003clinux/thread_info.h\u003e\n \n+#include \u003casm/compat.h\u003e\n #include \u003casm/cpufeature.h\u003e\n #include \u003casm/daifflags.h\u003e\n #include \u003casm/fpsimd.h\u003e\n #include \u003casm/mte.h\u003e\n #include \u003casm/stacktrace.h\u003e\n \n+enum ptrace_syscall_dir {\n+\tPTRACE_SYSCALL_ENTER = 0,\n+\tPTRACE_SYSCALL_EXIT,\n+};\n+\n #define ARCH_EXIT_TO_USER_MODE_WORK (_TIF_MTE_ASYNC_FAULT \| _TIF_FOREIGN_FPSTATE)\n \n static __always_inline void arch_exit_to_user_mode_work(struct pt_regs regs,\n@@ -54,4 +61,73 @@ static inline bool arch_irqentry_exit_need_resched(void)\n \n #define arch_irqentry_exit_need_resched arch_irqentry_exit_need_resched\n \n+static __always_inline unsigned long ptrace_save_reg(struct pt_regs regs,\n+\t\t\t\t\t\t enum ptrace_syscall_dir dir,\n+\t\t\t\t\t\t int regno)\n+{\n+\tunsigned long saved_reg;\n+\n+\t/\n+\t We have some ABI weirdness here in the way that we handle syscall\n+\t * exit stops because we indicate whether or not the stop has been\n+\t * signalled from syscall entry or syscall exit by clobbering a general\n+\t * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee\n+\t * and restoring its old value after the stop. This means that:\n+\t \n+\t - Any writes by the tracer to this register during the stop are\n+\t * ignored/discarded.\n+\t \n+\t - The actual value of the register is not available during the stop,\n+\t * so the tracer cannot save it and restore it later.\n+\t \n+\t - Syscall stops behave differently to seccomp and pseudo-step traps\n+\t * (the latter do not nobble any registers).\n+\t /\n+\tregno = (is_compat_task() ? 12 : 7);\n+\tsaved_reg = regs-\u003eregs[regno];\n+\tregs-\u003eregs[regno] = dir;\n+\n+\treturn saved_reg;\n+}\n+\n+static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs regs)\n+{\n+\tunsigned long saved_reg;\n+\tint regno, ret;\n+\n+\tsaved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, \u0026regno);\n+\tret = ptrace_report_syscall_entry(regs);\n+\tif (ret)\n+\t\tforget_syscall(regs);\n+\tregs-\u003eregs[regno] = saved_reg;\n+\n+\treturn ret;\n+}\n+\n+#define arch_ptrace_report_syscall_entry arch_ptrace_report_syscall_entry\n+\n+static __always_inline void arch_ptrace_report_syscall_exit(struct pt_regs regs,\n+\t\t\t\t\t\t\t int step)\n+{\n+\tunsigned long saved_reg;\n+\tint regno;\n+\n+\tsaved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_EXIT, \u0026regno);\n+\tif (!step) {\n+\t\tptrace_report_syscall_exit(regs, 0);\n+\t\tregs-\u003eregs[regno] = saved_reg;\n+\t} else {\n+\t\tregs-\u003eregs[regno] = saved_reg;\n+\n+\t\t/\n+\t\t Signal a pseudo-step exception since we are stepping but\n+\t\t * tracer modifications to the registers may have rewound the\n+\t\t * state machine.\n+\t\t /\n+\t\tptrace_report_syscall_exit(regs, 1);\n+\t}\n+}\n+\n+#define arch_ptrace_report_syscall_exit arch_ptrace_report_syscall_exit\n+\n #endif / _ASM_ARM64_ENTRY_COMMON_H /\ndiff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h\nindex 5e4c7fc44f7315..84b1c36233d41e 100644\n--- a/arch/arm64/include/asm/syscall.h\n+++ b/arch/arm64/include/asm/syscall.h\n@@ -8,6 +8,7 @@\n #include \u003cuapi/linux/audit.h\u003e\n #include \u003clinux/compat.h\u003e\n #include \u003clinux/err.h\u003e\n+#include \u003clinux/rseq.h\u003e\n \n typedef long (syscall_fn_t)(const struct pt_regs regs);\n \n@@ -120,7 +121,4 @@ static inline int syscall_get_arch(struct task_struct task)\n \treturn AUDIT_ARCH_AARCH64;\n }\n \n-int syscall_trace_enter(struct pt_regs regs);\n-void syscall_trace_exit(struct pt_regs regs);\n-\n #endif\t/* __ASM_SYSCALL_H /\ndiff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h\nindex 5d7fe3e153c850..3f621ba0f96137 100644\n--- a/arch/arm64/include/asm/thread_info.h\n+++ b/arch/arm64/include/asm/thread_info.h\n@@ -46,6 +46,7 @@ struct thread_info {\n \tu64\t\t\tmpam_partid_pmg;\n #endif\n \tu32\t\t\tcpu;\n+\tunsigned long\t\tsyscall_work; / SYSCALL_WORK_ flags /\n };\n \n #define thread_saved_pc(tsk)\t\\\n@@ -68,11 +69,6 @@ void arch_setup_new_exec(void);\n #define TIF_UPROBE\t\t5\t/ uprobe breakpoint or singlestep /\n #define TIF_MTE_ASYNC_FAULT\t6\t/ MTE Asynchronous Tag Check Fault /\n #define TIF_NOTIFY_SIGNAL\t7\t/ signal notifications exist /\n-#define TIF_SYSCALL_TRACE\t8\t/ syscall trace active /\n-#define TIF_SYSCALL_AUDIT\t9\t/ syscall auditing /\n-#define TIF_SYSCALL_TRACEPOINT\t10\t/ syscall tracepoint for ftrace /\n-#define TIF_SECCOMP\t\t11\t/ syscall secure computing /\n-#define TIF_SYSCALL_EMU\t\t12\t/ syscall emulation active /\n #define TIF_PATCH_PENDING\t13\t/ pending live patching update /\n #define TIF_MEMDIE\t\t18\t/ is terminating due to OOM killer /\n #define TIF_FREEZE\t\t19\n@@ -94,24 +90,14 @@ void arch_setup_new_exec(void);\n #define _TIF_NEED_RESCHED_LAZY\t(1 \u003c\u003c TIF_NEED_RESCHED_LAZY)\n #define _TIF_NOTIFY_RESUME\t(1 \u003c\u003c TIF_NOTIFY_RESUME)\n #define _TIF_FOREIGN_FPSTATE\t(1 \u003c\u003c TIF_FOREIGN_FPSTATE)\n-#define _TIF_SYSCALL_TRACE\t(1 \u003c\u003c TIF_SYSCALL_TRACE)\n-#define _TIF_SYSCALL_AUDIT\t(1 \u003c\u003c TIF_SYSCALL_AUDIT)\n-#define _TIF_SYSCALL_TRACEPOINT\t(1 \u003c\u003c TIF_SYSCALL_TRACEPOINT)\n-#define _TIF_SECCOMP\t\t(1 \u003c\u003c TIF_SECCOMP)\n-#define _TIF_SYSCALL_EMU\t(1 \u003c\u003c TIF_SYSCALL_EMU)\n #define _TIF_PATCH_PENDING\t(1 \u003c\u003c TIF_PATCH_PENDING)\n #define _TIF_UPROBE\t\t(1 \u003c\u003c TIF_UPROBE)\n-#define _TIF_SINGLESTEP\t\t(1 \u003c\u003c TIF_SINGLESTEP)\n #define _TIF_32BIT\t\t(1 \u003c\u003c TIF_32BIT)\n #define _TIF_SVE\t\t(1 \u003c\u003c TIF_SVE)\n #define _TIF_MTE_ASYNC_FAULT\t(1 \u003c\u003c TIF_MTE_ASYNC_FAULT)\n #define _TIF_NOTIFY_SIGNAL\t(1 \u003c\u003c TIF_NOTIFY_SIGNAL)\n #define _TIF_TSC_SIGSEGV\t(1 \u003c\u003c TIF_TSC_SIGSEGV)\n \n-#define _TIF_SYSCALL_WORK\t(_TIF_SYSCALL_TRACE \| _TIF_SYSCALL_AUDIT \| \\\n-\t\t\t\t _TIF_SYSCALL_TRACEPOINT \| _TIF_SECCOMP \| \\\n-\t\t\t\t _TIF_SYSCALL_EMU)\n-\n #ifdef CONFIG_SHADOW_CALL_STACK\n #define INIT_SCS\t\t\t\t\t\t\t\\\n \t.scs_base\t= init_shadow_call_stack,\t\t\t\\\ndiff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c\nindex 29307642f4c904..c5368383915536 100644\n--- a/arch/arm64/kernel/debug-monitors.c\n+++ b/arch/arm64/kernel/debug-monitors.c\n@@ -385,11 +385,19 @@ void user_enable_single_step(struct task_struct task)\n \n \tif (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))\n \t\tset_regs_spsr_ss(task_pt_regs(task));\n+\n+\t/\n+\t Ensure that the generic entry code triggers a trap once stepping\n+\t * out of a system call prior to executing any user instruction,\n+\t * as the generic entry code does not natively check for TIF_SINGLESTEP.\n+\t /\n+\tset_task_syscall_work(task, SYSCALL_EXIT_TRAP);\n }\n NOKPROBE_SYMBOL(user_enable_single_step);\n \n void user_disable_single_step(struct task_struct task)\n {\n \tclear_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);\n+\tclear_task_syscall_work(task, SYSCALL_EXIT_TRAP);\n }\n NOKPROBE_SYMBOL(user_disable_single_step);\ndiff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c\nindex 4d08598e2891d3..61a66868294715 100644\n--- a/arch/arm64/kernel/ptrace.c\n+++ b/arch/arm64/kernel/ptrace.c\n@@ -8,7 +8,6 @@\n * Copyright (C) 2012 ARM Ltd.\n /\n \n-#include \u003clinux/audit.h\u003e\n #include \u003clinux/compat.h\u003e\n #include \u003clinux/kernel.h\u003e\n #include \u003clinux/sched/signal.h\u003e\n@@ -18,7 +17,6 @@\n #include \u003clinux/smp.h\u003e\n #include \u003clinux/ptrace.h\u003e\n #include \u003clinux/user.h\u003e\n-#include \u003clinux/seccomp.h\u003e\n #include \u003clinux/security.h\u003e\n #include \u003clinux/init.h\u003e\n #include \u003clinux/signal.h\u003e\n@@ -28,7 +26,6 @@\n #include \u003clinux/hw_breakpoint.h\u003e\n #include \u003clinux/regset.h\u003e\n #include \u003clinux/elf.h\u003e\n-#include \u003clinux/rseq.h\u003e\n \n #include \u003casm/compat.h\u003e\n #include \u003casm/cpufeature.h\u003e\n@@ -38,13 +35,9 @@\n #include \u003casm/mte.h\u003e\n #include \u003casm/pointer_auth.h\u003e\n #include \u003casm/stacktrace.h\u003e\n-#include \u003casm/syscall.h\u003e\n #include \u003casm/traps.h\u003e\n #include \u003casm/system_misc.h\u003e\n \n-#define CREATE_TRACE_POINTS\n-#include \u003ctrace/events/syscalls.h\u003e\n-\n struct pt_regs_offset {\n \tconst char name;\n \tint offset;\n@@ -2339,114 +2332,6 @@ long arch_ptrace(struct task_struct child, long request,\n \treturn ptrace_request(child, request, addr, data);\n }\n \n-enum ptrace_syscall_dir {\n-\tPTRACE_SYSCALL_ENTER = 0,\n-\tPTRACE_SYSCALL_EXIT,\n-};\n-\n-static __always_inline unsigned long ptrace_save_reg(struct pt_regs regs,\n-\t\t\t\t\t\t enum ptrace_syscall_dir dir,\n-\t\t\t\t\t\t int regno)\n-{\n-\tunsigned long saved_reg;\n-\n-\t/\n-\t * We have some ABI weirdness here in the way that we handle syscall\n-\t * exit stops because we indicate whether or not the stop has been\n-\t * signalled from syscall entry or syscall exit by clobbering a general\n-\t * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee\n-\t * and restoring its old value after the stop. This means that:\n-\t \n-\t - Any writes by the tracer to this register during the stop are\n-\t * ignored/discarded.\n-\t \n-\t - The actual value of the register is not available during the stop,\n-\t * so the tracer cannot save it and restore it later.\n-\t \n-\t - Syscall stops behave differently to seccomp and pseudo-step traps\n-\t * (the latter do not nobble any registers).\n-\t /\n-\tregno = (is_compat_task() ? 12 : 7);\n-\tsaved_reg = regs-\u003eregs[regno];\n-\tregs-\u003eregs[regno] = dir;\n-\n-\treturn saved_reg;\n-}\n-\n-static int report_syscall_entry(struct pt_regs regs)\n-{\n-\tunsigned long saved_reg;\n-\tint regno, ret;\n-\n-\tsaved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, \u0026regno);\n-\tret = ptrace_report_syscall_entry(regs);\n-\tif (ret)\n-\t\tforget_syscall(regs);\n-\tregs-\u003eregs[regno] = saved_reg;\n-\n-\treturn ret;\n-}\n-\n-static void report_syscall_exit(struct pt_regs regs)\n-{\n-\tunsigned long saved_reg;\n-\tint regno;\n-\n-\tsaved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_EXIT, \u0026regno);\n-\tif (!test_thread_flag(TIF_SINGLESTEP)) {\n-\t\tptrace_report_syscall_exit(regs, 0);\n-\t\tregs-\u003eregs[regno] = saved_reg;\n-\t} else {\n-\t\tregs-\u003eregs[regno] = saved_reg;\n-\n-\t\t/\n-\t\t Signal a pseudo-step exception since we are stepping but\n-\t\t * tracer modifications to the registers may have rewound the\n-\t\t * state machine.\n-\t\t /\n-\t\tptrace_report_syscall_exit(regs, 1);\n-\t}\n-}\n-\n-int syscall_trace_enter(struct pt_regs regs)\n-{\n-\tunsigned long flags = read_thread_flags();\n-\tint ret;\n-\n-\tif (flags \u0026 (_TIF_SYSCALL_EMU \| _TIF_SYSCALL_TRACE)) {\n-\t\tret = report_syscall_entry(regs);\n-\t\tif (ret \|\| (flags \u0026 _TIF_SYSCALL_EMU))\n-\t\t\treturn NO_SYSCALL;\n-\t}\n-\n-\t/* Do the secure computing after ptrace; failures should be fast. /\n-\tif (secure_computing() == -1)\n-\t\treturn NO_SYSCALL;\n-\n-\tif (test_thread_flag(TIF_SYSCALL_TRACEPOINT))\n-\t\ttrace_sys_enter(regs, regs-\u003esyscallno);\n-\n-\taudit_syscall_entry(regs-\u003esyscallno, regs-\u003eorig_x0, regs-\u003eregs[1],\n-\t\t\t regs-\u003eregs[2], regs-\u003eregs[3]);\n-\n-\treturn regs-\u003esyscallno;\n-}\n-\n-void syscall_trace_exit(struct pt_regs regs)\n-{\n-\tunsigned long flags = read_thread_flags();\n-\n-\taudit_syscall_exit(regs);\n-\n-\tif (flags \u0026 _TIF_SYSCALL_TRACEPOINT)\n-\t\ttrace_sys_exit(regs, syscall_get_return_value(current, regs));\n-\n-\tif (flags \u0026 (_TIF_SYSCALL_TRACE \| _TIF_SINGLESTEP))\n-\t\treport_syscall_exit(regs);\n-\n-\trseq_syscall(regs);\n-}\n-\n /\n SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487D.a.\n * We permit userspace to set SSBS (AArch64 bit 12, AArch32 bit 23) which is\ndiff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c\nindex 38e6fa204c17b5..093eebb9d764ac 100644\n--- a/arch/arm64/kernel/signal.c\n+++ b/arch/arm64/kernel/signal.c\n@@ -8,8 +8,8 @@\n \n #include \u003clinux/cache.h\u003e\n #include \u003clinux/compat.h\u003e\n+#include \u003clinux/entry-common.h\u003e\n #include \u003clinux/errno.h\u003e\n-#include \u003clinux/irq-entry-common.h\u003e\n #include \u003clinux/kernel.h\u003e\n #include \u003clinux/signal.h\u003e\n #include \u003clinux/freezer.h\u003e\ndiff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c\nindex 358ddfbf1401ac..e0a98fac3b8567 100644\n--- a/arch/arm64/kernel/syscall.c\n+++ b/arch/arm64/kernel/syscall.c\n@@ -2,6 +2,7 @@\n \n #include \u003clinux/compiler.h\u003e\n #include \u003clinux/context_tracking.h\u003e\n+#include \u003clinux/entry-common.h\u003e\n #include \u003clinux/errno.h\u003e\n #include \u003clinux/nospec.h\u003e\n #include \u003clinux/ptrace.h\u003e\n@@ -54,15 +55,11 @@ static void invoke_syscall(struct pt_regs regs, unsigned int scno,\n \tsyscall_set_return_value(current, regs, 0, ret);\n }\n \n-static inline bool has_syscall_work(unsigned long flags)\n-{\n-\treturn unlikely(flags \u0026 _TIF_SYSCALL_WORK);\n-}\n-\n-static void el0_svc_common(struct pt_regs regs, int scno, int sc_nr,\n-\t\t\t const syscall_fn_t syscall_table[])\n+static __always_inline void el0_svc_common(struct pt_regs regs, int scno, int sc_nr,\n+\t\t\t\t\t const syscall_fn_t syscall_table[])\n {\n \tunsigned long flags = read_thread_flags();\n+\tunsigned long work;\n \n \tregs-\u003eorig_x0 = regs-\u003eregs[0];\n \tregs-\u003esyscallno = scno;\n@@ -95,7 +92,8 @@ static void el0_svc_common(struct pt_regs regs, int scno, int sc_nr,\n \t\treturn;\n \t}\n \n-\tif (has_syscall_work(flags)) {\n+\twork = READ_ONCE(current_thread_info()-\u003esyscall_work);\n+\tif (unlikely(work \u0026 SYSCALL_WORK_ENTER)) {\n \t\t/\n \t\t The de-facto standard way to skip a system call using ptrace\n \t\t * is to set the system call to -1 (NO_SYSCALL) and set x0 to a\n@@ -113,26 +111,14 @@ static void el0_svc_common(struct pt_regs regs, int scno, int sc_nr,\n \t\t /\n \t\tif (scno == NO_SYSCALL)\n \t\t\tsyscall_set_return_value(current, regs, -ENOSYS, 0);\n-\t\tscno = syscall_trace_enter(regs);\n+\t\tscno = syscall_trace_enter(regs, work);\n \t\tif (scno == NO_SYSCALL)\n \t\t\tgoto trace_exit;\n \t}\n \n \tinvoke_syscall(regs, scno, sc_nr, syscall_table);\n-\n-\t/\n-\t The tracing status may have changed under our feet, so we have to\n-\t * check again. However, if we were tracing entry, then we always trace\n-\t * exit regardless, as the old entry assembly did.\n-\t /\n-\tif (!has_syscall_work(flags) \u0026\u0026 !IS_ENABLED(CONFIG_DEBUG_RSEQ)) {\n-\t\tflags = read_thread_flags();\n-\t\tif (!has_syscall_work(flags) \u0026\u0026 !(flags \u0026 _TIF_SINGLESTEP))\n-\t\t\treturn;\n-\t}\n-\n trace_exit:\n-\tsyscall_trace_exit(regs);\n+\tsyscall_exit_to_user_mode_work(regs);\n }\n \n void do_el0_svc(struct pt_regs regs)\ndiff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c\nindex 592dd8668de463..5a0314a3c26e82 100644\n--- a/arch/arm64/kernel/vdso.c\n+++ b/arch/arm64/kernel/vdso.c\n@@ -343,3 +343,19 @@ int arch_setup_additional_pages(struct linux_binprm bprm, int uses_interp)\n \n \treturn ret;\n }\n+\n+bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\n+{\n+\tunsigned long sigtramp;\n+\n+#ifdef CONFIG_COMPAT\n+\tif (is_compat_task()) {\n+\t\tunsigned long sigpage = (unsigned long)current-\u003emm-\u003econtext.sigpage;\n+\n+\t\treturn regs-\u003epc \u003e= sigpage \u0026\u0026 regs-\u003epc \u003c (sigpage + PAGE_SIZE);\n+\t}\n+#endif\n+\tsigtramp = (unsigned long)VDSO_SYMBOL(current-\u003emm-\u003econtext.vdso, sigtramp);\n+\n+\treturn regs-\u003epc == (sigtramp + 8);\n+}\ndiff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c\nindex 6bb685a2646b56..11c5eff41e9d6a 100644\n--- a/arch/csky/kernel/ptrace.c\n+++ b/arch/csky/kernel/ptrace.c\n@@ -323,7 +323,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs regs)\n \t\tif (ptrace_report_syscall_entry(regs))\n \t\t\treturn -1;\n \n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n \n \tif (test_thread_flag(TIF_SYSCALL_TRACEPOINT))\ndiff --git a/arch/loongarch/include/asm/syscall.h b/arch/loongarch/include/asm/syscall.h\nindex df8ea223c77b1a..946886794cedf0 100644\n--- a/arch/loongarch/include/asm/syscall.h\n+++ b/arch/loongarch/include/asm/syscall.h\n@@ -85,9 +85,4 @@ static inline int syscall_get_arch(struct task_struct task)\n #endif\n }\n \n-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\n-{\n-\treturn false;\n-}\n-\n #endif\t/ __ASM_LOONGARCH_SYSCALL_H /\ndiff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c\nindex cfa2df24eced12..d2411404b9dfcf 100644\n--- a/arch/m68k/kernel/ptrace.c\n+++ b/arch/m68k/kernel/ptrace.c\n@@ -281,7 +281,7 @@ asmlinkage int syscall_trace_enter(void)\n \tif (test_thread_flag(TIF_SYSCALL_TRACE))\n \t\tret = ptrace_report_syscall_entry(task_pt_regs(current));\n \n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n \n \treturn ret;\ndiff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c\nindex 3f4c94c8812417..0d809cda754292 100644\n--- a/arch/mips/kernel/ptrace.c\n+++ b/arch/mips/kernel/ptrace.c\n@@ -1328,7 +1328,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs regs)\n \t\t\treturn -1;\n \t}\n \n-\tif (secure_computing())\n+\tif (!secure_computing())\n \t\treturn -1;\n \n \tif (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))\ndiff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c\nindex 8a17ab7e6e0b93..565b51a48c8a87 100644\n--- a/arch/parisc/kernel/ptrace.c\n+++ b/arch/parisc/kernel/ptrace.c\n@@ -351,7 +351,7 @@ long do_syscall_trace_enter(struct pt_regs regs)\n \t}\n \n \t/ Do the secure computing check after ptrace. /\n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n \n #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS\ndiff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h\nindex 834fcc4f7b543b..4b3c52ed6e9d2b 100644\n--- a/arch/powerpc/include/asm/syscall.h\n+++ b/arch/powerpc/include/asm/syscall.h\n@@ -139,9 +139,4 @@ static inline int syscall_get_arch(struct task_struct task)\n \telse\n \t\treturn AUDIT_ARCH_PPC64;\n }\n-\n-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\n-{\n-\treturn false;\n-}\n #endif\t/ _ASM_SYSCALL_H /\ndiff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h\nindex 8067e666a4ca68..987c9a78806f78 100644\n--- a/arch/riscv/include/asm/syscall.h\n+++ b/arch/riscv/include/asm/syscall.h\n@@ -112,11 +112,6 @@ static inline void syscall_handler(struct pt_regs regs, ulong syscall)\n \tregs-\u003ea0 = fn(regs);\n }\n \n-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\n-{\n-\treturn false;\n-}\n-\n asmlinkage long sys_riscv_flush_icache(uintptr_t, uintptr_t, uintptr_t);\n \n asmlinkage long sys_riscv_hwprobe(struct riscv_hwprobe , size_t, size_t,\ndiff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h\nindex 4271e4169f45b6..5f310caad1fcec 100644\n--- a/arch/s390/include/asm/syscall.h\n+++ b/arch/s390/include/asm/syscall.h\n@@ -89,11 +89,6 @@ static inline int syscall_get_arch(struct task_struct task)\n \treturn AUDIT_ARCH_S390X;\n }\n \n-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\n-{\n-\treturn false;\n-}\n-\n #define SYSCALL_FMT_0\n #define SYSCALL_FMT_1 , \"0\" (r2)\n #define SYSCALL_FMT_2 , \"d\" (r3) SYSCALL_FMT_1\ndiff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c\nindex 06f765d71a2951..8687f17cbe5adc 100644\n--- a/arch/sh/kernel/ptrace_32.c\n+++ b/arch/sh/kernel/ptrace_32.c\n@@ -460,7 +460,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs regs)\n \t\treturn -1;\n \t}\n \n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n \n \tif (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))\ndiff --git a/arch/um/kernel/skas/syscall.c b/arch/um/kernel/skas/syscall.c\nindex ba7494f9bfe412..916cd7acceafdf 100644\n--- a/arch/um/kernel/skas/syscall.c\n+++ b/arch/um/kernel/skas/syscall.c\n@@ -27,7 +27,7 @@ void handle_syscall(struct uml_pt_regs r)\n \t\tgoto out;\n \n \t/* Do the seccomp check after ptrace; failures should be fast. /\n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\tgoto out;\n \n \tsyscall = UPT_SYSCALL_NR(r);\ndiff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c\nindex ea36de9fa8641d..6aed3987b9f966 100644\n--- a/arch/x86/entry/vsyscall/vsyscall_64.c\n+++ b/arch/x86/entry/vsyscall/vsyscall_64.c\n@@ -198,7 +198,7 @@ static bool __emulate_vsyscall(struct pt_regs regs, unsigned long address)\n \tregs-\u003eorig_ax = syscall_nr;\n \tregs-\u003eax = -ENOSYS;\n \ttmp = secure_computing();\n-\tif ((!tmp \u0026\u0026 regs-\u003eorig_ax != syscall_nr) \|\| regs-\u003eip != address) {\n+\tif ((tmp \u0026\u0026 regs-\u003eorig_ax != syscall_nr) \|\| regs-\u003eip != address) {\n \t\twarn_bad_vsyscall(KERN_DEBUG, regs,\n \t\t\t\t \"seccomp tried to change syscall nr or ip\");\n \t\tforce_exit_sig(SIGSYS);\ndiff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c\nindex b80d54b2ea34e6..ef78fcd318ffcc 100644\n--- a/arch/xtensa/kernel/ptrace.c\n+++ b/arch/xtensa/kernel/ptrace.c\n@@ -553,8 +553,7 @@ int do_syscall_trace_enter(struct pt_regs regs)\n \t\treturn 0;\n \t}\n \n-\tif (regs-\u003esyscall == NO_SYSCALL \|\|\n-\t secure_computing() == -1) {\n+\tif (regs-\u003esyscall == NO_SYSCALL \|\| !secure_computing()) {\n \t\tdo_syscall_trace_leave(regs);\n \t\treturn 0;\n \t}\ndiff --git a/include/linux/entry-common.h b/include/linux/entry-common.h\nindex 416a3352261fe8..3f66320e46d331 100644\n--- a/include/linux/entry-common.h\n+++ b/include/linux/entry-common.h\n@@ -100,9 +100,8 @@ static __always_inline long syscall_trace_enter(struct pt_regs regs, unsigned l\n \n \t/* Do seccomp after ptrace, to catch any tracer changes. /\n \tif (work \u0026 SYSCALL_WORK_SECCOMP) {\n-\t\tret = __secure_computing();\n-\t\tif (ret == -1L)\n-\t\t\treturn ret;\n+\t\tif (!__secure_computing())\n+\t\t\treturn -1L;\n \t}\n \n \t/ Either of the above might have changed the syscall number /\n@@ -113,7 +112,7 @@ static __always_inline long syscall_trace_enter(struct pt_regs regs, unsigned l\n \n \tsyscall_enter_audit(regs, syscall);\n \n-\treturn ret ? : syscall;\n+\treturn syscall;\n }\n \n /*\ndiff --git a/include/linux/seccomp.h b/include/linux/seccomp.h\nindex 9b959972bf4a22..7af3173f40e985 100644\n--- a/include/linux/seccomp.h\n+++ b/include/linux/seccomp.h\n@@ -22,14 +22,14 @@\n #include \u003clinux/atomic.h\u003e\n #include \u003casm/seccomp.h\u003e\n \n-extern int __secure_computing(void);\n+extern bool __secure_computing(void);\n \n #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER\n-static inline int secure_computing(void)\n+static inline bool secure_computing(void)\n {\n \tif (unlikely(test_syscall_work(SECCOMP)))\n \t\treturn __secure_computing();\n-\treturn 0;\n+\treturn true;\n }\n #else\n extern void secure_computing_strict(int this_syscall);\n@@ -50,11 +50,11 @@ static inline int seccomp_mode(struct seccomp s)\n struct seccomp_data;\n \n #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER\n-static inline int secure_computing(void) { return 0; }\n+static inline bool secure_computing(void) { return true; }\n #else\n static inline void secure_computing_strict(int this_syscall) { return; }\n #endif\n-static inline int __secure_computing(void) { return 0; }\n+static inline bool __secure_computing(void) { return true; }\n \n static inline long prctl_get_seccomp(void)\n {\ndiff --git a/include/linux/syscall_user_dispatch.h b/include/linux/syscall_user_dispatch.h\nindex 3858a6ffdd5c84..73d69e02807d85 100644\n--- a/include/linux/syscall_user_dispatch.h\n+++ b/include/linux/syscall_user_dispatch.h\n@@ -10,6 +10,7 @@\n \n #ifdef CONFIG_GENERIC_ENTRY\n \n+bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs);\n int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,\n \t\t\t unsigned long len, char __user selector);\n \ndiff --git a/kernel/entry/syscall_user_dispatch.c b/kernel/entry/syscall_user_dispatch.c\nindex d89dffcc2d6429..acf545774d3720 100644\n--- a/kernel/entry/syscall_user_dispatch.c\n+++ b/kernel/entry/syscall_user_dispatch.c\n@@ -32,6 +32,11 @@ static void trigger_sigsys(struct pt_regs regs)\n \tforce_sig_info(\u0026info);\n }\n \n+bool __weak arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\n+{\n+\treturn false;\n+}\n+\n bool syscall_user_dispatch(struct pt_regs regs)\n {\n \tstruct syscall_user_dispatch sd = \u0026current-\u003esyscall_dispatch;\ndiff --git a/kernel/seccomp.c b/kernel/seccomp.c\nindex 066909393c38f5..1fec6efedab627 100644\n--- a/kernel/seccomp.c\n+++ b/kernel/seccomp.c\n@@ -1100,12 +1100,12 @@ void secure_computing_strict(int this_syscall)\n \telse\n \t\tBUG();\n }\n-int __secure_computing(void)\n+bool __secure_computing(void)\n {\n \tint this_syscall = syscall_get_nr(current, current_pt_regs());\n \n \tsecure_computing_strict(this_syscall);\n-\treturn 0;\n+\treturn true;\n }\n #else\n \n@@ -1256,7 +1256,7 @@ static int seccomp_do_user_notification(int this_syscall,\n \treturn -1;\n }\n \n-static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n+static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n {\n \tu32 filter_ret, action;\n \tstruct seccomp_data sd;\n@@ -1294,7 +1294,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n \tcase SECCOMP_RET_TRACE:\n \t\t/* We've been put in this state by the ptracer already. /\n \t\tif (recheck_after_trace)\n-\t\t\treturn 0;\n+\t\t\treturn true;\n \n \t\t/ ENOSYS these calls if there is no tracer attached. /\n \t\tif (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {\n@@ -1330,19 +1330,19 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n \t\t a skip would have already been reported.\n \t\t /\n \t\tif (__seccomp_filter(this_syscall, true))\n-\t\t\treturn -1;\n+\t\t\treturn false;\n \n-\t\treturn 0;\n+\t\treturn true;\n \n \tcase SECCOMP_RET_USER_NOTIF:\n \t\tif (seccomp_do_user_notification(this_syscall, match, \u0026sd))\n \t\t\tgoto skip;\n \n-\t\treturn 0;\n+\t\treturn true;\n \n \tcase SECCOMP_RET_LOG:\n \t\tseccomp_log(this_syscall, 0, action, true);\n-\t\treturn 0;\n+\t\treturn true;\n \n \tcase SECCOMP_RET_ALLOW:\n \t\t/\n@@ -1350,7 +1350,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n \t\t * this action since SECCOMP_RET_ALLOW is the starting\n \t\t * state in seccomp_run_filters().\n \t\t /\n-\t\treturn 0;\n+\t\treturn true;\n \n \tcase SECCOMP_RET_KILL_THREAD:\n \tcase SECCOMP_RET_KILL_PROCESS:\n@@ -1367,46 +1367,46 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n \t\t} else {\n \t\t\tdo_exit(SIGSYS);\n \t\t}\n-\t\treturn -1; / skip the syscall go directly to signal handling /\n+\t\treturn false; / skip the syscall go directly to signal handling /\n \t}\n \n \tunreachable();\n \n skip:\n \tseccomp_log(this_syscall, 0, action, match ? match-\u003elog : false);\n-\treturn -1;\n+\treturn false;\n }\n #else\n-static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n+static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n {\n \tBUG();\n \n-\treturn -1;\n+\treturn false;\n }\n #endif\n \n-int __secure_computing(void)\n+bool __secure_computing(void)\n {\n \tint mode = current-\u003eseccomp.mode;\n \tint this_syscall;\n \n \tif (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) \u0026\u0026\n \t unlikely(current-\u003eptrace \u0026 PT_SUSPEND_SECCOMP))\n-\t\treturn 0;\n+\t\treturn true;\n \n \tthis_syscall = syscall_get_nr(current, current_pt_regs());\n \n \tswitch (mode) {\n \tcase SECCOMP_MODE_STRICT:\n \t\t__secure_computing_strict(this_syscall); / may call do_exit /\n-\t\treturn 0;\n+\t\treturn true;\n \tcase SECCOMP_MODE_FILTER:\n \t\treturn __seccomp_filter(this_syscall, false);\n \t/ Surviving SECCOMP_RET_KILL_* must be proactively impossible. */\n \tcase SECCOMP_MODE_DEAD:\n \t\tWARN_ON_ONCE(1);\n \t\tdo_exit(SIGKILL);\n-\t\treturn -1;\n+\t\treturn false;\n \tdefault:\n \t\tBUG();\n \t}\n" }
2/1	2026/06/29 15:27	agent	patch-evaluator	4m Model: gemini-3.1-pro-preview Args: null Results: { "EnableConfigs": [ "SECCOMP", "SECCOMP_FILTER", "COMPAT" ], "FocusSymbols": [ "arch_syscall_is_vdso_sigreturn", "user_enable_single_step", "user_disable_single_step" ], "Reasoning": "The patch migrates arm64 to use the generic entry code for system calls, replacing custom arm64 syscall entry/exit tracing with generic hooks. It also modifies secure_computing() tree-wide to return a boolean. This is a major functional change to the core syscall path on arm64 and seccomp handling. Fuzzing should focus on the newly added arm64-specific generic entry hooks (e.g., arch_syscall_is_vdso_sigreturn) and ptrace single-step toggling which was modified to interact with generic entry. SECCOMP and COMPAT configs are required to exercise the modified seccomp logic and compat vdso checks.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 03669f942eb53ede0f9214de36e8cf43b018989d Author: syz-cluster <triage@syzkaller.com> Date: Mon Jun 29 15:27:46 2026 +0000 syz-cluster: applied patch under review diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c index 0687760ea46698..27d9847b108237 100644 --- a/arch/alpha/kernel/ptrace.c +++ b/arch/alpha/kernel/ptrace.c @@ -387,7 +387,7 @@ asmlinkage unsigned long syscall_trace_enter(void) * If this fails, seccomp may already have set up the return value * (e.g. SECCOMP_RET_ERRNO / TRACE). / - if (secure_computing() == -1) { + if (!secure_computing()) { if (regs->r19 == 0 && regs->r0 == (unsigned long)-1) syscall_set_return_value(current, regs, -ENOSYS, 0); syscall_set_nr(current, regs, -1); diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c index 7951b2c06fec60..5210745725ca7d 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c @@ -855,7 +855,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs regs) /* Do seccomp after ptrace; syscall may have changed. / #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER - if (secure_computing() == -1) + if (!secure_computing()) return -1; #else / XXX: remove this once OABI gets fixed / diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index b3afe0688919bd..aea686dce3d5ac 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -128,9 +128,9 @@ config ARM64 select GENERIC_CPU_DEVICES select GENERIC_CPU_VULNERABILITIES select GENERIC_EARLY_IOREMAP + select GENERIC_ENTRY select GENERIC_IDLE_POLL_SETUP select GENERIC_IOREMAP - select GENERIC_IRQ_ENTRY select GENERIC_IRQ_IPI select GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD select GENERIC_IRQ_PROBE diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h index d2779d604c7be2..f43d4dea916a5b 100644 --- a/arch/arm64/include/asm/elf.h +++ b/arch/arm64/include/asm/elf.h @@ -185,6 +185,7 @@ do { \ struct linux_binprm; extern int arch_setup_additional_pages(struct linux_binprm bprm, int uses_interp); +extern bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs); / 1GB of VA / #ifdef CONFIG_COMPAT diff --git a/arch/arm64/include/asm/entry-common.h b/arch/arm64/include/asm/entry-common.h index cab8cd78f69385..d8bf4bf342e80f 100644 --- a/arch/arm64/include/asm/entry-common.h +++ b/arch/arm64/include/asm/entry-common.h @@ -3,14 +3,21 @@ #ifndef _ASM_ARM64_ENTRY_COMMON_H #define _ASM_ARM64_ENTRY_COMMON_H +#include <linux/ptrace.h> #include <linux/thread_info.h> +#include <asm/compat.h> #include <asm/cpufeature.h> #include <asm/daifflags.h> #include <asm/fpsimd.h> #include <asm/mte.h> #include <asm/stacktrace.h> +enum ptrace_syscall_dir { + PTRACE_SYSCALL_ENTER = 0, + PTRACE_SYSCALL_EXIT, +}; + #define ARCH_EXIT_TO_USER_MODE_WORK (_TIF_MTE_ASYNC_FAULT \| _TIF_FOREIGN_FPSTATE) static __always_inline void arch_exit_to_user_mode_work(struct pt_regs regs, @@ -54,4 +61,73 @@ static inline bool arch_irqentry_exit_need_resched(void) #define arch_irqentry_exit_need_resched arch_irqentry_exit_need_resched +static __always_inline unsigned long ptrace_save_reg(struct pt_regs regs, + enum ptrace_syscall_dir dir, + int regno) +{ + unsigned long saved_reg; + + /* + * We have some ABI weirdness here in the way that we handle syscall + * exit stops because we indicate whether or not the stop has been + * signalled from syscall entry or syscall exit by clobbering a general + * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee + * and restoring its old value after the stop. This means that: + * + * - Any writes by the tracer to this register during the stop are + * ignored/discarded. + * + * - The actual value of the register is not available during the stop, + * so the tracer cannot save it and restore it later. + * + * - Syscall stops behave differently to seccomp and pseudo-step traps + * (the latter do not nobble any registers). + / + regno = (is_compat_task() ? 12 : 7); + saved_reg = regs->regs[regno]; + regs->regs[regno] = dir; + + return saved_reg; +} + +static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs regs) +{ + unsigned long saved_reg; + int regno, ret; + + saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, &regno); + ret = ptrace_report_syscall_entry(regs); + if (ret) + forget_syscall(regs); + regs->regs[regno] = saved_reg; + + return ret; +} + +#define arch_ptrace_report_syscall_entry arch_ptrace_report_syscall_entry + +static __always_inline void arch_ptrace_report_syscall_exit(struct pt_regs regs, + int step) +{ + unsigned long saved_reg; + int regno; + + saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_EXIT, &regno); + if (!step) { + ptrace_report_syscall_exit(regs, 0); + regs->regs[regno] = saved_reg; + } else { + regs->regs[regno] = saved_reg; + + /* + * Signal a pseudo-step exception since we are stepping but + * tracer modifications to the registers may have rewound the + * state machine. + / + ptrace_report_syscall_exit(regs, 1); + } +} + +#define arch_ptrace_report_syscall_exit arch_ptrace_report_syscall_exit + #endif / _ASM_ARM64_ENTRY_COMMON_H / diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h index 5e4c7fc44f7315..84b1c36233d41e 100644 --- a/arch/arm64/include/asm/syscall.h +++ b/arch/arm64/include/asm/syscall.h @@ -8,6 +8,7 @@ #include <uapi/linux/audit.h> #include <linux/compat.h> #include <linux/err.h> +#include <linux/rseq.h> typedef long (syscall_fn_t)(const struct pt_regs regs); @@ -120,7 +121,4 @@ static inline int syscall_get_arch(struct task_struct task) return AUDIT_ARCH_AARCH64; } -int syscall_trace_enter(struct pt_regs regs); -void syscall_trace_exit(struct pt_regs regs); - #endif /* __ASM_SYSCALL_H / diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h index 5d7fe3e153c850..3f621ba0f96137 100644 --- a/arch/arm64/include/asm/thread_info.h +++ b/arch/arm64/include/asm/thread_info.h @@ -46,6 +46,7 @@ struct thread_info { u64 mpam_partid_pmg; #endif u32 cpu; + unsigned long syscall_work; / SYSCALL_WORK_ flags / }; #define thread_saved_pc(tsk) \ @@ -68,11 +69,6 @@ void arch_setup_new_exec(void); #define TIF_UPROBE 5 / uprobe breakpoint or singlestep / #define TIF_MTE_ASYNC_FAULT 6 / MTE Asynchronous Tag Check Fault / #define TIF_NOTIFY_SIGNAL 7 / signal notifications exist / -#define TIF_SYSCALL_TRACE 8 / syscall trace active / -#define TIF_SYSCALL_AUDIT 9 / syscall auditing / -#define TIF_SYSCALL_TRACEPOINT 10 / syscall tracepoint for ftrace / -#define TIF_SECCOMP 11 / syscall secure computing / -#define TIF_SYSCALL_EMU 12 / syscall emulation active / #define TIF_PATCH_PENDING 13 / pending live patching update / #define TIF_MEMDIE 18 / is terminating due to OOM killer / #define TIF_FREEZE 19 @@ -94,24 +90,14 @@ void arch_setup_new_exec(void); #define _TIF_NEED_RESCHED_LAZY (1 << TIF_NEED_RESCHED_LAZY) #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME) #define _TIF_FOREIGN_FPSTATE (1 << TIF_FOREIGN_FPSTATE) -#define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE) -#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT) -#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT) -#define _TIF_SECCOMP (1 << TIF_SECCOMP) -#define _TIF_SYSCALL_EMU (1 << TIF_SYSCALL_EMU) #define _TIF_PATCH_PENDING (1 << TIF_PATCH_PENDING) #define _TIF_UPROBE (1 << TIF_UPROBE) -#define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP) #define _TIF_32BIT (1 << TIF_32BIT) #define _TIF_SVE (1 << TIF_SVE) #define _TIF_MTE_ASYNC_FAULT (1 << TIF_MTE_ASYNC_FAULT) #define _TIF_NOTIFY_SIGNAL (1 << TIF_NOTIFY_SIGNAL) #define _TIF_TSC_SIGSEGV (1 << TIF_TSC_SIGSEGV) -#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE \| _TIF_SYSCALL_AUDIT \| \ - _TIF_SYSCALL_TRACEPOINT \| _TIF_SECCOMP \| \ - _TIF_SYSCALL_EMU) - #ifdef CONFIG_SHADOW_CALL_STACK #define INIT_SCS \ .scs_base = init_shadow_call_stack, \ diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c index 29307642f4c904..c5368383915536 100644 --- a/arch/arm64/kernel/debug-monitors.c +++ b/arch/arm64/kernel/debug-monitors.c @@ -385,11 +385,19 @@ void user_enable_single_step(struct task_struct task) if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP)) set_regs_spsr_ss(task_pt_regs(task)); + + /* + * Ensure that the generic entry code triggers a trap once stepping + * out of a system call prior to executing any user instruction, + * as the generic entry code does not natively check for TIF_SINGLESTEP. + / + set_task_syscall_work(task, SYSCALL_EXIT_TRAP); } NOKPROBE_SYMBOL(user_enable_single_step); void user_disable_single_step(struct task_struct task) { clear_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP); + clear_task_syscall_work(task, SYSCALL_EXIT_TRAP); } NOKPROBE_SYMBOL(user_disable_single_step); diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 4d08598e2891d3..61a66868294715 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -8,7 +8,6 @@ * Copyright (C) 2012 ARM Ltd. / -#include <linux/audit.h> #include <linux/compat.h> #include <linux/kernel.h> #include <linux/sched/signal.h> @@ -18,7 +17,6 @@ #include <linux/smp.h> #include <linux/ptrace.h> #include <linux/user.h> -#include <linux/seccomp.h> #include <linux/security.h> #include <linux/init.h> #include <linux/signal.h> @@ -28,7 +26,6 @@ #include <linux/hw_breakpoint.h> #include <linux/regset.h> #include <linux/elf.h> -#include <linux/rseq.h> #include <asm/compat.h> #include <asm/cpufeature.h> @@ -38,13 +35,9 @@ #include <asm/mte.h> #include <asm/pointer_auth.h> #include <asm/stacktrace.h> -#include <asm/syscall.h> #include <asm/traps.h> #include <asm/system_misc.h> -#define CREATE_TRACE_POINTS -#include <trace/events/syscalls.h> - struct pt_regs_offset { const char name; int offset; @@ -2339,114 +2332,6 @@ long arch_ptrace(struct task_struct child, long request, return ptrace_request(child, request, addr, data); } -enum ptrace_syscall_dir { - PTRACE_SYSCALL_ENTER = 0, - PTRACE_SYSCALL_EXIT, -}; - -static __always_inline unsigned long ptrace_save_reg(struct pt_regs regs, - enum ptrace_syscall_dir dir, - int regno) -{ - unsigned long saved_reg; - - / - * We have some ABI weirdness here in the way that we handle syscall - * exit stops because we indicate whether or not the stop has been - * signalled from syscall entry or syscall exit by clobbering a general - * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee - * and restoring its old value after the stop. This means that: - * - * - Any writes by the tracer to this register during the stop are - * ignored/discarded. - * - * - The actual value of the register is not available during the stop, - * so the tracer cannot save it and restore it later. - * - * - Syscall stops behave differently to seccomp and pseudo-step traps - * (the latter do not nobble any registers). - / - regno = (is_compat_task() ? 12 : 7); - saved_reg = regs->regs[regno]; - regs->regs[regno] = dir; - - return saved_reg; -} - -static int report_syscall_entry(struct pt_regs regs) -{ - unsigned long saved_reg; - int regno, ret; - - saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, &regno); - ret = ptrace_report_syscall_entry(regs); - if (ret) - forget_syscall(regs); - regs->regs[regno] = saved_reg; - - return ret; -} - -static void report_syscall_exit(struct pt_regs regs) -{ - unsigned long saved_reg; - int regno; - - saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_EXIT, &regno); - if (!test_thread_flag(TIF_SINGLESTEP)) { - ptrace_report_syscall_exit(regs, 0); - regs->regs[regno] = saved_reg; - } else { - regs->regs[regno] = saved_reg; - - /* - * Signal a pseudo-step exception since we are stepping but - * tracer modifications to the registers may have rewound the - * state machine. - / - ptrace_report_syscall_exit(regs, 1); - } -} - -int syscall_trace_enter(struct pt_regs regs) -{ - unsigned long flags = read_thread_flags(); - int ret; - - if (flags & (_TIF_SYSCALL_EMU \| _TIF_SYSCALL_TRACE)) { - ret = report_syscall_entry(regs); - if (ret \|\| (flags & _TIF_SYSCALL_EMU)) - return NO_SYSCALL; - } - - /* Do the secure computing after ptrace; failures should be fast. / - if (secure_computing() == -1) - return NO_SYSCALL; - - if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) - trace_sys_enter(regs, regs->syscallno); - - audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1], - regs->regs[2], regs->regs[3]); - - return regs->syscallno; -} - -void syscall_trace_exit(struct pt_regs regs) -{ - unsigned long flags = read_thread_flags(); - - audit_syscall_exit(regs); - - if (flags & _TIF_SYSCALL_TRACEPOINT) - trace_sys_exit(regs, syscall_get_return_value(current, regs)); - - if (flags & (_TIF_SYSCALL_TRACE \| _TIF_SINGLESTEP)) - report_syscall_exit(regs); - - rseq_syscall(regs); -} - /* * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487D.a. * We permit userspace to set SSBS (AArch64 bit 12, AArch32 bit 23) which is diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index 38e6fa204c17b5..093eebb9d764ac 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -8,8 +8,8 @@ #include <linux/cache.h> #include <linux/compat.h> +#include <linux/entry-common.h> #include <linux/errno.h> -#include <linux/irq-entry-common.h> #include <linux/kernel.h> #include <linux/signal.h> #include <linux/freezer.h> diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c index 358ddfbf1401ac..e0a98fac3b8567 100644 --- a/arch/arm64/kernel/syscall.c +++ b/arch/arm64/kernel/syscall.c @@ -2,6 +2,7 @@ #include <linux/compiler.h> #include <linux/context_tracking.h> +#include <linux/entry-common.h> #include <linux/errno.h> #include <linux/nospec.h> #include <linux/ptrace.h> @@ -54,15 +55,11 @@ static void invoke_syscall(struct pt_regs regs, unsigned int scno, syscall_set_return_value(current, regs, 0, ret); } -static inline bool has_syscall_work(unsigned long flags) -{ - return unlikely(flags & _TIF_SYSCALL_WORK); -} - -static void el0_svc_common(struct pt_regs regs, int scno, int sc_nr, - const syscall_fn_t syscall_table[]) +static __always_inline void el0_svc_common(struct pt_regs regs, int scno, int sc_nr, + const syscall_fn_t syscall_table[]) { unsigned long flags = read_thread_flags(); + unsigned long work; regs->orig_x0 = regs->regs[0]; regs->syscallno = scno; @@ -95,7 +92,8 @@ static void el0_svc_common(struct pt_regs regs, int scno, int sc_nr, return; } - if (has_syscall_work(flags)) { + work = READ_ONCE(current_thread_info()->syscall_work); + if (unlikely(work & SYSCALL_WORK_ENTER)) { /* * The de-facto standard way to skip a system call using ptrace * is to set the system call to -1 (NO_SYSCALL) and set x0 to a @@ -113,26 +111,14 @@ static void el0_svc_common(struct pt_regs regs, int scno, int sc_nr, / if (scno == NO_SYSCALL) syscall_set_return_value(current, regs, -ENOSYS, 0); - scno = syscall_trace_enter(regs); + scno = syscall_trace_enter(regs, work); if (scno == NO_SYSCALL) goto trace_exit; } invoke_syscall(regs, scno, sc_nr, syscall_table); - - /* - * The tracing status may have changed under our feet, so we have to - * check again. However, if we were tracing entry, then we always trace - * exit regardless, as the old entry assembly did. - / - if (!has_syscall_work(flags) && !IS_ENABLED(CONFIG_DEBUG_RSEQ)) { - flags = read_thread_flags(); - if (!has_syscall_work(flags) && !(flags & _TIF_SINGLESTEP)) - return; - } - trace_exit: - syscall_trace_exit(regs); + syscall_exit_to_user_mode_work(regs); } void do_el0_svc(struct pt_regs regs) diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c index 592dd8668de463..5a0314a3c26e82 100644 --- a/arch/arm64/kernel/vdso.c +++ b/arch/arm64/kernel/vdso.c @@ -343,3 +343,19 @@ int arch_setup_additional_pages(struct linux_binprm bprm, int uses_interp) return ret; } + +bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs) +{ + unsigned long sigtramp; + +#ifdef CONFIG_COMPAT + if (is_compat_task()) { + unsigned long sigpage = (unsigned long)current->mm->context.sigpage; + + return regs->pc >= sigpage && regs->pc < (sigpage + PAGE_SIZE); + } +#endif + sigtramp = (unsigned long)VDSO_SYMBOL(current->mm->context.vdso, sigtramp); + + return regs->pc == (sigtramp + 8); +} diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c index 6bb685a2646b56..11c5eff41e9d6a 100644 --- a/arch/csky/kernel/ptrace.c +++ b/arch/csky/kernel/ptrace.c @@ -323,7 +323,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs regs) if (ptrace_report_syscall_entry(regs)) return -1; - if (secure_computing() == -1) + if (!secure_computing()) return -1; if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) diff --git a/arch/loongarch/include/asm/syscall.h b/arch/loongarch/include/asm/syscall.h index df8ea223c77b1a..946886794cedf0 100644 --- a/arch/loongarch/include/asm/syscall.h +++ b/arch/loongarch/include/asm/syscall.h @@ -85,9 +85,4 @@ static inline int syscall_get_arch(struct task_struct task) #endif } -static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs) -{ - return false; -} - #endif / __ASM_LOONGARCH_SYSCALL_H / diff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c index cfa2df24eced12..d2411404b9dfcf 100644 --- a/arch/m68k/kernel/ptrace.c +++ b/arch/m68k/kernel/ptrace.c @@ -281,7 +281,7 @@ asmlinkage int syscall_trace_enter(void) if (test_thread_flag(TIF_SYSCALL_TRACE)) ret = ptrace_report_syscall_entry(task_pt_regs(current)); - if (secure_computing() == -1) + if (!secure_computing()) return -1; return ret; diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c index 3f4c94c8812417..0d809cda754292 100644 --- a/arch/mips/kernel/ptrace.c +++ b/arch/mips/kernel/ptrace.c @@ -1328,7 +1328,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs regs) return -1; } - if (secure_computing()) + if (!secure_computing()) return -1; if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c index 8a17ab7e6e0b93..565b51a48c8a87 100644 --- a/arch/parisc/kernel/ptrace.c +++ b/arch/parisc/kernel/ptrace.c @@ -351,7 +351,7 @@ long do_syscall_trace_enter(struct pt_regs regs) } / Do the secure computing check after ptrace. / - if (secure_computing() == -1) + if (!secure_computing()) return -1; #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h index 834fcc4f7b543b..4b3c52ed6e9d2b 100644 --- a/arch/powerpc/include/asm/syscall.h +++ b/arch/powerpc/include/asm/syscall.h @@ -139,9 +139,4 @@ static inline int syscall_get_arch(struct task_struct task) else return AUDIT_ARCH_PPC64; } - -static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs) -{ - return false; -} #endif / _ASM_SYSCALL_H / diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h index 8067e666a4ca68..987c9a78806f78 100644 --- a/arch/riscv/include/asm/syscall.h +++ b/arch/riscv/include/asm/syscall.h @@ -112,11 +112,6 @@ static inline void syscall_handler(struct pt_regs regs, ulong syscall) regs->a0 = fn(regs); } -static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs) -{ - return false; -} - asmlinkage long sys_riscv_flush_icache(uintptr_t, uintptr_t, uintptr_t); asmlinkage long sys_riscv_hwprobe(struct riscv_hwprobe , size_t, size_t, diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h index 4271e4169f45b6..5f310caad1fcec 100644 --- a/arch/s390/include/asm/syscall.h +++ b/arch/s390/include/asm/syscall.h @@ -89,11 +89,6 @@ static inline int syscall_get_arch(struct task_struct task) return AUDIT_ARCH_S390X; } -static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs) -{ - return false; -} - #define SYSCALL_FMT_0 #define SYSCALL_FMT_1 , "0" (r2) #define SYSCALL_FMT_2 , "d" (r3) SYSCALL_FMT_1 diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c index 06f765d71a2951..8687f17cbe5adc 100644 --- a/arch/sh/kernel/ptrace_32.c +++ b/arch/sh/kernel/ptrace_32.c @@ -460,7 +460,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs regs) return -1; } - if (secure_computing() == -1) + if (!secure_computing()) return -1; if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) diff --git a/arch/um/kernel/skas/syscall.c b/arch/um/kernel/skas/syscall.c index ba7494f9bfe412..916cd7acceafdf 100644 --- a/arch/um/kernel/skas/syscall.c +++ b/arch/um/kernel/skas/syscall.c @@ -27,7 +27,7 @@ void handle_syscall(struct uml_pt_regs r) goto out; /* Do the seccomp check after ptrace; failures should be fast. / - if (secure_computing() == -1) + if (!secure_computing()) goto out; syscall = UPT_SYSCALL_NR(r); diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c index ea36de9fa8641d..6aed3987b9f966 100644 --- a/arch/x86/entry/vsyscall/vsyscall_64.c +++ b/arch/x86/entry/vsyscall/vsyscall_64.c @@ -198,7 +198,7 @@ static bool __emulate_vsyscall(struct pt_regs regs, unsigned long address) regs->orig_ax = syscall_nr; regs->ax = -ENOSYS; tmp = secure_computing(); - if ((!tmp && regs->orig_ax != syscall_nr) \|\| regs->ip != address) { + if ((tmp && regs->orig_ax != syscall_nr) \|\| regs->ip != address) { warn_bad_vsyscall(KERN_DEBUG, regs, "seccomp tried to change syscall nr or ip"); force_exit_sig(SIGSYS); diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c index b80d54b2ea34e6..ef78fcd318ffcc 100644 --- a/arch/xtensa/kernel/ptrace.c +++ b/arch/xtensa/kernel/ptrace.c @@ -553,8 +553,7 @@ int do_syscall_trace_enter(struct pt_regs regs) return 0; } - if (regs->syscall == NO_SYSCALL \|\| - secure_computing() == -1) { + if (regs->syscall == NO_SYSCALL \|\| !secure_computing()) { do_syscall_trace_leave(regs); return 0; } diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h index 416a3352261fe8..3f66320e46d331 100644 --- a/include/linux/entry-common.h +++ b/include/linux/entry-common.h @@ -100,9 +100,8 @@ static __always_inline long syscall_trace_enter(struct pt_regs regs, unsigned l /* Do seccomp after ptrace, to catch any tracer changes. / if (work & SYSCALL_WORK_SECCOMP) { - ret = __secure_computing(); - if (ret == -1L) - return ret; + if (!__secure_computing()) + return -1L; } / Either of the above might have changed the syscall number / @@ -113,7 +112,7 @@ static __always_inline long syscall_trace_enter(struct pt_regs regs, unsigned l syscall_enter_audit(regs, syscall); - return ret ? : syscall; + return syscall; } /** diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h index 9b959972bf4a22..7af3173f40e985 100644 --- a/include/linux/seccomp.h +++ b/include/linux/seccomp.h @@ -22,14 +22,14 @@ #include <linux/atomic.h> #include <asm/seccomp.h> -extern int __secure_computing(void); +extern bool __secure_computing(void); #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER -static inline int secure_computing(void) +static inline bool secure_computing(void) { if (unlikely(test_syscall_work(SECCOMP))) return __secure_computing(); - return 0; + return true; } #else extern void secure_computing_strict(int this_syscall); @@ -50,11 +50,11 @@ static inline int seccomp_mode(struct seccomp s) struct seccomp_data; #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER -static inline int secure_computing(void) { return 0; } +static inline bool secure_computing(void) { return true; } #else static inline void secure_computing_strict(int this_syscall) { return; } #endif -static inline int __secure_computing(void) { return 0; } +static inline bool __secure_computing(void) { return true; } static inline long prctl_get_seccomp(void) { diff --git a/include/linux/syscall_user_dispatch.h b/include/linux/syscall_user_dispatch.h index 3858a6ffdd5c84..73d69e02807d85 100644 --- a/include/linux/syscall_user_dispatch.h +++ b/include/linux/syscall_user_dispatch.h @@ -10,6 +10,7 @@ #ifdef CONFIG_GENERIC_ENTRY +bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs); int set_syscall_user_dispatch(unsigned long mode, unsigned long offset, unsigned long len, char __user selector); diff --git a/kernel/entry/syscall_user_dispatch.c b/kernel/entry/syscall_user_dispatch.c index d89dffcc2d6429..acf545774d3720 100644 --- a/kernel/entry/syscall_user_dispatch.c +++ b/kernel/entry/syscall_user_dispatch.c @@ -32,6 +32,11 @@ static void trigger_sigsys(struct pt_regs regs) force_sig_info(&info); } +bool __weak arch_syscall_is_vdso_sigreturn(struct pt_regs regs) +{ + return false; +} + bool syscall_user_dispatch(struct pt_regs regs) { struct syscall_user_dispatch sd = &current->syscall_dispatch; diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 066909393c38f5..1fec6efedab627 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -1100,12 +1100,12 @@ void secure_computing_strict(int this_syscall) else BUG(); } -int __secure_computing(void) +bool __secure_computing(void) { int this_syscall = syscall_get_nr(current, current_pt_regs()); secure_computing_strict(this_syscall); - return 0; + return true; } #else @@ -1256,7 +1256,7 @@ static int seccomp_do_user_notification(int this_syscall, return -1; } -static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) +static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace) { u32 filter_ret, action; struct seccomp_data sd; @@ -1294,7 +1294,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) case SECCOMP_RET_TRACE: / We've been put in this state by the ptracer already. / if (recheck_after_trace) - return 0; + return true; / ENOSYS these calls if there is no tracer attached. / if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) { @@ -1330,19 +1330,19 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) a skip would have already been reported. / if (__seccomp_filter(this_syscall, true)) - return -1; + return false; - return 0; + return true; case SECCOMP_RET_USER_NOTIF: if (seccomp_do_user_notification(this_syscall, match, &sd)) goto skip; - return 0; + return true; case SECCOMP_RET_LOG: seccomp_log(this_syscall, 0, action, true); - return 0; + return true; case SECCOMP_RET_ALLOW: / @@ -1350,7 +1350,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) * this action since SECCOMP_RET_ALLOW is the starting * state in seccomp_run_filters(). / - return 0; + return true; case SECCOMP_RET_KILL_THREAD: case SECCOMP_RET_KILL_PROCESS: @@ -1367,46 +1367,46 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) } else { do_exit(SIGSYS); } - return -1; / skip the syscall go directly to signal handling / + return false; / skip the syscall go directly to signal handling / } unreachable(); skip: seccomp_log(this_syscall, 0, action, match ? match->log : false); - return -1; + return false; } #else -static int __seccomp_filter(int this_syscall, const bool recheck_after_trace) +static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace) { BUG(); - return -1; + return false; } #endif -int __secure_computing(void) +bool __secure_computing(void) { int mode = current->seccomp.mode; int this_syscall; if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) && unlikely(current->ptrace & PT_SUSPEND_SECCOMP)) - return 0; + return true; this_syscall = syscall_get_nr(current, current_pt_regs()); switch (mode) { case SECCOMP_MODE_STRICT: __secure_computing_strict(this_syscall); / may call do_exit / - return 0; + return true; case SECCOMP_MODE_FILTER: return __seccomp_filter(this_syscall, false); / Surviving SECCOMP_RET_KILL_* must be proactively impossible. */ case SECCOMP_MODE_DEAD: WARN_ON_ONCE(1); do_exit(SIGKILL); - return -1; + return false; default: BUG(); }
3/2	2026/06/29 15:27	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 13412 output: 37 thoughts: 601 Thoughts: Analyzing a Significant Arm64 Syscall Entry Architectural Shift Okay, so I'm looking at this patch and it's making some big changes to how `secure_computing()` handles syscalls and tracing on arm64. First off, it looks like `secure_computing()` is now returning a `bool` instead of an `int`. A `true` means the syscall should proceed, `false` means it gets skipped. Interesting, the old way used `0` for success and `-1` for skip. Seems cleaner, more semantic. My immediate thought is the changes to `arch/arm64/kernel/syscall.c` and `arch/arm64/Kconfig` are the key here, it looks like arm64 is moving over to the `GENERIC_ENTRY` code. And yup, the `Kconfig` confirms it selects `GENERIC_ENTRY`. The `syscall.c` file is now using `syscall_trace_enter(regs, work)` and `syscall_exit_to_user_mode_work(regs)`. This is a big architectural shift for arm64, moving to this generic entry point. Okay, let's dig deeper. The patch also removes `syscall_trace_enter` and `syscall_trace_exit` from `arch/arm64/kernel/ptrace.c`, and a bunch of `TIF_SYSCALL_TRACE` flags from `arch/arm64/include/asm/thread_info.h` are gone, replaced with `syscall_work`. `arch/arm64/kernel/debug-monitors.c` is setting `SYSCALL_EXIT_TRAP`. And, `arch/arm64/kernel/signal.c` now includes `<linux/entry-common.h>`. Plus, `arch/arm64/kernel/vdso.c` adds `arch_syscall_is_vdso_sigreturn`. This is definitely a functional change. The migration to generic entry code for syscalls on arm64 is substantial. The whole syscall path is being rewritten. Worth fuzzing? Absolutely. This is touching the very core of syscall entry and exit for arm64. This warrants thorough testing. Now, which functions are critical to focus on for fuzzing? From a quick glance, I'd say `el0_svc_common` in `arch/arm64/kernel/syscall.c` is front and center. I’ll also look at `arch_syscall_is_vdso_sigreturn` in `arch/arm64/kernel/vdso.c` since the vDSO is always a sensitive area. And anything related to ptrace, namely `ptrace_save_reg`, `arch_ptrace_report_syscall_entry` and `arch_ptrace_report_syscall_exit` in `arch/arm64/include/asm/entry-common.h` is critical. These will need a close look at `arch/arm64/kernel/syscall.c`.
4/2	2026/06/29 15:27	tool	grepper	0m Args: { "Expression": "el0_svc_common", "PathPrefix": "arch/arm64/kernel/syscall.c" } Results: { "Output": "arch/arm64/kernel/syscall.c=39=static void invoke_syscall(struct pt_regs regs, unsigned int scno,\n--\narch/arm64/kernel/syscall.c-57-\narch/arm64/kernel/syscall.c:58:static __always_inline void el0_svc_common(struct pt_regs regs, int scno, int sc_nr,\narch/arm64/kernel/syscall.c-59-\t\t\t\t\t const syscall_fn_t syscall_table[])\n--\narch/arm64/kernel/syscall.c=124=void do_el0_svc(struct pt_regs regs)\narch/arm64/kernel/syscall.c-125-{\narch/arm64/kernel/syscall.c:126:\tel0_svc_common(regs, regs-\u003eregs[8], __NR_syscalls, sys_call_table);\narch/arm64/kernel/syscall.c-127-}\n--\narch/arm64/kernel/syscall.c=130=void do_el0_svc_compat(struct pt_regs regs)\narch/arm64/kernel/syscall.c-131-{\narch/arm64/kernel/syscall.c:132:\tel0_svc_common(regs, regs-\u003eregs[7], __NR_compat32_syscalls,\narch/arm64/kernel/syscall.c-133-\t\t compat_sys_call_table);\n" }
5/2	2026/06/29 15:27	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 15084 output: 37 thoughts: 192 Thoughts: Analyzing the ARM64 System Call Entry Point Okay, so I'm trying to trace the system call path on ARM64. Since `el0_svc_common` is `__always_inline`, I'm going to bypass that and focus directly on the functions it calls: `do_el0_svc` and `do_el0_svc_compat`. Those are the prime suspects, along with `arch_syscall_is_vdso_sigreturn` in `arch/arm64/kernel/vdso.c`, since that's another area where syscalls would be handled. Initially, I also considered `syscall_trace_enter` in `include/linux/entry-common.h`. However, it looks like that's also an `__always_inline` function. The generic entry functions are `syscall_enter_from_user_mode`, and `syscall_exit_to_user_mode`. Given that I'm specifically looking at the ARM64 architecture, I think the generic ones are not what I need to focus on. I need to see what those inlines expand to. So, back to `do_el0_svc` and `do_el0_svc_compat`. Right, let's head over to `arch/arm64/kernel/syscall.c` and see what we can find. That should be the place to find the implementations for `do_el0_svc` and `do_el0_svc_compat`.
6/2	2026/06/29 15:28	tool	grepper	0m Args: { "Expression": "do_el0_svc", "PathPrefix": "arch/arm64/kernel/syscall.c" } Results: { "Output": "arch/arm64/kernel/syscall.c=58=static __always_inline void el0_svc_common(struct pt_regs regs, int scno, int sc_nr,\n--\narch/arm64/kernel/syscall.c-123-\narch/arm64/kernel/syscall.c:124:void do_el0_svc(struct pt_regs regs)\narch/arm64/kernel/syscall.c-125-{\n--\narch/arm64/kernel/syscall.c-129-#ifdef CONFIG_COMPAT\narch/arm64/kernel/syscall.c:130:void do_el0_svc_compat(struct pt_regs *regs)\narch/arm64/kernel/syscall.c-131-{\n" }
7/2	2026/06/29 15:28	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 15836 output: 43 thoughts: 32 Thoughts: Here's a summary of my thought process: Diving into the ARM64 VDSO for Sigreturn Verification Okay, so I need to understand how the architecture handles `sigreturn` calls, specifically in the context of the VDSO on ARM64. My first instinct, as always, is to go directly to the source code. Let's see... I'm thinking I should start by looking into `arch/arm64/kernel/vdso.c`. That's the likely location for code related to the Virtual Dynamic Shared Object and the kernel's interaction with user-space for syscalls and related functionality. Specifically, I'm zeroing in on a function or macro named `arch_syscall_is_vdso_sigreturn`. This name suggests it's the key to figuring out how the kernel determines if a syscall is a VDSO-provided `sigreturn` rather than a standard one. This is crucial for security and performance optimization, making sure the right context is restored. I'm hoping to understand how it's implemented and what assumptions it makes about the VDSO setup.
8/2	2026/06/29 15:28	tool	grepper	0m Args: { "Expression": "arch_syscall_is_vdso_sigreturn", "PathPrefix": "arch/arm64/kernel/vdso.c" } Results: { "Output": "arch/arm64/kernel/vdso.c=333=int arch_setup_additional_pages(struct linux_binprm bprm, int uses_interp)\n--\narch/arm64/kernel/vdso.c-346-\narch/arm64/kernel/vdso.c:347:bool arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\narch/arm64/kernel/vdso.c-348-{\n" }
9/2	2026/06/29 15:28	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16277 output: 41 thoughts: 40 Thoughts: Here's my take on the thought process: Diving into the Arm64 Single-Stepping Implementation Okay, so I need to understand how user-mode single-stepping is enabled and disabled on Arm64. My first instinct, given my experience, is to head directly into the kernel source. Specifically, I'm thinking the relevant code will be within the architecture-specific directory. I'm going to look for the implementation that deals with the debug monitors, as that's where this functionality is likely handled. So, let's start by checking out `arch/arm64/kernel/debug-monitors.c`. The key functions I'm expecting to find are probably named something like `user_enable_single_step` and `user_disable_single_step`. That's where I'll start digging to understand the mechanics of how the kernel manages this feature. Let's see what's in there.
10/2	2026/06/29 15:28	tool	grepper	0m Args: { "Expression": "user_enable_single_step", "PathPrefix": "arch/arm64/kernel/debug-monitors.c" } Results: { "Output": "arch/arm64/kernel/debug-monitors.c=376=void kernel_fastforward_single_step(struct pt_regs regs)\n--\narch/arm64/kernel/debug-monitors.c-381-/ ptrace API /\narch/arm64/kernel/debug-monitors.c:382:void user_enable_single_step(struct task_struct task)\narch/arm64/kernel/debug-monitors.c-383-{\n--\narch/arm64/kernel/debug-monitors.c-395-}\narch/arm64/kernel/debug-monitors.c:396:NOKPROBE_SYMBOL(user_enable_single_step);\narch/arm64/kernel/debug-monitors.c-397-\n" }
11/2	2026/06/29 15:28	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16768 output: 31 thoughts: 29 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Diving into seccomp.c Alright, time to dig in. My initial thought process is leading me straight to `kernel/seccomp.c`. I need to refresh my understanding, so I'm honing in on the key pieces: `__secure_computing` and `__seccomp_filter`. I'm especially interested in how those interact. I'm probably looking at the core machinery here, seeing how the kernel actually does secure computing. I expect to be looking for where the checks are enforced, where the filters are installed, and how the syscall interface is modified, if at all. It's a fundamental part of the security posture, so I want to be certain I have a solid grip on the specifics. I'm going to start by getting a handle on the data structures.
12/2	2026/06/29 15:28	tool	grepper	0m Args: { "Expression": "__secure_computing", "PathPrefix": "kernel/seccomp.c" } Results: { "Output": "kernel/seccomp.c=1056=static const int mode1_syscalls[] = {\n--\nkernel/seccomp.c-1066-\nkernel/seccomp.c:1067:static void __secure_computing_strict(int this_syscall)\nkernel/seccomp.c-1068-{\n--\nkernel/seccomp.c=1088=void secure_computing_strict(int this_syscall)\n--\nkernel/seccomp.c-1098-\telse if (mode == SECCOMP_MODE_STRICT)\nkernel/seccomp.c:1099:\t\t__secure_computing_strict(this_syscall);\nkernel/seccomp.c-1100-\telse\n--\nkernel/seccomp.c-1102-}\nkernel/seccomp.c:1103:bool __secure_computing(void)\nkernel/seccomp.c-1104-{\n--\nkernel/seccomp.c=1380=static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n--\nkernel/seccomp.c-1387-\nkernel/seccomp.c:1388:bool __secure_computing(void)\nkernel/seccomp.c-1389-{\n--\nkernel/seccomp.c-1400-\tcase SECCOMP_MODE_STRICT:\nkernel/seccomp.c:1401:\t\t__secure_computing_strict(this_syscall); /* may call do_exit */\nkernel/seccomp.c-1402-\t\treturn true;\n" }
13/2	2026/06/29 15:28	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 17435 output: 36 thoughts: 25 Thoughts: Here's a first-person summary, tailored for an expert audience, as requested: Digging into the Syscall Dispatch Okay, time to get to the heart of the matter. Let's start by looking at `kernel/entry/syscall_user_dispatch.c`. I need to understand exactly how the system call `syscall_user_dispatch` works. I know it's a critical point for user-space interaction and I need to confirm my understanding of the execution path, data flow, and any potential vulnerabilities. I want to see precisely where the kernel intercepts a system call from user space and how the right handler is selected and called. I'm especially interested in the register passing, privilege level checks, and any context switching that occurs at that point. It's time to refresh my memory on the intricacies there, and ensure I'm up to speed on the latest implementation.
14/2	2026/06/29 15:28	tool	grepper	0m Args: { "Expression": "syscall_user_dispatch", "PathPrefix": "kernel/entry/syscall_user_dispatch.c" } Results: { "Output": "kernel/entry/syscall_user_dispatch.c-9-#include \u003clinux/ptrace.h\u003e\nkernel/entry/syscall_user_dispatch.c:10:#include \u003clinux/syscall_user_dispatch.h\u003e\nkernel/entry/syscall_user_dispatch.c-11-#include \u003clinux/uaccess.h\u003e\n--\nkernel/entry/syscall_user_dispatch.c=35=bool __weak arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\n--\nkernel/entry/syscall_user_dispatch.c-39-\nkernel/entry/syscall_user_dispatch.c:40:bool syscall_user_dispatch(struct pt_regs regs)\nkernel/entry/syscall_user_dispatch.c-41-{\nkernel/entry/syscall_user_dispatch.c:42:\tstruct syscall_user_dispatch sd = \u0026current-\u003esyscall_dispatch;\nkernel/entry/syscall_user_dispatch.c-43-\tchar state;\n--\nkernel/entry/syscall_user_dispatch.c-76-\nkernel/entry/syscall_user_dispatch.c:77:static int task_set_syscall_user_dispatch(struct task_struct task, unsigned long mode,\nkernel/entry/syscall_user_dispatch.c-78-\t\t\t\t\t unsigned long offset, unsigned long len,\n--\nkernel/entry/syscall_user_dispatch.c-99-\t\t/\nkernel/entry/syscall_user_dispatch.c:100:\t\t Invert the range, the check in syscall_user_dispatch()\nkernel/entry/syscall_user_dispatch.c-101-\t\t * supports wrap-around.\n--\nkernel/entry/syscall_user_dispatch.c-135-\nkernel/entry/syscall_user_dispatch.c:136:int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,\nkernel/entry/syscall_user_dispatch.c-137-\t\t\t unsigned long len, char __user selector)\nkernel/entry/syscall_user_dispatch.c-138-{\nkernel/entry/syscall_user_dispatch.c:139:\treturn task_set_syscall_user_dispatch(current, mode, offset, len, selector);\nkernel/entry/syscall_user_dispatch.c-140-}\nkernel/entry/syscall_user_dispatch.c-141-\nkernel/entry/syscall_user_dispatch.c:142:int syscall_user_dispatch_get_config(struct task_struct task, unsigned long size,\nkernel/entry/syscall_user_dispatch.c-143-\t\t\t\t void __user data)\nkernel/entry/syscall_user_dispatch.c-144-{\nkernel/entry/syscall_user_dispatch.c:145:\tstruct syscall_user_dispatch sd = \u0026task-\u003esyscall_dispatch;\nkernel/entry/syscall_user_dispatch.c-146-\tstruct ptrace_sud_config cfg;\n--\nkernel/entry/syscall_user_dispatch.c-165-\nkernel/entry/syscall_user_dispatch.c:166:int syscall_user_dispatch_set_config(struct task_struct task, unsigned long size,\nkernel/entry/syscall_user_dispatch.c-167-\t\t\t\t void __user data)\n--\nkernel/entry/syscall_user_dispatch.c-176-\nkernel/entry/syscall_user_dispatch.c:177:\treturn task_set_syscall_user_dispatch(task, cfg.mode, cfg.offset, cfg.len,\nkernel/entry/syscall_user_dispatch.c-178-\t\t\t\t\t (char __user *)(uintptr_t)cfg.selector);\n" }
15/2	2026/06/29 15:28	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 18582 output: 34 thoughts: 39 Thoughts: Okay, here's my interpretation of those thoughts, tailored for an expert audience: Analyzing the System Call Trace Entry Point Modification Right, so this patch is zeroing in on `syscall_trace_enter`, specifically in `include/linux/entry-common.h`. That immediately piques my interest. Any modification to this area is going to have a potentially significant impact on tracing, debugging, and potentially even performance, given the frequency with which it's likely called. Before diving deep into the specifics of the patch itself, I need to get a mental map of what's already there. Let's see... I'm going to pull up `include/linux/entry-common.h` in my head and mentally walk through it. I want to quickly recall the usual prologue structure, the register saving/restoration conventions, and any potential instrumentation points that might be in or around `syscall_trace_enter`. I need to assess the context of this function. I'm thinking about whether this is a direct entry point, or if there is another layer of abstraction or wrapper function, that the patch modifies. Understanding the surrounding code will be critical to fully grasp the patch's purpose and any potential side effects.
16/2	2026/06/29 15:28	tool	grepper	0m Args: { "Expression": "syscall_trace_enter", "PathPrefix": "include/linux/entry-common.h" } Results: { "Output": "include/linux/entry-common.h-42- \ninclude/linux/entry-common.h:43: Invoked from syscall_trace_enter() to wrap ptrace_report_syscall_entry().\ninclude/linux/entry-common.h-44- \n--\ninclude/linux/entry-common.h=62=static inline void syscall_enter_audit(struct pt_regs regs, long syscall)\n--\ninclude/linux/entry-common.h-71-\ninclude/linux/entry-common.h:72:static __always_inline long syscall_trace_enter(struct pt_regs regs, unsigned long work)\ninclude/linux/entry-common.h-73-{\n--\ninclude/linux/entry-common.h=141=static __always_inline long syscall_enter_from_user_mode_work(struct pt_regs regs, long syscall)\n--\ninclude/linux/entry-common.h-145-\tif (work \u0026 SYSCALL_WORK_ENTER)\ninclude/linux/entry-common.h:146:\t\tsyscall = syscall_trace_enter(regs, work);\ninclude/linux/entry-common.h-147-\n--\ninclude/linux/entry-common.h=223=static __always_inline void syscall_exit_work(struct pt_regs regs, unsigned long work)\n--\ninclude/linux/entry-common.h-229-\t then the tracers below are not invoked for the same reason as\ninclude/linux/entry-common.h:230:\t * the entry side was not invoked in syscall_trace_enter(): The ABI\ninclude/linux/entry-common.h-231-\t * of these syscalls is unknown.\n" }
17/2	2026/06/29 15:28	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19334 output: 23 thoughts: 381 Thoughts: Analyzing the `syscall_trace_enter` Patch Okay, so this patch is modifying `syscall_trace_enter` within `include/linux/entry-common.h`. I see that the code now directly checks the return value of `__secure_computing()`. Previously, the return value was stored in `ret`, which could indicate an error. Now, the logic is simplified: if `__secure_computing()` returns `false`, it immediately returns `-1L`. Makes sense. The intent is to catch tracer changes, which were possibly a pre-existing issue. I see that this change is generic, not architecture-specific. Interesting. Given that fact, I need to understand which architectures are affected. I notice that the `arch/arm64/Kconfig` file selects `GENERIC_ENTRY`. This tells me that ARM64 is now using this generic code, which is good. That likely explains why the change is generic. Now, I need to determine if any specific configurations are needed. It appears that `GENERIC_ENTRY` is selected through the ARM64 architecture, so I'm not overly concerned there. I need to make sure the build environment is set up. To test the `__secure_computing()` functionality, I'll need `SECCOMP`. I'll also need `SYSCALL_USER_DISPATCH` for `syscall_user_dispatch` and `arch_syscall_is_vdso_sigreturn` testing. I'll need to check the relevant `Kconfig` files to confirm that `SECCOMP` and `SYSCALL_USER_DISPATCH` are appropriately configured.
18/2	2026/06/29 15:29	tool	grepper	0m Args: { "Expression": "config SECCOMP", "PathPrefix": "" } Results: { "Output": "arch/Kconfig=628=config HAVE_ARCH_SECCOMP_FILTER\n--\narch/Kconfig-646-\narch/Kconfig:647:config SECCOMP\narch/Kconfig-648-\tprompt \"Enable seccomp to safely execute untrusted bytecode\"\n--\narch/Kconfig-663-\narch/Kconfig:664:config SECCOMP_FILTER\narch/Kconfig-665-\tdef_bool y\n--\narch/Kconfig-673-\narch/Kconfig:674:config SECCOMP_CACHE_DEBUG\narch/Kconfig-675-\tbool \"Show seccomp filter cache status in /proc/pid/seccomp_cache\"\n" }
19/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 20266 output: 29 thoughts: 14 Thoughts: Okay, let's dive into this. Here's my take on those thoughts, as if they're my own: Investigating the System Call Dispatch Alright, time to get to the heart of the matter. My first instinct is to zero in on `SYSCALL_USER_DISPATCH`. That's where the rubber meets the road, isn't it? The core of the system call mechanism, where the user-space requests are finally sorted and directed to the appropriate kernel handlers. I need to understand exactly how this dispatch is being handled – how the system call number gets translated into the correct kernel function. Is there any potential bottleneck or misdirection I should be aware of? This is the starting point for understanding how this system actually works. Gotta check how this mechanism works. I'm going to look through the documentation to check how this function works. It seems like a lot to do, but that is the only place to start.
20/2	2026/06/29 15:29	tool	grepper	0m Error: no matches Args: { "Expression": "config SYSCALL_USER_DISPATCH", "PathPrefix": "" } Results: { "error": "no matches" }
21/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 20522 output: 28 thoughts: 28 Thoughts: Here's my thought process, as if I were considering this myself: Kconfig Location Hunt for SYSCALL_USER_DISPATCH Okay, so I'm trying to track down where `SYSCALL_USER_DISPATCH` is defined within the kernel's build configuration. My initial hunch is that it's likely going to be in either `init/Kconfig` or `kernel/Kconfig`. These are the classic places where you'd find core kernel features and their associated build options defined. I'll need to check those files closely to verify. I'll start with a quick grep or find in those directories and see what turns up.
22/2	2026/06/29 15:29	tool	grepper	0m Args: { "Expression": "SYSCALL_USER_DISPATCH", "PathPrefix": "" } Results: { "Output": "Documentation/admin-guide/syscall-user-dispatch.rst=52=following prctl:\nDocumentation/admin-guide/syscall-user-dispatch.rst-53-\nDocumentation/admin-guide/syscall-user-dispatch.rst:54: prctl(PR_SET_SYSCALL_USER_DISPATCH, \u003cop\u003e, \u003coffset\u003e, \u003clength\u003e, [selector])\nDocumentation/admin-guide/syscall-user-dispatch.rst-55-\n--\nDocumentation/admin-guide/syscall-user-dispatch.rst=81=Additionally, a tasks syscall user dispatch configuration can be peeked\nDocumentation/admin-guide/syscall-user-dispatch.rst:82:and poked via the PTRACE_(GET\|SET)_SYSCALL_USER_DISPATCH_CONFIG ptrace\nDocumentation/admin-guide/syscall-user-dispatch.rst-83-requests. This is useful for checkpoint/restart software.\n--\ninclude/linux/entry-common.h-27-\t\t\t\t SYSCALL_WORK_SYSCALL_AUDIT \|\t\t\\\ninclude/linux/entry-common.h:28:\t\t\t\t SYSCALL_WORK_SYSCALL_USER_DISPATCH \|\t\\\ninclude/linux/entry-common.h-29-\t\t\t\t SYSCALL_WORK_SYSCALL_RSEQ_SLICE)\n--\ninclude/linux/entry-common.h-35-\t\t\t\t SYSCALL_WORK_SYSCALL_AUDIT \|\t\t\\\ninclude/linux/entry-common.h:36:\t\t\t\t SYSCALL_WORK_SYSCALL_USER_DISPATCH \|\t\\\ninclude/linux/entry-common.h-37-\t\t\t\t SYSCALL_WORK_SYSCALL_EXIT_TRAP)\n--\ninclude/linux/entry-common.h=72=static __always_inline long syscall_trace_enter(struct pt_regs regs, unsigned long work)\n--\ninclude/linux/entry-common.h-80-\t /\ninclude/linux/entry-common.h:81:\tif (work \u0026 SYSCALL_WORK_SYSCALL_USER_DISPATCH) {\ninclude/linux/entry-common.h-82-\t\tif (syscall_user_dispatch(regs))\n--\ninclude/linux/entry-common.h=223=static __always_inline void syscall_exit_work(struct pt_regs regs, unsigned long work)\n--\ninclude/linux/entry-common.h-232-\t /\ninclude/linux/entry-common.h:233:\tif (work \u0026 SYSCALL_WORK_SYSCALL_USER_DISPATCH) {\ninclude/linux/entry-common.h-234-\t\tif (unlikely(current-\u003esyscall_dispatch.on_dispatch)) {\n--\ninclude/linux/syscall_user_dispatch.h-4- /\ninclude/linux/syscall_user_dispatch.h:5:#ifndef _SYSCALL_USER_DISPATCH_H\ninclude/linux/syscall_user_dispatch.h:6:#define _SYSCALL_USER_DISPATCH_H\ninclude/linux/syscall_user_dispatch.h-7-\n--\ninclude/linux/syscall_user_dispatch.h=14=int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,\n--\ninclude/linux/syscall_user_dispatch.h-17-#define clear_syscall_work_syscall_user_dispatch(tsk) \\\ninclude/linux/syscall_user_dispatch.h:18:\tclear_task_syscall_work(tsk, SYSCALL_USER_DISPATCH)\ninclude/linux/syscall_user_dispatch.h-19-\n--\ninclude/linux/syscall_user_dispatch.h=44=static inline int syscall_user_dispatch_set_config(struct task_struct task,\n--\ninclude/linux/syscall_user_dispatch.h-51-\ninclude/linux/syscall_user_dispatch.h:52:#endif /* _SYSCALL_USER_DISPATCH_H /\n--\ninclude/linux/syscall_user_dispatch_types.h-1-/ SPDX-License-Identifier: GPL-2.0 /\ninclude/linux/syscall_user_dispatch_types.h:2:#ifndef _SYSCALL_USER_DISPATCH_TYPES_H\ninclude/linux/syscall_user_dispatch_types.h:3:#define _SYSCALL_USER_DISPATCH_TYPES_H\ninclude/linux/syscall_user_dispatch_types.h-4-\n--\ninclude/linux/syscall_user_dispatch_types.h=18=struct syscall_user_dispatch {};\n--\ninclude/linux/syscall_user_dispatch_types.h-21-\ninclude/linux/syscall_user_dispatch_types.h:22:#endif / _SYSCALL_USER_DISPATCH_TYPES_H /\n--\ninclude/linux/thread_info.h=41=enum syscall_work_bit {\n--\ninclude/linux/thread_info.h-46-\tSYSCALL_WORK_BIT_SYSCALL_AUDIT,\ninclude/linux/thread_info.h:47:\tSYSCALL_WORK_BIT_SYSCALL_USER_DISPATCH,\ninclude/linux/thread_info.h-48-\tSYSCALL_WORK_BIT_SYSCALL_EXIT_TRAP,\n--\ninclude/linux/thread_info.h-56-#define SYSCALL_WORK_SYSCALL_AUDIT\t\tBIT(SYSCALL_WORK_BIT_SYSCALL_AUDIT)\ninclude/linux/thread_info.h:57:#define SYSCALL_WORK_SYSCALL_USER_DISPATCH\tBIT(SYSCALL_WORK_BIT_SYSCALL_USER_DISPATCH)\ninclude/linux/thread_info.h-58-#define SYSCALL_WORK_SYSCALL_EXIT_TRAP\t\tBIT(SYSCALL_WORK_BIT_SYSCALL_EXIT_TRAP)\n--\ninclude/uapi/linux/prctl.h=134=struct prctl_mm_map {\n--\ninclude/uapi/linux/prctl.h-267-/ Dispatch syscalls to a userspace handler /\ninclude/uapi/linux/prctl.h:268:#define PR_SET_SYSCALL_USER_DISPATCH\t59\ninclude/uapi/linux/prctl.h-269-# define PR_SYS_DISPATCH_OFF\t\t0\n--\ninclude/uapi/linux/ptrace.h=110=struct ptrace_rseq_configuration {\n--\ninclude/uapi/linux/ptrace.h-117-\ninclude/uapi/linux/ptrace.h:118:#define PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG 0x4210\ninclude/uapi/linux/ptrace.h:119:#define PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG 0x4211\ninclude/uapi/linux/ptrace.h-120-\n--\nkernel/entry/syscall_user_dispatch.c=77=static int task_set_syscall_user_dispatch(struct task_struct task, unsigned long mode,\n--\nkernel/entry/syscall_user_dispatch.c-128-\tif (mode != PR_SYS_DISPATCH_OFF)\nkernel/entry/syscall_user_dispatch.c:129:\t\tset_task_syscall_work(task, SYSCALL_USER_DISPATCH);\nkernel/entry/syscall_user_dispatch.c-130-\telse\nkernel/entry/syscall_user_dispatch.c:131:\t\tclear_task_syscall_work(task, SYSCALL_USER_DISPATCH);\nkernel/entry/syscall_user_dispatch.c-132-\n--\nkernel/entry/syscall_user_dispatch.c=142=int syscall_user_dispatch_get_config(struct task_struct task, unsigned long size,\n--\nkernel/entry/syscall_user_dispatch.c-150-\nkernel/entry/syscall_user_dispatch.c:151:\tif (test_task_syscall_work(task, SYSCALL_USER_DISPATCH))\nkernel/entry/syscall_user_dispatch.c-152-\t\tcfg.mode = PR_SYS_DISPATCH_ON;\n--\nkernel/ptrace.c=1162=int ptrace_request(struct task_struct child, long request,\n--\nkernel/ptrace.c-1397-\nkernel/ptrace.c:1398:\tcase PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG:\nkernel/ptrace.c-1399-\t\tret = syscall_user_dispatch_set_config(child, addr, datavp);\n--\nkernel/ptrace.c-1401-\nkernel/ptrace.c:1402:\tcase PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG:\nkernel/ptrace.c-1403-\t\tret = syscall_user_dispatch_get_config(child, addr, datavp);\n--\nkernel/sys.c=2534=SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,\n--\nkernel/sys.c-2801-\t\tbreak;\nkernel/sys.c:2802:\tcase PR_SET_SYSCALL_USER_DISPATCH:\nkernel/sys.c-2803-\t\terror = set_syscall_user_dispatch(arg2, arg3, arg4,\n--\ntools/include/uapi/linux/prctl.h=134=struct prctl_mm_map {\n--\ntools/include/uapi/linux/prctl.h-255-/* Dispatch syscalls to a userspace handler /\ntools/include/uapi/linux/prctl.h:256:#define PR_SET_SYSCALL_USER_DISPATCH\t59\ntools/include/uapi/linux/prctl.h-257-# define PR_SYS_DISPATCH_OFF\t\t0\n--\ntools/perf/trace/beauty/include/uapi/linux/prctl.h=134=struct prctl_mm_map {\n--\ntools/perf/trace/beauty/include/uapi/linux/prctl.h-267-/ Dispatch syscalls to a userspace handler /\ntools/perf/trace/beauty/include/uapi/linux/prctl.h:268:#define PR_SET_SYSCALL_USER_DISPATCH\t59\ntools/perf/trace/beauty/include/uapi/linux/prctl.h-269-# define PR_SYS_DISPATCH_OFF\t\t0\n--\ntools/testing/selftests/ptrace/get_set_sud.c=18=TEST(get_set_sud)\n--\ntools/testing/selftests/ptrace/get_set_sud.c-39-\ntools/testing/selftests/ptrace/get_set_sud.c:40:\tret = sys_ptrace(PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG, child,\ntools/testing/selftests/ptrace/get_set_sud.c-41-\t\t\t (void )sizeof(config), \u0026config);\n--\ntools/testing/selftests/ptrace/get_set_sud.c-53-\ntools/testing/selftests/ptrace/get_set_sud.c:54:\tret = sys_ptrace(PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG, child,\ntools/testing/selftests/ptrace/get_set_sud.c-55-\t\t\t (void )sizeof(config), \u0026config);\n--\ntools/testing/selftests/ptrace/get_set_sud.c-59-\tmemset(\u0026config, 1, sizeof(config));\ntools/testing/selftests/ptrace/get_set_sud.c:60:\tret = sys_ptrace(PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG, child,\ntools/testing/selftests/ptrace/get_set_sud.c-61-\t\t\t (void )sizeof(config), \u0026config);\n--\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c-20-\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c:21:#ifndef PR_SET_SYSCALL_USER_DISPATCH\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c:22:# define PR_SET_SYSCALL_USER_DISPATCH\t59\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c-23-# define PR_SYS_DISPATCH_OFF\t0\n--\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c=136=int main(void)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c-162-\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c:163:\tif (prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_ON,\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c-164-\t\t syscall_dispatcher_start,\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-18-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:19:#ifndef PR_SET_SYSCALL_USER_DISPATCH\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:20:# define PR_SET_SYSCALL_USER_DISPATCH\t59\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-21-# define PR_SYS_DISPATCH_OFF\t0\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-45- \ntools/testing/selftests/syscall_user_dispatch/sud_test.c:46: - dispatch_trigger_sigsys: Verify if PR_SET_SYSCALL_USER_DISPATCH is\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-47- * able to trigger SIGSYS on a syscall.\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=65=TEST_SIGNAL(dispatch_trigger_sigsys, SIGSYS)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-73-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:74:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, 0, \u0026sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-75-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:76:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-77-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=88=static void prctl_valid(struct __test_metadata _metadata,\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-91-{\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:92:\tEXPECT_EQ(0, prctl(PR_SET_SYSCALL_USER_DISPATCH, op, off, size, sel));\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-93-}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=95=static void prctl_invalid(struct __test_metadata _metadata,\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-98-{\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:99:\tEXPECT_EQ(-1, prctl(PR_SET_SYSCALL_USER_DISPATCH, op, off, size, sel));\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-100-\tEXPECT_EQ(err, errno);\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=210=TEST(dispatch_and_return)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-223-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:224:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, 0, \u0026glob_sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-225-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:226:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-227-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=255=TEST_SIGNAL(bad_selector, SIGSYS)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-279-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:280:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, 0, \u0026glob_sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-281-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:282:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-283-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=298=TEST(disable_dispatch)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-303-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:304:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, 0, \u0026sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-305-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:306:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-307-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-311-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:312:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_OFF, 0, 0, 0);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-313-\tEXPECT_EQ(0, ret) {\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=326=TEST(direct_dispatch_range)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-335-\t /\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:336:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, -1L, \u0026sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-337-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:338:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-339-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=349=static void test_range(struct __test_metadata _metadata,\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-354-\tSYSCALL_DISPATCH_OFF(glob_sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:355:\tEXPECT_EQ(0, prctl(PR_SET_SYSCALL_USER_DISPATCH, op, off, size, \u0026glob_sel));\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-356-\tSYSCALL_DISPATCH_ON(glob_sel);\n" }
23/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25956 output: 33 thoughts: 75 Thoughts: Okay, here's my take on those thoughts, framed as my own internal monologue: Navigating the Kconfig Maze Right, so I was looking for `CONFIG_SYSCALL_USER_DISPATCH`, but that name doesn't seem to be sticking. Hmm, could it be just `SYSCALL_USER_DISPATCH` without the `CONFIG_` prefix? No, wait a minute... I seem to recall that the generic entry point stuff is what enables it. Let me just double check. Yeah, I should really consult `init/Kconfig` to confirm where `SYSCALL_USER_DISPATCH` is actually defined and what enables it. Need to make sure I'm not chasing a ghost here, or, worse, misunderstanding a critical dependency.
24/2	2026/06/29 15:29	tool	grepper	0m Error: no matches Args: { "Expression": "config SYSCALL_USER_DISPATCH", "PathPrefix": "init/Kconfig" } Results: { "error": "no matches" }
25/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26244 output: 29 thoughts: 28 Thoughts: Here's my thought process, summarized as you requested: Investigating the `SYSCALL_USER_DISPATCH` Configuration Option Okay, so I need to track down the configuration option `SYSCALL_USER_DISPATCH`. The logical place to start looking for this would be the Kconfig files. Considering the system architecture, it's likely defined within the kernel source. Therefore, I'm going to check the `kernel/entry/Kconfig` file first. If it's not located there, then I'll broaden the search and go to the more general `Kconfig` files that are commonly used. That should pinpoint where this option is defined and how it's used in the build process.
26/2	2026/06/29 15:29	tool	grepper	0m Error: no matches Args: { "Expression": "config SYSCALL_USER_DISPATCH", "PathPrefix": "" } Results: { "error": "no matches" }
27/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26468 output: 33 thoughts: 45 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Investigating `SYSCALL_USER_DISPATCH` Hmm, so `SYSCALL_USER_DISPATCH` is a kernel config option, is it? Interesting. Given my experience, I'd immediately want to check how this affects the system calls path. Specifically, I need to know how the kernel handles the dispatch based on this. My first thought is to dive into `kernel/entry/syscall_user_dispatch.c`. I'll want to see if this particular file is conditional on that config option. It will also be important to understand how the code behaves differently when the option is enabled vs when it's not. Is it a compile-time inclusion? A conditional branch within the main syscall handling path? Understanding the implications of this option is going to be crucial for profiling the syscall path and determining if this impacts performance in any way. I'll need to look for `#ifdef` or similar preprocessor directives that guard blocks of code related to user dispatch. And if it's there, then I'm going to want to understand what the differences are when it's not there!
28/2	2026/06/29 15:29	tool	grepper	0m Error: no matches Args: { "Expression": "SYSCALL_USER_DISPATCH", "PathPrefix": "kernel/entry/Makefile" } Results: { "error": "no matches" }
29/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26811 output: 30 thoughts: 11 Thoughts: Here's my take on the thought process: Diving into the Kernel Entry Point Makefile Alright, time to get my hands dirty. I need to understand how this system initializes. My first instinct is always to check the entry point configuration. Let's see what's in `kernel/entry/Makefile`. This file should hold the keys to how the kernel's initial setup is orchestrated – the initial boot process, the early environment configuration, and what calls the `start` routine. Gotta see how the linker scripts are used, any architecture-specific assembly files that are linked early, any pre-main setup steps... It's the starting gun of the whole damn thing, and I need to see what's written on the barrel. The Makefile itself should illuminate the process.
30/2	2026/06/29 15:29	tool	grepper	0m Args: { "Expression": "syscall_user_dispatch", "PathPrefix": "kernel/entry/Makefile" } Results: { "Output": "kernel/entry/Makefile=15=obj-$(CONFIG_GENERIC_IRQ_ENTRY) \t+= common.o\nkernel/entry/Makefile:16:obj-$(CONFIG_GENERIC_SYSCALL) \t\t+= syscall-common.o syscall_user_dispatch.o\nkernel/entry/Makefile-17-obj-$(CONFIG_VIRT_XFER_TO_GUEST_WORK)\t+= virt.o\n" }
31/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27126 output: 34 thoughts: 93 Thoughts: Okay, here's my interpretation of that thought process, assuming I'm an expert in kernel development and configuration: Navigating Kernel Configuration for System Call Implementation Alright, so I'm looking at some code related to system calls. My first thought is whether we're using `CONFIG_GENERIC_SYSCALL` or `CONFIG_GENERIC_ENTRY`. It seems like a core part of the generic system call support. Let's dig in. Okay, the Makefile is revealing a dependency: `obj-$(CONFIG_GENERIC_SYSCALL) += syscall-common.o syscall_user_dispatch.o`. That confirms it – `CONFIG_GENERIC_SYSCALL` is controlling the inclusion of those crucial object files. But it makes me wonder, precisely what does this option entail? My knee-jerk reaction is to verify the definition of `GENERIC_SYSCALL` (since `CONFIG_GENERIC_SYSCALL` is its configuration counterpart) and how it’s used within the ARM64 architecture; so, I'm heading over to `arch/arm64/Kconfig` to refresh my memory and understand the relationship. I need a clear picture of how system call entry points are handled here.
32/2	2026/06/29 15:29	tool	grepper	0m Error: no matches Args: { "Expression": "GENERIC_SYSCALL", "PathPrefix": "arch/arm64/Kconfig" } Results: { "error": "no matches" }
33/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27531 output: 29 thoughts: 32 Thoughts: Okay, here's my interpretation of that thought process, assuming I'm deep in the weeds of kernel development: Digging into the Entry Point Configuration Hmm, so `arch/arm64/Kconfig` is actually selecting `GENERIC_ENTRY`. I need to make sure I haven't missed anything. I thought I had the relationship of `GENERIC_ENTRY` pinned down, but it wouldn't hurt to double check it and see what's actually happening at `kernel/entry/Makefile`. Maybe I misremembered some of its relationships with the Kconfigs and Makefiles. Time to dive back in.
34/2	2026/06/29 15:29	tool	grepper	0m Error: no matches Args: { "Expression": "GENERIC_ENTRY", "PathPrefix": "kernel/entry/Makefile" } Results: { "error": "no matches" }
35/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27740 output: 31 thoughts: 11 Thoughts: Here's my take on the kernel entry Makefile, from an expert's perspective: Diving into the Kernel Entry Makefile Okay, let's get down to brass tacks. I'm going to take a look at `kernel/entry/Makefile`. This is a crucial file, the starting point for understanding how the kernel's entry code is structured and compiled. I'm expecting to see how the initial setup is handled, things like architecture-specific code, boot-time initialization, and the linking of the entry point. I want to see which object files are being included, what compiler flags are being used, and any architecture-specific assembly code that's involved. I'll be looking for clues about the boot process itself; things like the early interrupt handling set-up and where the initial stacks are established are going to be key. Depending on the architecture, I'll be particularly interested in how the bootloader hands off control to the kernel proper. I'm keen to spot any unusual build configurations or dependencies that might offer insight into specific design choices. Time to crack it open and see what gems are inside.
36/2	2026/06/29 15:29	tool	read-file	0m Args: { "File": "kernel/entry/Makefile", "FirstLine": 1, "LineCount": 20 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0\n 2:\t\n 3:\t# Prevent the noinstr section from being pestered by sanitizer and other goodies\n 4:\t# as long as these things cannot be disabled per function.\n 5:\tKASAN_SANITIZE := n\n 6:\tUBSAN_SANITIZE := n\n 7:\tKCOV_INSTRUMENT := n\n 8:\t\n 9:\t# Branch profiling isn't noinstr-safe\n 10:\tccflags-$(CONFIG_TRACE_BRANCH_PROFILING) += -DDISABLE_BRANCH_PROFILING\n 11:\t\n 12:\tCFLAGS_REMOVE_common.o\t = -fstack-protector -fstack-protector-strong\n 13:\tCFLAGS_common.o\t\t+= -fno-stack-protector\n 14:\t\n 15:\tobj-$(CONFIG_GENERIC_IRQ_ENTRY) \t+= common.o\n 16:\tobj-$(CONFIG_GENERIC_SYSCALL) \t\t+= syscall-common.o syscall_user_dispatch.o\n 17:\tobj-$(CONFIG_VIRT_XFER_TO_GUEST_WORK)\t+= virt.o\n" }
37/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28326 output: 27 thoughts: 23 Thoughts: Here's my thought process, summarized as requested: Navigating Kernel Configuration Options Okay, so `CONFIG_GENERIC_SYSCALL`... that rings a bell, but I need to make sure I'm on the right track with my understanding. Time to drill down. Where exactly is this option defined? I need to quickly ascertain the context. I'm thinking I should start digging around in the configuration files, because that's the obvious first step. I need to understand its implications for the current architecture I'm working with and how this impacts the overall system call implementation. Let's get cracking.
38/2	2026/06/29 15:29	tool	grepper	0m Args: { "Expression": "config GENERIC_SYSCALL", "PathPrefix": "" } Results: { "Output": "arch/Kconfig=105=config GENERIC_IRQ_ENTRY\n--\narch/Kconfig-107-\narch/Kconfig:108:config GENERIC_SYSCALL\narch/Kconfig-109-\tbool\n" }
39/2	2026/06/29 15:29	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28579 output: 27 thoughts: 14 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: Analyzing the GENERIC_SYSCALL Usage Alright, so the initial thought process kicks off with a directed focus: Let's see what selects `GENERIC_SYSCALL`. This is where I begin the investigative process, the analysis. I'm not just idly pondering; I'm actively formulating a plan to understand the context and implications of this specific system call definition. The selection of `GENERIC_SYSCALL` is the focal point. I need to understand what pieces of the kernel are tying into this. My next steps are probably, to dig into the source tree and trace where this symbol is used. Is it a legacy thing? A performance optimization? Some sort of abstraction? Understanding the "what" and the "why" of the selection will be key to understanding the deeper architectural design considerations at play. I'm already mentally running through potential scenarios: Is it a common fallback? Part of a modular system? Does its selection correlate to other kernel features? This is going to be a fun dig.
40/2	2026/06/29 15:30	tool	grepper	0m Args: { "Expression": "select GENERIC_SYSCALL", "PathPrefix": "" } Results: { "Output": "arch/Kconfig=112=config GENERIC_ENTRY\n--\narch/Kconfig-114-\tselect GENERIC_IRQ_ENTRY\narch/Kconfig:115:\tselect GENERIC_SYSCALL\narch/Kconfig-116-\n" }
41/2	2026/06/29 15:30	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28936 output: 29 thoughts: 390 Thoughts: Analyzing the ARM64 Generic Syscall Entry Patch Okay, let's break this down. My initial thought was: the generic entry point (`GENERIC_ENTRY`) is the one being used to dispatch `GENERIC_SYSCALL`, and I remember that `arch/arm64/Kconfig` selects it. Therefore, this patch must be selecting it... wait, let's double-check. Examines the diff Ah, the diff confirms it: the patch explicitly adds `select GENERIC_ENTRY` in `arch/arm64/Kconfig`, while removing `GENERIC_IRQ_ENTRY`. So, that's straightforward. Now, what about testing this? Which configurations will be important? Hmm, `SECCOMP` is a no-brainer because `secure_computing` gets modified and is used by the patch. Of course, `SECCOMP_FILTER` should also be enabled. Then, `COMPAT` looks to be used by the functions `arch_syscall_is_vdso_sigreturn` and `do_el0_svc_compat`, which are being modified, so I'll need to confirm that. As for `DEBUG_RSEQ`, that looks like it's being removed from `arch/arm64/kernel/syscall.c`, but the `rseq_syscall` is handled by the generic entry, so I'll need to check how that impacts the test configuration. Let me confirm if `SYSCALL_USER_DISPATCH` is a configuration option, since it's just enabled if `GENERIC_SYSCALL` is enabled. Okay, I'll need to check where that's defined.
42/2	2026/06/29 15:30	tool	grepper	0m Error: no matches Args: { "Expression": "config SYSCALL_USER_DISPATCH", "PathPrefix": "" } Results: { "error": "no matches" }
43/2	2026/06/29 15:30	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 29726 output: 45 thoughts: 455 Thoughts: My Investigation into Arm64 System Call Configuration Okay, so it looks like `CONFIG_SYSCALL_USER_DISPATCH` isn't a standalone option. It's automatically included when `GENERIC_SYSCALL` is enabled, which simplifies things. That's good to know. Now, let me dive into the code itself. In `arch/arm64/kernel/syscall.c`, I need to confirm the entry points. Ah, yes, `do_el0_svc` is the main handler for syscalls, and `do_el0_svc_compat` handles the compatibility calls. Excellent. And, as expected, `arch_syscall_is_vdso_sigreturn` is in `arch/arm64/kernel/vdso.c`, and `user_enable_single_step` is in `arch/arm64/kernel/debug-monitors.c`. Makes perfect sense. Next, I should look at the security aspects. Let's see what's happening with seccomp. I remember that the `__secure_computing` function is, as expected, enabled through `CONFIG_SECCOMP`. Now, I want to confirm the role of `syscall_user_dispatch`, which should be in `kernel/entry/syscall_user_dispatch.c`. Yep, it's there and built when `CONFIG_GENERIC_SYSCALL` is active. So, to properly exercise the relevant functionality, the key configurations I need to focus on are: * `SECCOMP` * `SECCOMP_FILTER` * `COMPAT` (to test those compatibility syscalls) I know `SECCOMP` and `SECCOMP_FILTER` are usually enabled. However, I want to be certain, so I will list them here. Oh, wait, there's `GENERIC_ENTRY`. I recall it's selected by `ARM64`, which means it's always active on arm64 architectures. Good to keep in mind. Are there any other relevant configurations? Let's check `arch/arm64/kernel/ptrace.c`. Hmm, `ptrace_save_reg` has moved from `ptrace.c` to `entry-common.h`, and, more importantly, `arch_ptrace_report_syscall_entry` and `arch_ptrace_report_syscall_exit` have been added to `entry-common.h`. So these are compiled in all the time. Now I should check what is in `arch/arm64/include/asm/entry-common.h`.
44/2	2026/06/29 15:30	tool	grepper	0m Args: { "Expression": "arch_ptrace_report_syscall_entry", "PathPrefix": "arch/arm64/include/asm/entry-common.h" } Results: { "Output": "arch/arm64/include/asm/entry-common.h=64=static __always_inline unsigned long ptrace_save_reg(struct pt_regs regs,\n--\narch/arm64/include/asm/entry-common.h-92-\narch/arm64/include/asm/entry-common.h:93:static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs regs)\narch/arm64/include/asm/entry-common.h-94-{\n--\narch/arm64/include/asm/entry-common.h-106-\narch/arm64/include/asm/entry-common.h:107:#define arch_ptrace_report_syscall_entry arch_ptrace_report_syscall_entry\narch/arm64/include/asm/entry-common.h-108-\n" }
45/2	2026/06/29 15:30	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 31014 output: 34 thoughts: 298 Thoughts: My Analysis of Function Hotness for Test Distribution Okay, so I'm thinking about which functions are going to skew my test distributions, and these ones jumped out: `do_el0_svc`, `do_el0_svc_compat`, `arch_syscall_is_vdso_sigreturn`, `syscall_user_dispatch`, `__secure_computing`, `__seccomp_filter`, `user_enable_single_step`, and `user_disable_single_step`. The instructions explicitly say to avoid generic hot-path functions, and, hang on... `do_el0_svc` is a huge offender here. It’s the entry point for every EL0 system call! That's going to dominate any test and invalidate the results. Definitely avoiding that. Then, `__secure_computing` and `__seccomp_filter` – they're on the fast path too if seccomp is enabled, so, depending on the system config, we should probably ignore them. `syscall_user_dispatch` is the next one. It's executed for every syscall if `SYSCALL_USER_DISPATCH` is enabled, but it looks like that's controlled by a flag, so maybe not as hot as the others, but still on the syscall path, so potentially problematic. And `arch_syscall_is_vdso_sigreturn` is called from `syscall_user_dispatch`, so that's indirectly hot. But wait, `syscall_user_dispatch` is only actually called if `SYSCALL_WORK_SYSCALL_USER_DISPATCH` is set! Good to know, I need to check `include/linux/entry-common.h` to see how this flag is set and how common it is.
46/2	2026/06/29 15:30	tool	grepper	0m Args: { "Expression": "syscall_user_dispatch", "PathPrefix": "include/linux/entry-common.h" } Results: { "Output": "include/linux/entry-common.h=52=static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs regs)\n--\ninclude/linux/entry-common.h-57-\ninclude/linux/entry-common.h:58:bool syscall_user_dispatch(struct pt_regs regs);\ninclude/linux/entry-common.h-59-long trace_syscall_enter(struct pt_regs regs, long syscall);\n--\ninclude/linux/entry-common.h=72=static __always_inline long syscall_trace_enter(struct pt_regs regs, unsigned long work)\n--\ninclude/linux/entry-common.h-81-\tif (work \u0026 SYSCALL_WORK_SYSCALL_USER_DISPATCH) {\ninclude/linux/entry-common.h:82:\t\tif (syscall_user_dispatch(regs))\ninclude/linux/entry-common.h-83-\t\t\treturn -1L;\n" }
47/2	2026/06/29 15:30	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 31983 output: 38 thoughts: 124 Thoughts: Fuzzing Candidate Identification Okay, let's see. My initial scan has pointed me towards some promising areas for fuzzing within the kernel. The logic flow seems to indicate that `syscall_user_dispatch` is only invoked when that specific flag is set, making it a prime target for in-depth analysis. This seems like it could have some interesting edge cases to explore. Then, there's `arch_syscall_is_vdso_sigreturn`. This function is another compelling avenue to investigate, and warrants further attention. Furthermore, the pair of functions `user_enable_single_step` and `user_disable_single_step` look particularly relevant. The fact that they are invoked during ptrace operations, specifically when enabling and disabling single-stepping, suggests they're handling low-level control of the execution flow. I need to dig into these, as ptrace is notoriously complex. Finally, `set_syscall_user_dispatch` is intriguing. It's the prctl handler, so it offers a way to configure the system call dispatch. I need to check the code in `kernel/entry/syscall_user_dispatch.c` to see precisely what is being controlled and how this impacts the rest of the kernel's execution path.
48/2	2026/06/29 15:30	tool	grepper	0m Args: { "Expression": "set_syscall_user_dispatch", "PathPrefix": "kernel/entry/syscall_user_dispatch.c" } Results: { "Output": "kernel/entry/syscall_user_dispatch.c=40=bool syscall_user_dispatch(struct pt_regs regs)\n--\nkernel/entry/syscall_user_dispatch.c-76-\nkernel/entry/syscall_user_dispatch.c:77:static int task_set_syscall_user_dispatch(struct task_struct task, unsigned long mode,\nkernel/entry/syscall_user_dispatch.c-78-\t\t\t\t\t unsigned long offset, unsigned long len,\n--\nkernel/entry/syscall_user_dispatch.c-135-\nkernel/entry/syscall_user_dispatch.c:136:int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,\nkernel/entry/syscall_user_dispatch.c-137-\t\t\t unsigned long len, char __user selector)\nkernel/entry/syscall_user_dispatch.c-138-{\nkernel/entry/syscall_user_dispatch.c:139:\treturn task_set_syscall_user_dispatch(current, mode, offset, len, selector);\nkernel/entry/syscall_user_dispatch.c-140-}\n--\nkernel/entry/syscall_user_dispatch.c=166=int syscall_user_dispatch_set_config(struct task_struct task, unsigned long size,\n--\nkernel/entry/syscall_user_dispatch.c-176-\nkernel/entry/syscall_user_dispatch.c:177:\treturn task_set_syscall_user_dispatch(task, cfg.mode, cfg.offset, cfg.len,\nkernel/entry/syscall_user_dispatch.c-178-\t\t\t\t\t (char __user *)(uintptr_t)cfg.selector);\n" }
49/2	2026/06/29 15:30	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 32829 output: 38 thoughts: 611 Thoughts: My Initial Thoughts on Fuzzing Target Candidates Okay, so I'm thinking about where to start with fuzzing targets. `set_syscall_user_dispatch` and `task_set_syscall_user_dispatch` immediately jump out as possibilities, along with the configuration getters and setters: `syscall_user_dispatch_get_config` and `syscall_user_dispatch_set_config`. These seem like good starting points. Let's do some digging. I'll check `arch/arm64/kernel/ptrace.c`. Ah, right, the patch removed the `syscall_trace_enter` and `syscall_trace_exit` functions. They've been replaced by `arch_ptrace_report_syscall_entry` and `arch_ptrace_report_syscall_exit`, which are now in `arch/arm64/include/asm/entry-common.h`. Hmm, but `arch_ptrace_report_syscall_entry` is declared as `__always_inline`. That's a no-go for direct fuzzing. What about the generic `ptrace_report_syscall_entry`? It's a possibility, but potentially not as interesting as others. Now, let's look at `arch/arm64/kernel/debug-monitors.c`. Ah, here we go, `user_enable_single_step` and `user_disable_single_step` are being modified to set or clear the `SYSCALL_EXIT_TRAP` flag. Those are definitely good candidates! Then, I'll move on to `kernel/seccomp.c`. I see `__secure_computing` and `__seccomp_filter` now return a `bool`. They are both called on syscall entry if seccomp is enabled. The question is: are they too hot? Generally, in a fuzzing setup, seccomp is usually only enabled for specific tests, but I need to consider if Syzkaller heavily leverages seccomp to isolate processes. Wait, it doesn't use seccomp for its own processes, but it might fuzz it. Actually, `__seccomp_filter` is likely a good choice because it's the core of seccomp filtering. However, the prompt says to avoid "generic hot-path functions," so I need to be careful here. I know `__secure_computing` is probably a hot path if seccomp is enabled. I should stick to the less frequently used options. So, let me narrow it down to: * `arch_syscall_is_vdso_sigreturn` * `syscall_user_dispatch` * `set_syscall_user_dispatch` * `task_set_syscall_user_dispatch` * `syscall_user_dispatch_get_config` * `syscall_user_dispatch_set_config` * `user_enable_single_step` * `user_disable_single_step` Okay, hold on...I need to make sure I'm not missing anything. I need to make sure I've exhausted `kernel/entry/syscall_user_dispatch.c`. Are there any other functions in there? That should be a good area to start looking at more closely.
50/2	2026/06/29 15:31	tool	grepper	0m Args: { "Expression": "^bool syscall_user_dispatch", "PathPrefix": "kernel/entry/syscall_user_dispatch.c" } Results: { "Output": "kernel/entry/syscall_user_dispatch.c=35=bool __weak arch_syscall_is_vdso_sigreturn(struct pt_regs regs)\n--\nkernel/entry/syscall_user_dispatch.c-39-\nkernel/entry/syscall_user_dispatch.c:40:bool syscall_user_dispatch(struct pt_regs regs)\nkernel/entry/syscall_user_dispatch.c-41-{\n" }
51/2	2026/06/29 15:31	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 34313 output: 34 thoughts: 735 Thoughts: Analyzing the Kernel Patch: Arm64 and Generic Syscall Entry Okay, so initially I was a bit confused. `syscall_user_dispatch` is a general mechanism, but this patch is enabling it specifically for arm64 by selecting `GENERIC_ENTRY`. The patch doesn't actually add `syscall_user_dispatch.c` directly, it's modifying `arch/arm64/Kconfig` to set `GENERIC_ENTRY`, which conditionally includes `syscall_user_dispatch.c` if `GENERIC_SYSCALL` is also chosen. Right, got it. But hold on, let me double-check the diff itself... Aha! The diff does touch `kernel/entry/syscall_user_dispatch.c`. Now I see it. The patch adds `arch_syscall_is_vdso_sigreturn` as a weak function there. Okay, so that's a key function for this change. Now I understand. This function is implemented in `arch/arm64/kernel/vdso.c`, and it's definitely a core piece. Let's broaden the scope and look at other affected files within the patch. I'm seeing changes to `arch/alpha/kernel/ptrace.c`, `arch/arm/kernel/ptrace.c`, `arch/csky/kernel/ptrace.c`, `arch/m68k/kernel/ptrace.c`, `arch/mips/kernel/ptrace.c`, `arch/parisc/kernel/ptrace.c`, `arch/sh/kernel/ptrace_32.c`, `arch/um/kernel/skas/syscall.c`, `arch/x86/entry/vsyscall/vsyscall_64.c`, and `arch/xtensa/kernel/ptrace.c`. They're all being modified to use `!secure_computing()` instead of `secure_computing() == -1`. This means there's a wider, fundamental change across the kernel where `secure_computing()` is now returning a boolean. So, summing it up, the core of this patch is two-fold: First, it's a tree-wide change to convert `secure_computing()` to a boolean return. But the bigger, architectural change is migrating arm64 to this generic entry point mechanism. That's the primary area of interest, I believe. To solidify my understanding, let's list the relevant symbols. The key functions are: * `arch_syscall_is_vdso_sigreturn` * `user_enable_single_step` * `user_disable_single_step` Wait, hang on... `user_enable_single_step` is actually defined in `arch/arm64/kernel/debug-monitors.c`. I'll need to remember that. Let's quickly check the contents of `arch/arm64/kernel/syscall.c` too. While it won't be as important to understanding the impact of the change, it's important to understand the arm64 specific code. Looks like `do_el0_svc` and `do_el0_svc_compat` are hot paths, and I'll need to consider `invoke_syscall`, although I'm pretty sure that it's static and likely inlined. I need to keep this context when reviewing the code. I'll need to check the actual `arch/arm64/kernel/syscall.c` file itself.
52/2	2026/06/29 15:31	tool	grepper	0m Args: { "Expression": "invoke_syscall", "PathPrefix": "arch/arm64/kernel/syscall.c" } Results: { "Output": "arch/arm64/kernel/syscall.c=23=static long do_ni_syscall(struct pt_regs regs, int scno)\n--\narch/arm64/kernel/syscall.c-33-\narch/arm64/kernel/syscall.c:34:static long __invoke_syscall(struct pt_regs regs, syscall_fn_t syscall_fn)\narch/arm64/kernel/syscall.c-35-{\n--\narch/arm64/kernel/syscall.c-38-\narch/arm64/kernel/syscall.c:39:static void invoke_syscall(struct pt_regs regs, unsigned int scno,\narch/arm64/kernel/syscall.c-40-\t\t\t unsigned int sc_nr,\n--\narch/arm64/kernel/syscall.c-49-\t\tsyscall_fn = syscall_table[array_index_nospec(scno, sc_nr)];\narch/arm64/kernel/syscall.c:50:\t\tret = __invoke_syscall(regs, syscall_fn);\narch/arm64/kernel/syscall.c-51-\t} else {\n--\narch/arm64/kernel/syscall.c=58=static __always_inline void el0_svc_common(struct pt_regs regs, int scno, int sc_nr,\n--\narch/arm64/kernel/syscall.c-118-\narch/arm64/kernel/syscall.c:119:\tinvoke_syscall(regs, scno, sc_nr, syscall_table);\narch/arm64/kernel/syscall.c-120-trace_exit:\n" }
53/2	2026/06/29 15:31	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 36259 output: 31 thoughts: 1787 Thoughts: My Analysis of the System Call Patch Okay, let's break this down. My initial thought process focused on identifying the most interesting changes within this system call patch. I quickly honed in on the hot paths, like `invoke_syscall` and `__invoke_syscall`, which I filtered out to focus on the key modifications. I started by looking into `syscall_trace_enter`, which led me to specific architecture implementations. My attention then shifted to the less frequently executed functions that were actually changed. Specifically, I noticed modifications to: * `arch_syscall_is_vdso_sigreturn` * `user_enable_single_step` * `user_disable_single_step` I then double-checked `syscall_user_dispatch`. It wasn't directly modified but saw the addition of `arch_syscall_is_vdso_sigreturn` and therefore bears relevance. I moved on to analyze the implications of these changes, particularly how `arch_syscall_is_vdso_sigreturn` is implemented for ARM64. The differences, specifically those related to the VDSO sigreturn mechanism, seem critical. I then considered `__secure_computing` and `__seccomp_filter`. While those are core seccomp changes in the patch, my focus is on less-frequently called functions. Since this patch modifies the seccomp, but the hot path functions are not the focus, I discarded these. I revisited the question of generic hot paths, making sure to avoid including them in my selection, to prevent skewed test distributions. Therefore, I settled on listing the following: * `arch_syscall_is_vdso_sigreturn` * `user_enable_single_step` * `user_disable_single_step` These functions seem to capture the essence of the changes without being overly generic. Finally, I checked the required configurations to ensure proper testability. * `SECCOMP` * `SECCOMP_FILTER` * `COMPAT` (needed because of compat-related logic in `arch_syscall_is_vdso_sigreturn`)
54/2	2026/06/29 15:31	tool	grepper	0m Args: { "Expression": "config COMPAT", "PathPrefix": "arch/arm64/Kconfig" } Results: { "Output": "arch/arm64/Kconfig=1746=config ARM64_TAGGED_ADDR_ABI\n--\narch/arm64/Kconfig-1754-\narch/arm64/Kconfig:1755:menuconfig COMPAT\narch/arm64/Kconfig-1756-\tbool \"Kernel support for 32-bit EL0\"\n--\narch/arm64/Kconfig=1775=config KUSER_HELPERS\n--\narch/arm64/Kconfig-1801-\narch/arm64/Kconfig:1802:config COMPAT_VDSO\narch/arm64/Kconfig-1803-\tbool \"Enable vDSO for 32-bit applications\"\n--\narch/arm64/Kconfig=1815=config THUMB2_COMPAT_VDSO\n--\narch/arm64/Kconfig-1822-\narch/arm64/Kconfig:1823:config COMPAT_ALIGNMENT_FIXUPS\narch/arm64/Kconfig-1824-\tbool \"Fix up misaligned multi-word loads and stores in user space\"\n" }
55/2	2026/06/29 15:31	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 38831 output: 27 thoughts: 28 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: Configuration Verification: A Quick Check Right, so we're looking at a config here. Good, `COMPAT` is definitely a valid option; that's straightforward. Now, let's just make sure we haven't overlooked anything related to security, particularly with this `SECCOMP` and `SECCOMP_FILTER` combo. I need to quickly refresh my mental map of how these interact and the potential implications of their settings. Gotta ensure no oversights here. Gotta confirm the SECCOMP policies are well-defined. Alright, let's delve deeper to confirm that.
56/2	2026/06/29 15:31	tool	grepper	0m Args: { "Expression": "config SECCOMP", "PathPrefix": "arch/Kconfig" } Results: { "Output": "arch/Kconfig=628=config HAVE_ARCH_SECCOMP_FILTER\n--\narch/Kconfig-646-\narch/Kconfig:647:config SECCOMP\narch/Kconfig-648-\tprompt \"Enable seccomp to safely execute untrusted bytecode\"\n--\narch/Kconfig-663-\narch/Kconfig:664:config SECCOMP_FILTER\narch/Kconfig-665-\tdef_bool y\n--\narch/Kconfig-673-\narch/Kconfig:674:config SECCOMP_CACHE_DEBUG\narch/Kconfig-675-\tbool \"Show seccomp filter cache status in /proc/pid/seccomp_cache\"\n" }
57/2	2026/06/29 15:31	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 39212 output: 220 thoughts: 481 Thoughts: My Assessment of the Arm64 System Call Migration Patch Okay, this looks valid. Let me quickly run through this patch's implications for fuzzing. Are there any other configuration details I need to consider? Right, it modifies `arch/arm64/Kconfig` to select `GENERIC_ENTRY`. `GENERIC_ENTRY` is selected, so I don't need to enable it explicitly. That simplifies things. Let's break down the core of this: the patch moves arm64 to the generic entry code for system calls. This means it's ditching the custom arm64 syscall entry/exit tracing and switching to the generic `syscall_trace_enter()` and `syscall_exit_to_user_mode_work()` functions. It also modifies `secure_computing()` across the tree to return a boolean instead of an integer. That's a substantial functional shift in how syscalls work on arm64, and it ripples out to seccomp handling across architectures. Therefore, fuzzing efforts should target the specific new entry points on arm64 introduced by the generic entry mechanism. I'm thinking specifically about things like `arch_syscall_is_vdso_sigreturn`. And, I need to look closely at single-step ptrace interaction, since that was modified to work with the generic entry. To exercise the seccomp changes and the compat branch of the vdso sigreturn check, I should definitely enable `SECCOMP`, `SECCOMP_FILTER`, and `COMPAT`. My key focus symbols here are: * `arch_syscall_is_vdso_sigreturn` * `user_enable_single_step` * `user_disable_single_step` Wait... I see `arch_syscall_is_vdso_sigreturn` is also added as a weak function in `kernel/entry/syscall_user_dispatch.c`. Alright, so the function is defined in more than one place. Hmm, what about fuzzing `__secure_computing` directly? It's a hot path, and it's been touched by this patch. However, it's too risky to include in this current focus. I don't want to skew the results by including code that is too broadly changed. Let me just quickly verify if there are any other relevant functions to consider... Okay, `ptrace_save_reg` in `arch/arm64/include/asm/entry-common.h` and `arch_ptrace_report_syscall_entry` and `arch_ptrace_report_syscall_exit` are all `__always_inline`. That means I can't target them directly for fuzzing. Okay, I'm confident with these three focus symbols. Let's call `set-results`.
58/2	2026/06/29 15:31	tool	set-results	0m Args: { "EnableConfigs": [ "SECCOMP", "SECCOMP_FILTER", "COMPAT" ], "FocusSymbols": [ "arch_syscall_is_vdso_sigreturn", "user_enable_single_step", "user_disable_single_step" ], "Reasoning": "The patch migrates arm64 to use the generic entry code for system calls, replacing custom arm64 syscall entry/exit tracing with generic hooks. It also modifies secure_computing() tree-wide to return a boolean. This is a major functional change to the core syscall path on arm64 and seccomp handling. Fuzzing should focus on the newly added arm64-specific generic entry hooks (e.g., arch_syscall_is_vdso_sigreturn) and ptrace single-step toggling which was modified to interact with generic entry. SECCOMP and COMPAT configs are required to exercise the modified seccomp logic and compat vdso checks.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "SECCOMP", "SECCOMP_FILTER", "COMPAT" ], "FocusSymbols": [ "arch_syscall_is_vdso_sigreturn", "user_enable_single_step", "user_disable_single_step" ], "Reasoning": "The patch migrates arm64 to use the generic entry code for system calls, replacing custom arm64 syscall entry/exit tracing with generic hooks. It also modifies secure_computing() tree-wide to return a boolean. This is a major functional change to the core syscall path on arm64 and seccomp handling. Fuzzing should focus on the newly added arm64-specific generic entry hooks (e.g., arch_syscall_is_vdso_sigreturn) and ptrace single-step toggling which was modified to interact with generic entry. SECCOMP and COMPAT configs are required to exercise the modified seccomp logic and compat vdso checks.", "WorthFuzzing": true }

{
  "EnableConfigs": [
    "SECCOMP",
    "SECCOMP_FILTER",
    "COMPAT"
  ],
  "FocusSymbols": [
    "arch_syscall_is_vdso_sigreturn",
    "user_enable_single_step",
    "user_disable_single_step"
  ],
  "Reasoning": "The patch migrates arm64 to use the generic entry code for system calls, replacing custom arm64 syscall entry/exit tracing with generic hooks. It also modifies secure_computing() tree-wide to return a boolean. This is a major functional change to the core syscall path on arm64 and seccomp handling. Fuzzing should focus on the newly added arm64-specific generic entry hooks (e.g., arch_syscall_is_vdso_sigreturn) and ptrace single-step toggling which was modified to interact with generic entry. SECCOMP and COMPAT configs are required to exercise the modified seccomp logic and compat vdso checks.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit 03669f942eb53ede0f9214de36e8cf43b018989d\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jun 29 15:27:46 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c\nindex 0687760ea46698..27d9847b108237 100644\n--- a/arch/alpha/kernel/ptrace.c\n+++ b/arch/alpha/kernel/ptrace.c\n@@ -387,7 +387,7 @@ asmlinkage unsigned long syscall_trace_enter(void)\n \t * If this fails, seccomp may already have set up the return value\n \t * (e.g. SECCOMP_RET_ERRNO / TRACE).\n \t */\n-\tif (secure_computing() == -1) {\n+\tif (!secure_computing()) {\n \t\tif (regs-\u003er19 == 0 \u0026\u0026 regs-\u003er0 == (unsigned long)-1)\n \t\t\tsyscall_set_return_value(current, regs, -ENOSYS, 0);\n \t\tsyscall_set_nr(current, regs, -1);\ndiff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c\nindex 7951b2c06fec60..5210745725ca7d 100644\n--- a/arch/arm/kernel/ptrace.c\n+++ b/arch/arm/kernel/ptrace.c\n@@ -855,7 +855,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)\n \n \t/* Do seccomp after ptrace; syscall may have changed. */\n #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER\n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n #else\n \t/* XXX: remove this once OABI gets fixed */\ndiff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig\nindex b3afe0688919bd..aea686dce3d5ac 100644\n--- a/arch/arm64/Kconfig\n+++ b/arch/arm64/Kconfig\n@@ -128,9 +128,9 @@ config ARM64\n \tselect GENERIC_CPU_DEVICES\n \tselect GENERIC_CPU_VULNERABILITIES\n \tselect GENERIC_EARLY_IOREMAP\n+\tselect GENERIC_ENTRY\n \tselect GENERIC_IDLE_POLL_SETUP\n \tselect GENERIC_IOREMAP\n-\tselect GENERIC_IRQ_ENTRY\n \tselect GENERIC_IRQ_IPI\n \tselect GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD\n \tselect GENERIC_IRQ_PROBE\ndiff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h\nindex d2779d604c7be2..f43d4dea916a5b 100644\n--- a/arch/arm64/include/asm/elf.h\n+++ b/arch/arm64/include/asm/elf.h\n@@ -185,6 +185,7 @@ do {\t\t\t\t\t\t\t\t\t\\\n struct linux_binprm;\n extern int arch_setup_additional_pages(struct linux_binprm *bprm,\n \t\t\t\t       int uses_interp);\n+extern bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs);\n \n /* 1GB of VA */\n #ifdef CONFIG_COMPAT\ndiff --git a/arch/arm64/include/asm/entry-common.h b/arch/arm64/include/asm/entry-common.h\nindex cab8cd78f69385..d8bf4bf342e80f 100644\n--- a/arch/arm64/include/asm/entry-common.h\n+++ b/arch/arm64/include/asm/entry-common.h\n@@ -3,14 +3,21 @@\n #ifndef _ASM_ARM64_ENTRY_COMMON_H\n #define _ASM_ARM64_ENTRY_COMMON_H\n \n+#include \u003clinux/ptrace.h\u003e\n #include \u003clinux/thread_info.h\u003e\n \n+#include \u003casm/compat.h\u003e\n #include \u003casm/cpufeature.h\u003e\n #include \u003casm/daifflags.h\u003e\n #include \u003casm/fpsimd.h\u003e\n #include \u003casm/mte.h\u003e\n #include \u003casm/stacktrace.h\u003e\n \n+enum ptrace_syscall_dir {\n+\tPTRACE_SYSCALL_ENTER = 0,\n+\tPTRACE_SYSCALL_EXIT,\n+};\n+\n #define ARCH_EXIT_TO_USER_MODE_WORK (_TIF_MTE_ASYNC_FAULT | _TIF_FOREIGN_FPSTATE)\n \n static __always_inline void arch_exit_to_user_mode_work(struct pt_regs *regs,\n@@ -54,4 +61,73 @@ static inline bool arch_irqentry_exit_need_resched(void)\n \n #define arch_irqentry_exit_need_resched arch_irqentry_exit_need_resched\n \n+static __always_inline unsigned long ptrace_save_reg(struct pt_regs *regs,\n+\t\t\t\t\t\t     enum ptrace_syscall_dir dir,\n+\t\t\t\t\t\t     int *regno)\n+{\n+\tunsigned long saved_reg;\n+\n+\t/*\n+\t * We have some ABI weirdness here in the way that we handle syscall\n+\t * exit stops because we indicate whether or not the stop has been\n+\t * signalled from syscall entry or syscall exit by clobbering a general\n+\t * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee\n+\t * and restoring its old value after the stop. This means that:\n+\t *\n+\t * - Any writes by the tracer to this register during the stop are\n+\t *   ignored/discarded.\n+\t *\n+\t * - The actual value of the register is not available during the stop,\n+\t *   so the tracer cannot save it and restore it later.\n+\t *\n+\t * - Syscall stops behave differently to seccomp and pseudo-step traps\n+\t *   (the latter do not nobble any registers).\n+\t */\n+\t*regno = (is_compat_task() ? 12 : 7);\n+\tsaved_reg = regs-\u003eregs[*regno];\n+\tregs-\u003eregs[*regno] = dir;\n+\n+\treturn saved_reg;\n+}\n+\n+static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs *regs)\n+{\n+\tunsigned long saved_reg;\n+\tint regno, ret;\n+\n+\tsaved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, \u0026regno);\n+\tret = ptrace_report_syscall_entry(regs);\n+\tif (ret)\n+\t\tforget_syscall(regs);\n+\tregs-\u003eregs[regno] = saved_reg;\n+\n+\treturn ret;\n+}\n+\n+#define arch_ptrace_report_syscall_entry arch_ptrace_report_syscall_entry\n+\n+static __always_inline void arch_ptrace_report_syscall_exit(struct pt_regs *regs,\n+\t\t\t\t\t\t\t    int step)\n+{\n+\tunsigned long saved_reg;\n+\tint regno;\n+\n+\tsaved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_EXIT, \u0026regno);\n+\tif (!step) {\n+\t\tptrace_report_syscall_exit(regs, 0);\n+\t\tregs-\u003eregs[regno] = saved_reg;\n+\t} else {\n+\t\tregs-\u003eregs[regno] = saved_reg;\n+\n+\t\t/*\n+\t\t * Signal a pseudo-step exception since we are stepping but\n+\t\t * tracer modifications to the registers may have rewound the\n+\t\t * state machine.\n+\t\t */\n+\t\tptrace_report_syscall_exit(regs, 1);\n+\t}\n+}\n+\n+#define arch_ptrace_report_syscall_exit arch_ptrace_report_syscall_exit\n+\n #endif /* _ASM_ARM64_ENTRY_COMMON_H */\ndiff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h\nindex 5e4c7fc44f7315..84b1c36233d41e 100644\n--- a/arch/arm64/include/asm/syscall.h\n+++ b/arch/arm64/include/asm/syscall.h\n@@ -8,6 +8,7 @@\n #include \u003cuapi/linux/audit.h\u003e\n #include \u003clinux/compat.h\u003e\n #include \u003clinux/err.h\u003e\n+#include \u003clinux/rseq.h\u003e\n \n typedef long (*syscall_fn_t)(const struct pt_regs *regs);\n \n@@ -120,7 +121,4 @@ static inline int syscall_get_arch(struct task_struct *task)\n \treturn AUDIT_ARCH_AARCH64;\n }\n \n-int syscall_trace_enter(struct pt_regs *regs);\n-void syscall_trace_exit(struct pt_regs *regs);\n-\n #endif\t/* __ASM_SYSCALL_H */\ndiff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h\nindex 5d7fe3e153c850..3f621ba0f96137 100644\n--- a/arch/arm64/include/asm/thread_info.h\n+++ b/arch/arm64/include/asm/thread_info.h\n@@ -46,6 +46,7 @@ struct thread_info {\n \tu64\t\t\tmpam_partid_pmg;\n #endif\n \tu32\t\t\tcpu;\n+\tunsigned long\t\tsyscall_work;   /* SYSCALL_WORK_ flags */\n };\n \n #define thread_saved_pc(tsk)\t\\\n@@ -68,11 +69,6 @@ void arch_setup_new_exec(void);\n #define TIF_UPROBE\t\t5\t/* uprobe breakpoint or singlestep */\n #define TIF_MTE_ASYNC_FAULT\t6\t/* MTE Asynchronous Tag Check Fault */\n #define TIF_NOTIFY_SIGNAL\t7\t/* signal notifications exist */\n-#define TIF_SYSCALL_TRACE\t8\t/* syscall trace active */\n-#define TIF_SYSCALL_AUDIT\t9\t/* syscall auditing */\n-#define TIF_SYSCALL_TRACEPOINT\t10\t/* syscall tracepoint for ftrace */\n-#define TIF_SECCOMP\t\t11\t/* syscall secure computing */\n-#define TIF_SYSCALL_EMU\t\t12\t/* syscall emulation active */\n #define TIF_PATCH_PENDING\t13\t/* pending live patching update */\n #define TIF_MEMDIE\t\t18\t/* is terminating due to OOM killer */\n #define TIF_FREEZE\t\t19\n@@ -94,24 +90,14 @@ void arch_setup_new_exec(void);\n #define _TIF_NEED_RESCHED_LAZY\t(1 \u003c\u003c TIF_NEED_RESCHED_LAZY)\n #define _TIF_NOTIFY_RESUME\t(1 \u003c\u003c TIF_NOTIFY_RESUME)\n #define _TIF_FOREIGN_FPSTATE\t(1 \u003c\u003c TIF_FOREIGN_FPSTATE)\n-#define _TIF_SYSCALL_TRACE\t(1 \u003c\u003c TIF_SYSCALL_TRACE)\n-#define _TIF_SYSCALL_AUDIT\t(1 \u003c\u003c TIF_SYSCALL_AUDIT)\n-#define _TIF_SYSCALL_TRACEPOINT\t(1 \u003c\u003c TIF_SYSCALL_TRACEPOINT)\n-#define _TIF_SECCOMP\t\t(1 \u003c\u003c TIF_SECCOMP)\n-#define _TIF_SYSCALL_EMU\t(1 \u003c\u003c TIF_SYSCALL_EMU)\n #define _TIF_PATCH_PENDING\t(1 \u003c\u003c TIF_PATCH_PENDING)\n #define _TIF_UPROBE\t\t(1 \u003c\u003c TIF_UPROBE)\n-#define _TIF_SINGLESTEP\t\t(1 \u003c\u003c TIF_SINGLESTEP)\n #define _TIF_32BIT\t\t(1 \u003c\u003c TIF_32BIT)\n #define _TIF_SVE\t\t(1 \u003c\u003c TIF_SVE)\n #define _TIF_MTE_ASYNC_FAULT\t(1 \u003c\u003c TIF_MTE_ASYNC_FAULT)\n #define _TIF_NOTIFY_SIGNAL\t(1 \u003c\u003c TIF_NOTIFY_SIGNAL)\n #define _TIF_TSC_SIGSEGV\t(1 \u003c\u003c TIF_TSC_SIGSEGV)\n \n-#define _TIF_SYSCALL_WORK\t(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \\\n-\t\t\t\t _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | \\\n-\t\t\t\t _TIF_SYSCALL_EMU)\n-\n #ifdef CONFIG_SHADOW_CALL_STACK\n #define INIT_SCS\t\t\t\t\t\t\t\\\n \t.scs_base\t= init_shadow_call_stack,\t\t\t\\\ndiff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c\nindex 29307642f4c904..c5368383915536 100644\n--- a/arch/arm64/kernel/debug-monitors.c\n+++ b/arch/arm64/kernel/debug-monitors.c\n@@ -385,11 +385,19 @@ void user_enable_single_step(struct task_struct *task)\n \n \tif (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))\n \t\tset_regs_spsr_ss(task_pt_regs(task));\n+\n+\t/*\n+\t * Ensure that the generic entry code triggers a trap once stepping\n+\t * out of a system call prior to executing any user instruction,\n+\t * as the generic entry code does not natively check for TIF_SINGLESTEP.\n+\t */\n+\tset_task_syscall_work(task, SYSCALL_EXIT_TRAP);\n }\n NOKPROBE_SYMBOL(user_enable_single_step);\n \n void user_disable_single_step(struct task_struct *task)\n {\n \tclear_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);\n+\tclear_task_syscall_work(task, SYSCALL_EXIT_TRAP);\n }\n NOKPROBE_SYMBOL(user_disable_single_step);\ndiff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c\nindex 4d08598e2891d3..61a66868294715 100644\n--- a/arch/arm64/kernel/ptrace.c\n+++ b/arch/arm64/kernel/ptrace.c\n@@ -8,7 +8,6 @@\n  * Copyright (C) 2012 ARM Ltd.\n  */\n \n-#include \u003clinux/audit.h\u003e\n #include \u003clinux/compat.h\u003e\n #include \u003clinux/kernel.h\u003e\n #include \u003clinux/sched/signal.h\u003e\n@@ -18,7 +17,6 @@\n #include \u003clinux/smp.h\u003e\n #include \u003clinux/ptrace.h\u003e\n #include \u003clinux/user.h\u003e\n-#include \u003clinux/seccomp.h\u003e\n #include \u003clinux/security.h\u003e\n #include \u003clinux/init.h\u003e\n #include \u003clinux/signal.h\u003e\n@@ -28,7 +26,6 @@\n #include \u003clinux/hw_breakpoint.h\u003e\n #include \u003clinux/regset.h\u003e\n #include \u003clinux/elf.h\u003e\n-#include \u003clinux/rseq.h\u003e\n \n #include \u003casm/compat.h\u003e\n #include \u003casm/cpufeature.h\u003e\n@@ -38,13 +35,9 @@\n #include \u003casm/mte.h\u003e\n #include \u003casm/pointer_auth.h\u003e\n #include \u003casm/stacktrace.h\u003e\n-#include \u003casm/syscall.h\u003e\n #include \u003casm/traps.h\u003e\n #include \u003casm/system_misc.h\u003e\n \n-#define CREATE_TRACE_POINTS\n-#include \u003ctrace/events/syscalls.h\u003e\n-\n struct pt_regs_offset {\n \tconst char *name;\n \tint offset;\n@@ -2339,114 +2332,6 @@ long arch_ptrace(struct task_struct *child, long request,\n \treturn ptrace_request(child, request, addr, data);\n }\n \n-enum ptrace_syscall_dir {\n-\tPTRACE_SYSCALL_ENTER = 0,\n-\tPTRACE_SYSCALL_EXIT,\n-};\n-\n-static __always_inline unsigned long ptrace_save_reg(struct pt_regs *regs,\n-\t\t\t\t\t\t     enum ptrace_syscall_dir dir,\n-\t\t\t\t\t\t     int *regno)\n-{\n-\tunsigned long saved_reg;\n-\n-\t/*\n-\t * We have some ABI weirdness here in the way that we handle syscall\n-\t * exit stops because we indicate whether or not the stop has been\n-\t * signalled from syscall entry or syscall exit by clobbering a general\n-\t * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee\n-\t * and restoring its old value after the stop. This means that:\n-\t *\n-\t * - Any writes by the tracer to this register during the stop are\n-\t *   ignored/discarded.\n-\t *\n-\t * - The actual value of the register is not available during the stop,\n-\t *   so the tracer cannot save it and restore it later.\n-\t *\n-\t * - Syscall stops behave differently to seccomp and pseudo-step traps\n-\t *   (the latter do not nobble any registers).\n-\t */\n-\t*regno = (is_compat_task() ? 12 : 7);\n-\tsaved_reg = regs-\u003eregs[*regno];\n-\tregs-\u003eregs[*regno] = dir;\n-\n-\treturn saved_reg;\n-}\n-\n-static int report_syscall_entry(struct pt_regs *regs)\n-{\n-\tunsigned long saved_reg;\n-\tint regno, ret;\n-\n-\tsaved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, \u0026regno);\n-\tret = ptrace_report_syscall_entry(regs);\n-\tif (ret)\n-\t\tforget_syscall(regs);\n-\tregs-\u003eregs[regno] = saved_reg;\n-\n-\treturn ret;\n-}\n-\n-static void report_syscall_exit(struct pt_regs *regs)\n-{\n-\tunsigned long saved_reg;\n-\tint regno;\n-\n-\tsaved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_EXIT, \u0026regno);\n-\tif (!test_thread_flag(TIF_SINGLESTEP)) {\n-\t\tptrace_report_syscall_exit(regs, 0);\n-\t\tregs-\u003eregs[regno] = saved_reg;\n-\t} else {\n-\t\tregs-\u003eregs[regno] = saved_reg;\n-\n-\t\t/*\n-\t\t * Signal a pseudo-step exception since we are stepping but\n-\t\t * tracer modifications to the registers may have rewound the\n-\t\t * state machine.\n-\t\t */\n-\t\tptrace_report_syscall_exit(regs, 1);\n-\t}\n-}\n-\n-int syscall_trace_enter(struct pt_regs *regs)\n-{\n-\tunsigned long flags = read_thread_flags();\n-\tint ret;\n-\n-\tif (flags \u0026 (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {\n-\t\tret = report_syscall_entry(regs);\n-\t\tif (ret || (flags \u0026 _TIF_SYSCALL_EMU))\n-\t\t\treturn NO_SYSCALL;\n-\t}\n-\n-\t/* Do the secure computing after ptrace; failures should be fast. */\n-\tif (secure_computing() == -1)\n-\t\treturn NO_SYSCALL;\n-\n-\tif (test_thread_flag(TIF_SYSCALL_TRACEPOINT))\n-\t\ttrace_sys_enter(regs, regs-\u003esyscallno);\n-\n-\taudit_syscall_entry(regs-\u003esyscallno, regs-\u003eorig_x0, regs-\u003eregs[1],\n-\t\t\t    regs-\u003eregs[2], regs-\u003eregs[3]);\n-\n-\treturn regs-\u003esyscallno;\n-}\n-\n-void syscall_trace_exit(struct pt_regs *regs)\n-{\n-\tunsigned long flags = read_thread_flags();\n-\n-\taudit_syscall_exit(regs);\n-\n-\tif (flags \u0026 _TIF_SYSCALL_TRACEPOINT)\n-\t\ttrace_sys_exit(regs, syscall_get_return_value(current, regs));\n-\n-\tif (flags \u0026 (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP))\n-\t\treport_syscall_exit(regs);\n-\n-\trseq_syscall(regs);\n-}\n-\n /*\n  * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487D.a.\n  * We permit userspace to set SSBS (AArch64 bit 12, AArch32 bit 23) which is\ndiff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c\nindex 38e6fa204c17b5..093eebb9d764ac 100644\n--- a/arch/arm64/kernel/signal.c\n+++ b/arch/arm64/kernel/signal.c\n@@ -8,8 +8,8 @@\n \n #include \u003clinux/cache.h\u003e\n #include \u003clinux/compat.h\u003e\n+#include \u003clinux/entry-common.h\u003e\n #include \u003clinux/errno.h\u003e\n-#include \u003clinux/irq-entry-common.h\u003e\n #include \u003clinux/kernel.h\u003e\n #include \u003clinux/signal.h\u003e\n #include \u003clinux/freezer.h\u003e\ndiff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c\nindex 358ddfbf1401ac..e0a98fac3b8567 100644\n--- a/arch/arm64/kernel/syscall.c\n+++ b/arch/arm64/kernel/syscall.c\n@@ -2,6 +2,7 @@\n \n #include \u003clinux/compiler.h\u003e\n #include \u003clinux/context_tracking.h\u003e\n+#include \u003clinux/entry-common.h\u003e\n #include \u003clinux/errno.h\u003e\n #include \u003clinux/nospec.h\u003e\n #include \u003clinux/ptrace.h\u003e\n@@ -54,15 +55,11 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,\n \tsyscall_set_return_value(current, regs, 0, ret);\n }\n \n-static inline bool has_syscall_work(unsigned long flags)\n-{\n-\treturn unlikely(flags \u0026 _TIF_SYSCALL_WORK);\n-}\n-\n-static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,\n-\t\t\t   const syscall_fn_t syscall_table[])\n+static __always_inline void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,\n+\t\t\t\t\t   const syscall_fn_t syscall_table[])\n {\n \tunsigned long flags = read_thread_flags();\n+\tunsigned long work;\n \n \tregs-\u003eorig_x0 = regs-\u003eregs[0];\n \tregs-\u003esyscallno = scno;\n@@ -95,7 +92,8 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,\n \t\treturn;\n \t}\n \n-\tif (has_syscall_work(flags)) {\n+\twork = READ_ONCE(current_thread_info()-\u003esyscall_work);\n+\tif (unlikely(work \u0026 SYSCALL_WORK_ENTER)) {\n \t\t/*\n \t\t * The de-facto standard way to skip a system call using ptrace\n \t\t * is to set the system call to -1 (NO_SYSCALL) and set x0 to a\n@@ -113,26 +111,14 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,\n \t\t */\n \t\tif (scno == NO_SYSCALL)\n \t\t\tsyscall_set_return_value(current, regs, -ENOSYS, 0);\n-\t\tscno = syscall_trace_enter(regs);\n+\t\tscno = syscall_trace_enter(regs, work);\n \t\tif (scno == NO_SYSCALL)\n \t\t\tgoto trace_exit;\n \t}\n \n \tinvoke_syscall(regs, scno, sc_nr, syscall_table);\n-\n-\t/*\n-\t * The tracing status may have changed under our feet, so we have to\n-\t * check again. However, if we were tracing entry, then we always trace\n-\t * exit regardless, as the old entry assembly did.\n-\t */\n-\tif (!has_syscall_work(flags) \u0026\u0026 !IS_ENABLED(CONFIG_DEBUG_RSEQ)) {\n-\t\tflags = read_thread_flags();\n-\t\tif (!has_syscall_work(flags) \u0026\u0026 !(flags \u0026 _TIF_SINGLESTEP))\n-\t\t\treturn;\n-\t}\n-\n trace_exit:\n-\tsyscall_trace_exit(regs);\n+\tsyscall_exit_to_user_mode_work(regs);\n }\n \n void do_el0_svc(struct pt_regs *regs)\ndiff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c\nindex 592dd8668de463..5a0314a3c26e82 100644\n--- a/arch/arm64/kernel/vdso.c\n+++ b/arch/arm64/kernel/vdso.c\n@@ -343,3 +343,19 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)\n \n \treturn ret;\n }\n+\n+bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\n+{\n+\tunsigned long sigtramp;\n+\n+#ifdef CONFIG_COMPAT\n+\tif (is_compat_task()) {\n+\t\tunsigned long sigpage = (unsigned long)current-\u003emm-\u003econtext.sigpage;\n+\n+\t\treturn regs-\u003epc \u003e= sigpage \u0026\u0026 regs-\u003epc \u003c (sigpage + PAGE_SIZE);\n+\t}\n+#endif\n+\tsigtramp = (unsigned long)VDSO_SYMBOL(current-\u003emm-\u003econtext.vdso, sigtramp);\n+\n+\treturn regs-\u003epc == (sigtramp + 8);\n+}\ndiff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c\nindex 6bb685a2646b56..11c5eff41e9d6a 100644\n--- a/arch/csky/kernel/ptrace.c\n+++ b/arch/csky/kernel/ptrace.c\n@@ -323,7 +323,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)\n \t\tif (ptrace_report_syscall_entry(regs))\n \t\t\treturn -1;\n \n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n \n \tif (test_thread_flag(TIF_SYSCALL_TRACEPOINT))\ndiff --git a/arch/loongarch/include/asm/syscall.h b/arch/loongarch/include/asm/syscall.h\nindex df8ea223c77b1a..946886794cedf0 100644\n--- a/arch/loongarch/include/asm/syscall.h\n+++ b/arch/loongarch/include/asm/syscall.h\n@@ -85,9 +85,4 @@ static inline int syscall_get_arch(struct task_struct *task)\n #endif\n }\n \n-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\n-{\n-\treturn false;\n-}\n-\n #endif\t/* __ASM_LOONGARCH_SYSCALL_H */\ndiff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c\nindex cfa2df24eced12..d2411404b9dfcf 100644\n--- a/arch/m68k/kernel/ptrace.c\n+++ b/arch/m68k/kernel/ptrace.c\n@@ -281,7 +281,7 @@ asmlinkage int syscall_trace_enter(void)\n \tif (test_thread_flag(TIF_SYSCALL_TRACE))\n \t\tret = ptrace_report_syscall_entry(task_pt_regs(current));\n \n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n \n \treturn ret;\ndiff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c\nindex 3f4c94c8812417..0d809cda754292 100644\n--- a/arch/mips/kernel/ptrace.c\n+++ b/arch/mips/kernel/ptrace.c\n@@ -1328,7 +1328,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)\n \t\t\treturn -1;\n \t}\n \n-\tif (secure_computing())\n+\tif (!secure_computing())\n \t\treturn -1;\n \n \tif (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))\ndiff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c\nindex 8a17ab7e6e0b93..565b51a48c8a87 100644\n--- a/arch/parisc/kernel/ptrace.c\n+++ b/arch/parisc/kernel/ptrace.c\n@@ -351,7 +351,7 @@ long do_syscall_trace_enter(struct pt_regs *regs)\n \t}\n \n \t/* Do the secure computing check after ptrace. */\n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n \n #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS\ndiff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h\nindex 834fcc4f7b543b..4b3c52ed6e9d2b 100644\n--- a/arch/powerpc/include/asm/syscall.h\n+++ b/arch/powerpc/include/asm/syscall.h\n@@ -139,9 +139,4 @@ static inline int syscall_get_arch(struct task_struct *task)\n \telse\n \t\treturn AUDIT_ARCH_PPC64;\n }\n-\n-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\n-{\n-\treturn false;\n-}\n #endif\t/* _ASM_SYSCALL_H */\ndiff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h\nindex 8067e666a4ca68..987c9a78806f78 100644\n--- a/arch/riscv/include/asm/syscall.h\n+++ b/arch/riscv/include/asm/syscall.h\n@@ -112,11 +112,6 @@ static inline void syscall_handler(struct pt_regs *regs, ulong syscall)\n \tregs-\u003ea0 = fn(regs);\n }\n \n-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\n-{\n-\treturn false;\n-}\n-\n asmlinkage long sys_riscv_flush_icache(uintptr_t, uintptr_t, uintptr_t);\n \n asmlinkage long sys_riscv_hwprobe(struct riscv_hwprobe *, size_t, size_t,\ndiff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h\nindex 4271e4169f45b6..5f310caad1fcec 100644\n--- a/arch/s390/include/asm/syscall.h\n+++ b/arch/s390/include/asm/syscall.h\n@@ -89,11 +89,6 @@ static inline int syscall_get_arch(struct task_struct *task)\n \treturn AUDIT_ARCH_S390X;\n }\n \n-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\n-{\n-\treturn false;\n-}\n-\n #define SYSCALL_FMT_0\n #define SYSCALL_FMT_1 , \"0\" (r2)\n #define SYSCALL_FMT_2 , \"d\" (r3) SYSCALL_FMT_1\ndiff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c\nindex 06f765d71a2951..8687f17cbe5adc 100644\n--- a/arch/sh/kernel/ptrace_32.c\n+++ b/arch/sh/kernel/ptrace_32.c\n@@ -460,7 +460,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)\n \t\treturn -1;\n \t}\n \n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\treturn -1;\n \n \tif (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))\ndiff --git a/arch/um/kernel/skas/syscall.c b/arch/um/kernel/skas/syscall.c\nindex ba7494f9bfe412..916cd7acceafdf 100644\n--- a/arch/um/kernel/skas/syscall.c\n+++ b/arch/um/kernel/skas/syscall.c\n@@ -27,7 +27,7 @@ void handle_syscall(struct uml_pt_regs *r)\n \t\tgoto out;\n \n \t/* Do the seccomp check after ptrace; failures should be fast. */\n-\tif (secure_computing() == -1)\n+\tif (!secure_computing())\n \t\tgoto out;\n \n \tsyscall = UPT_SYSCALL_NR(r);\ndiff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c\nindex ea36de9fa8641d..6aed3987b9f966 100644\n--- a/arch/x86/entry/vsyscall/vsyscall_64.c\n+++ b/arch/x86/entry/vsyscall/vsyscall_64.c\n@@ -198,7 +198,7 @@ static bool __emulate_vsyscall(struct pt_regs *regs, unsigned long address)\n \tregs-\u003eorig_ax = syscall_nr;\n \tregs-\u003eax = -ENOSYS;\n \ttmp = secure_computing();\n-\tif ((!tmp \u0026\u0026 regs-\u003eorig_ax != syscall_nr) || regs-\u003eip != address) {\n+\tif ((tmp \u0026\u0026 regs-\u003eorig_ax != syscall_nr) || regs-\u003eip != address) {\n \t\twarn_bad_vsyscall(KERN_DEBUG, regs,\n \t\t\t\t  \"seccomp tried to change syscall nr or ip\");\n \t\tforce_exit_sig(SIGSYS);\ndiff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c\nindex b80d54b2ea34e6..ef78fcd318ffcc 100644\n--- a/arch/xtensa/kernel/ptrace.c\n+++ b/arch/xtensa/kernel/ptrace.c\n@@ -553,8 +553,7 @@ int do_syscall_trace_enter(struct pt_regs *regs)\n \t\treturn 0;\n \t}\n \n-\tif (regs-\u003esyscall == NO_SYSCALL ||\n-\t    secure_computing() == -1) {\n+\tif (regs-\u003esyscall == NO_SYSCALL || !secure_computing()) {\n \t\tdo_syscall_trace_leave(regs);\n \t\treturn 0;\n \t}\ndiff --git a/include/linux/entry-common.h b/include/linux/entry-common.h\nindex 416a3352261fe8..3f66320e46d331 100644\n--- a/include/linux/entry-common.h\n+++ b/include/linux/entry-common.h\n@@ -100,9 +100,8 @@ static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned l\n \n \t/* Do seccomp after ptrace, to catch any tracer changes. */\n \tif (work \u0026 SYSCALL_WORK_SECCOMP) {\n-\t\tret = __secure_computing();\n-\t\tif (ret == -1L)\n-\t\t\treturn ret;\n+\t\tif (!__secure_computing())\n+\t\t\treturn -1L;\n \t}\n \n \t/* Either of the above might have changed the syscall number */\n@@ -113,7 +112,7 @@ static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned l\n \n \tsyscall_enter_audit(regs, syscall);\n \n-\treturn ret ? : syscall;\n+\treturn syscall;\n }\n \n /**\ndiff --git a/include/linux/seccomp.h b/include/linux/seccomp.h\nindex 9b959972bf4a22..7af3173f40e985 100644\n--- a/include/linux/seccomp.h\n+++ b/include/linux/seccomp.h\n@@ -22,14 +22,14 @@\n #include \u003clinux/atomic.h\u003e\n #include \u003casm/seccomp.h\u003e\n \n-extern int __secure_computing(void);\n+extern bool __secure_computing(void);\n \n #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER\n-static inline int secure_computing(void)\n+static inline bool secure_computing(void)\n {\n \tif (unlikely(test_syscall_work(SECCOMP)))\n \t\treturn  __secure_computing();\n-\treturn 0;\n+\treturn true;\n }\n #else\n extern void secure_computing_strict(int this_syscall);\n@@ -50,11 +50,11 @@ static inline int seccomp_mode(struct seccomp *s)\n struct seccomp_data;\n \n #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER\n-static inline int secure_computing(void) { return 0; }\n+static inline bool secure_computing(void) { return true; }\n #else\n static inline void secure_computing_strict(int this_syscall) { return; }\n #endif\n-static inline int __secure_computing(void) { return 0; }\n+static inline bool __secure_computing(void) { return true; }\n \n static inline long prctl_get_seccomp(void)\n {\ndiff --git a/include/linux/syscall_user_dispatch.h b/include/linux/syscall_user_dispatch.h\nindex 3858a6ffdd5c84..73d69e02807d85 100644\n--- a/include/linux/syscall_user_dispatch.h\n+++ b/include/linux/syscall_user_dispatch.h\n@@ -10,6 +10,7 @@\n \n #ifdef CONFIG_GENERIC_ENTRY\n \n+bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs);\n int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,\n \t\t\t      unsigned long len, char __user *selector);\n \ndiff --git a/kernel/entry/syscall_user_dispatch.c b/kernel/entry/syscall_user_dispatch.c\nindex d89dffcc2d6429..acf545774d3720 100644\n--- a/kernel/entry/syscall_user_dispatch.c\n+++ b/kernel/entry/syscall_user_dispatch.c\n@@ -32,6 +32,11 @@ static void trigger_sigsys(struct pt_regs *regs)\n \tforce_sig_info(\u0026info);\n }\n \n+bool __weak arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\n+{\n+\treturn false;\n+}\n+\n bool syscall_user_dispatch(struct pt_regs *regs)\n {\n \tstruct syscall_user_dispatch *sd = \u0026current-\u003esyscall_dispatch;\ndiff --git a/kernel/seccomp.c b/kernel/seccomp.c\nindex 066909393c38f5..1fec6efedab627 100644\n--- a/kernel/seccomp.c\n+++ b/kernel/seccomp.c\n@@ -1100,12 +1100,12 @@ void secure_computing_strict(int this_syscall)\n \telse\n \t\tBUG();\n }\n-int __secure_computing(void)\n+bool __secure_computing(void)\n {\n \tint this_syscall = syscall_get_nr(current, current_pt_regs());\n \n \tsecure_computing_strict(this_syscall);\n-\treturn 0;\n+\treturn true;\n }\n #else\n \n@@ -1256,7 +1256,7 @@ static int seccomp_do_user_notification(int this_syscall,\n \treturn -1;\n }\n \n-static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n+static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n {\n \tu32 filter_ret, action;\n \tstruct seccomp_data sd;\n@@ -1294,7 +1294,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n \tcase SECCOMP_RET_TRACE:\n \t\t/* We've been put in this state by the ptracer already. */\n \t\tif (recheck_after_trace)\n-\t\t\treturn 0;\n+\t\t\treturn true;\n \n \t\t/* ENOSYS these calls if there is no tracer attached. */\n \t\tif (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {\n@@ -1330,19 +1330,19 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n \t\t * a skip would have already been reported.\n \t\t */\n \t\tif (__seccomp_filter(this_syscall, true))\n-\t\t\treturn -1;\n+\t\t\treturn false;\n \n-\t\treturn 0;\n+\t\treturn true;\n \n \tcase SECCOMP_RET_USER_NOTIF:\n \t\tif (seccomp_do_user_notification(this_syscall, match, \u0026sd))\n \t\t\tgoto skip;\n \n-\t\treturn 0;\n+\t\treturn true;\n \n \tcase SECCOMP_RET_LOG:\n \t\tseccomp_log(this_syscall, 0, action, true);\n-\t\treturn 0;\n+\t\treturn true;\n \n \tcase SECCOMP_RET_ALLOW:\n \t\t/*\n@@ -1350,7 +1350,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n \t\t * this action since SECCOMP_RET_ALLOW is the starting\n \t\t * state in seccomp_run_filters().\n \t\t */\n-\t\treturn 0;\n+\t\treturn true;\n \n \tcase SECCOMP_RET_KILL_THREAD:\n \tcase SECCOMP_RET_KILL_PROCESS:\n@@ -1367,46 +1367,46 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n \t\t} else {\n \t\t\tdo_exit(SIGSYS);\n \t\t}\n-\t\treturn -1; /* skip the syscall go directly to signal handling */\n+\t\treturn false; /* skip the syscall go directly to signal handling */\n \t}\n \n \tunreachable();\n \n skip:\n \tseccomp_log(this_syscall, 0, action, match ? match-\u003elog : false);\n-\treturn -1;\n+\treturn false;\n }\n #else\n-static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n+static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n {\n \tBUG();\n \n-\treturn -1;\n+\treturn false;\n }\n #endif\n \n-int __secure_computing(void)\n+bool __secure_computing(void)\n {\n \tint mode = current-\u003eseccomp.mode;\n \tint this_syscall;\n \n \tif (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) \u0026\u0026\n \t    unlikely(current-\u003eptrace \u0026 PT_SUSPEND_SECCOMP))\n-\t\treturn 0;\n+\t\treturn true;\n \n \tthis_syscall = syscall_get_nr(current, current_pt_regs());\n \n \tswitch (mode) {\n \tcase SECCOMP_MODE_STRICT:\n \t\t__secure_computing_strict(this_syscall);  /* may call do_exit */\n-\t\treturn 0;\n+\t\treturn true;\n \tcase SECCOMP_MODE_FILTER:\n \t\treturn __seccomp_filter(this_syscall, false);\n \t/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */\n \tcase SECCOMP_MODE_DEAD:\n \t\tWARN_ON_ONCE(1);\n \t\tdo_exit(SIGKILL);\n-\t\treturn -1;\n+\t\treturn false;\n \tdefault:\n \t\tBUG();\n \t}\n"
}

gemini-3.1-pro-preview

{
  "EnableConfigs": [
    "SECCOMP",
    "SECCOMP_FILTER",
    "COMPAT"
  ],
  "FocusSymbols": [
    "arch_syscall_is_vdso_sigreturn",
    "user_enable_single_step",
    "user_disable_single_step"
  ],
  "Reasoning": "The patch migrates arm64 to use the generic entry code for system calls, replacing custom arm64 syscall entry/exit tracing with generic hooks. It also modifies secure_computing() tree-wide to return a boolean. This is a major functional change to the core syscall path on arm64 and seccomp handling. Fuzzing should focus on the newly added arm64-specific generic entry hooks (e.g., arch_syscall_is_vdso_sigreturn) and ptrace single-step toggling which was modified to interact with generic entry. SECCOMP and COMPAT configs are required to exercise the modified seccomp logic and compat vdso checks.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 03669f942eb53ede0f9214de36e8cf43b018989d
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jun 29 15:27:46 2026 +0000

    syz-cluster: applied patch under review

diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index 0687760ea46698..27d9847b108237 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -387,7 +387,7 @@ asmlinkage unsigned long syscall_trace_enter(void)
 	 * If this fails, seccomp may already have set up the return value
 	 * (e.g. SECCOMP_RET_ERRNO / TRACE).
 	 */
-	if (secure_computing() == -1) {
+	if (!secure_computing()) {
 		if (regs->r19 == 0 && regs->r0 == (unsigned long)-1)
 			syscall_set_return_value(current, regs, -ENOSYS, 0);
 		syscall_set_nr(current, regs, -1);
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 7951b2c06fec60..5210745725ca7d 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -855,7 +855,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 
 	/* Do seccomp after ptrace; syscall may have changed. */
 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
-	if (secure_computing() == -1)
+	if (!secure_computing())
 		return -1;
 #else
 	/* XXX: remove this once OABI gets fixed */
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b3afe0688919bd..aea686dce3d5ac 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -128,9 +128,9 @@ config ARM64
 	select GENERIC_CPU_DEVICES
 	select GENERIC_CPU_VULNERABILITIES
 	select GENERIC_EARLY_IOREMAP
+	select GENERIC_ENTRY
 	select GENERIC_IDLE_POLL_SETUP
 	select GENERIC_IOREMAP
-	select GENERIC_IRQ_ENTRY
 	select GENERIC_IRQ_IPI
 	select GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD
 	select GENERIC_IRQ_PROBE
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index d2779d604c7be2..f43d4dea916a5b 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -185,6 +185,7 @@ do {									\
 struct linux_binprm;
 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 				       int uses_interp);
+extern bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs);
 
 /* 1GB of VA */
 #ifdef CONFIG_COMPAT
diff --git a/arch/arm64/include/asm/entry-common.h b/arch/arm64/include/asm/entry-common.h
index cab8cd78f69385..d8bf4bf342e80f 100644
--- a/arch/arm64/include/asm/entry-common.h
+++ b/arch/arm64/include/asm/entry-common.h
@@ -3,14 +3,21 @@
 #ifndef _ASM_ARM64_ENTRY_COMMON_H
 #define _ASM_ARM64_ENTRY_COMMON_H
 
+#include <linux/ptrace.h>
 #include <linux/thread_info.h>
 
+#include <asm/compat.h>
 #include <asm/cpufeature.h>
 #include <asm/daifflags.h>
 #include <asm/fpsimd.h>
 #include <asm/mte.h>
 #include <asm/stacktrace.h>
 
+enum ptrace_syscall_dir {
+	PTRACE_SYSCALL_ENTER = 0,
+	PTRACE_SYSCALL_EXIT,
+};
+
 #define ARCH_EXIT_TO_USER_MODE_WORK (_TIF_MTE_ASYNC_FAULT | _TIF_FOREIGN_FPSTATE)
 
 static __always_inline void arch_exit_to_user_mode_work(struct pt_regs *regs,
@@ -54,4 +61,73 @@ static inline bool arch_irqentry_exit_need_resched(void)
 
 #define arch_irqentry_exit_need_resched arch_irqentry_exit_need_resched
 
+static __always_inline unsigned long ptrace_save_reg(struct pt_regs *regs,
+						     enum ptrace_syscall_dir dir,
+						     int *regno)
+{
+	unsigned long saved_reg;
+
+	/*
+	 * We have some ABI weirdness here in the way that we handle syscall
+	 * exit stops because we indicate whether or not the stop has been
+	 * signalled from syscall entry or syscall exit by clobbering a general
+	 * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee
+	 * and restoring its old value after the stop. This means that:
+	 *
+	 * - Any writes by the tracer to this register during the stop are
+	 *   ignored/discarded.
+	 *
+	 * - The actual value of the register is not available during the stop,
+	 *   so the tracer cannot save it and restore it later.
+	 *
+	 * - Syscall stops behave differently to seccomp and pseudo-step traps
+	 *   (the latter do not nobble any registers).
+	 */
+	*regno = (is_compat_task() ? 12 : 7);
+	saved_reg = regs->regs[*regno];
+	regs->regs[*regno] = dir;
+
+	return saved_reg;
+}
+
+static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs *regs)
+{
+	unsigned long saved_reg;
+	int regno, ret;
+
+	saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, &regno);
+	ret = ptrace_report_syscall_entry(regs);
+	if (ret)
+		forget_syscall(regs);
+	regs->regs[regno] = saved_reg;
+
+	return ret;
+}
+
+#define arch_ptrace_report_syscall_entry arch_ptrace_report_syscall_entry
+
+static __always_inline void arch_ptrace_report_syscall_exit(struct pt_regs *regs,
+							    int step)
+{
+	unsigned long saved_reg;
+	int regno;
+
+	saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_EXIT, &regno);
+	if (!step) {
+		ptrace_report_syscall_exit(regs, 0);
+		regs->regs[regno] = saved_reg;
+	} else {
+		regs->regs[regno] = saved_reg;
+
+		/*
+		 * Signal a pseudo-step exception since we are stepping but
+		 * tracer modifications to the registers may have rewound the
+		 * state machine.
+		 */
+		ptrace_report_syscall_exit(regs, 1);
+	}
+}
+
+#define arch_ptrace_report_syscall_exit arch_ptrace_report_syscall_exit
+
 #endif /* _ASM_ARM64_ENTRY_COMMON_H */
diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
index 5e4c7fc44f7315..84b1c36233d41e 100644
--- a/arch/arm64/include/asm/syscall.h
+++ b/arch/arm64/include/asm/syscall.h
@@ -8,6 +8,7 @@
 #include <uapi/linux/audit.h>
 #include <linux/compat.h>
 #include <linux/err.h>
+#include <linux/rseq.h>
 
 typedef long (*syscall_fn_t)(const struct pt_regs *regs);
 
@@ -120,7 +121,4 @@ static inline int syscall_get_arch(struct task_struct *task)
 	return AUDIT_ARCH_AARCH64;
 }
 
-int syscall_trace_enter(struct pt_regs *regs);
-void syscall_trace_exit(struct pt_regs *regs);
-
 #endif	/* __ASM_SYSCALL_H */
diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h
index 5d7fe3e153c850..3f621ba0f96137 100644
--- a/arch/arm64/include/asm/thread_info.h
+++ b/arch/arm64/include/asm/thread_info.h
@@ -46,6 +46,7 @@ struct thread_info {
 	u64			mpam_partid_pmg;
 #endif
 	u32			cpu;
+	unsigned long		syscall_work;   /* SYSCALL_WORK_ flags */
 };
 
 #define thread_saved_pc(tsk)	\
@@ -68,11 +69,6 @@ void arch_setup_new_exec(void);
 #define TIF_UPROBE		5	/* uprobe breakpoint or singlestep */
 #define TIF_MTE_ASYNC_FAULT	6	/* MTE Asynchronous Tag Check Fault */
 #define TIF_NOTIFY_SIGNAL	7	/* signal notifications exist */
-#define TIF_SYSCALL_TRACE	8	/* syscall trace active */
-#define TIF_SYSCALL_AUDIT	9	/* syscall auditing */
-#define TIF_SYSCALL_TRACEPOINT	10	/* syscall tracepoint for ftrace */
-#define TIF_SECCOMP		11	/* syscall secure computing */
-#define TIF_SYSCALL_EMU		12	/* syscall emulation active */
 #define TIF_PATCH_PENDING	13	/* pending live patching update */
 #define TIF_MEMDIE		18	/* is terminating due to OOM killer */
 #define TIF_FREEZE		19
@@ -94,24 +90,14 @@ void arch_setup_new_exec(void);
 #define _TIF_NEED_RESCHED_LAZY	(1 << TIF_NEED_RESCHED_LAZY)
 #define _TIF_NOTIFY_RESUME	(1 << TIF_NOTIFY_RESUME)
 #define _TIF_FOREIGN_FPSTATE	(1 << TIF_FOREIGN_FPSTATE)
-#define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)
-#define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)
-#define _TIF_SYSCALL_TRACEPOINT	(1 << TIF_SYSCALL_TRACEPOINT)
-#define _TIF_SECCOMP		(1 << TIF_SECCOMP)
-#define _TIF_SYSCALL_EMU	(1 << TIF_SYSCALL_EMU)
 #define _TIF_PATCH_PENDING	(1 << TIF_PATCH_PENDING)
 #define _TIF_UPROBE		(1 << TIF_UPROBE)
-#define _TIF_SINGLESTEP		(1 << TIF_SINGLESTEP)
 #define _TIF_32BIT		(1 << TIF_32BIT)
 #define _TIF_SVE		(1 << TIF_SVE)
 #define _TIF_MTE_ASYNC_FAULT	(1 << TIF_MTE_ASYNC_FAULT)
 #define _TIF_NOTIFY_SIGNAL	(1 << TIF_NOTIFY_SIGNAL)
 #define _TIF_TSC_SIGSEGV	(1 << TIF_TSC_SIGSEGV)
 
-#define _TIF_SYSCALL_WORK	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
-				 _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | \
-				 _TIF_SYSCALL_EMU)
-
 #ifdef CONFIG_SHADOW_CALL_STACK
 #define INIT_SCS							\
 	.scs_base	= init_shadow_call_stack,			\
diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index 29307642f4c904..c5368383915536 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -385,11 +385,19 @@ void user_enable_single_step(struct task_struct *task)
 
 	if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))
 		set_regs_spsr_ss(task_pt_regs(task));
+
+	/*
+	 * Ensure that the generic entry code triggers a trap once stepping
+	 * out of a system call prior to executing any user instruction,
+	 * as the generic entry code does not natively check for TIF_SINGLESTEP.
+	 */
+	set_task_syscall_work(task, SYSCALL_EXIT_TRAP);
 }
 NOKPROBE_SYMBOL(user_enable_single_step);
 
 void user_disable_single_step(struct task_struct *task)
 {
 	clear_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);
+	clear_task_syscall_work(task, SYSCALL_EXIT_TRAP);
 }
 NOKPROBE_SYMBOL(user_disable_single_step);
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 4d08598e2891d3..61a66868294715 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -8,7 +8,6 @@
  * Copyright (C) 2012 ARM Ltd.
  */
 
-#include <linux/audit.h>
 #include <linux/compat.h>
 #include <linux/kernel.h>
 #include <linux/sched/signal.h>
@@ -18,7 +17,6 @@
 #include <linux/smp.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
-#include <linux/seccomp.h>
 #include <linux/security.h>
 #include <linux/init.h>
 #include <linux/signal.h>
@@ -28,7 +26,6 @@
 #include <linux/hw_breakpoint.h>
 #include <linux/regset.h>
 #include <linux/elf.h>
-#include <linux/rseq.h>
 
 #include <asm/compat.h>
 #include <asm/cpufeature.h>
@@ -38,13 +35,9 @@
 #include <asm/mte.h>
 #include <asm/pointer_auth.h>
 #include <asm/stacktrace.h>
-#include <asm/syscall.h>
 #include <asm/traps.h>
 #include <asm/system_misc.h>
 
-#define CREATE_TRACE_POINTS
-#include <trace/events/syscalls.h>
-
 struct pt_regs_offset {
 	const char *name;
 	int offset;
@@ -2339,114 +2332,6 @@ long arch_ptrace(struct task_struct *child, long request,
 	return ptrace_request(child, request, addr, data);
 }
 
-enum ptrace_syscall_dir {
-	PTRACE_SYSCALL_ENTER = 0,
-	PTRACE_SYSCALL_EXIT,
-};
-
-static __always_inline unsigned long ptrace_save_reg(struct pt_regs *regs,
-						     enum ptrace_syscall_dir dir,
-						     int *regno)
-{
-	unsigned long saved_reg;
-
-	/*
-	 * We have some ABI weirdness here in the way that we handle syscall
-	 * exit stops because we indicate whether or not the stop has been
-	 * signalled from syscall entry or syscall exit by clobbering a general
-	 * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee
-	 * and restoring its old value after the stop. This means that:
-	 *
-	 * - Any writes by the tracer to this register during the stop are
-	 *   ignored/discarded.
-	 *
-	 * - The actual value of the register is not available during the stop,
-	 *   so the tracer cannot save it and restore it later.
-	 *
-	 * - Syscall stops behave differently to seccomp and pseudo-step traps
-	 *   (the latter do not nobble any registers).
-	 */
-	*regno = (is_compat_task() ? 12 : 7);
-	saved_reg = regs->regs[*regno];
-	regs->regs[*regno] = dir;
-
-	return saved_reg;
-}
-
-static int report_syscall_entry(struct pt_regs *regs)
-{
-	unsigned long saved_reg;
-	int regno, ret;
-
-	saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, &regno);
-	ret = ptrace_report_syscall_entry(regs);
-	if (ret)
-		forget_syscall(regs);
-	regs->regs[regno] = saved_reg;
-
-	return ret;
-}
-
-static void report_syscall_exit(struct pt_regs *regs)
-{
-	unsigned long saved_reg;
-	int regno;
-
-	saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_EXIT, &regno);
-	if (!test_thread_flag(TIF_SINGLESTEP)) {
-		ptrace_report_syscall_exit(regs, 0);
-		regs->regs[regno] = saved_reg;
-	} else {
-		regs->regs[regno] = saved_reg;
-
-		/*
-		 * Signal a pseudo-step exception since we are stepping but
-		 * tracer modifications to the registers may have rewound the
-		 * state machine.
-		 */
-		ptrace_report_syscall_exit(regs, 1);
-	}
-}
-
-int syscall_trace_enter(struct pt_regs *regs)
-{
-	unsigned long flags = read_thread_flags();
-	int ret;
-
-	if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
-		ret = report_syscall_entry(regs);
-		if (ret || (flags & _TIF_SYSCALL_EMU))
-			return NO_SYSCALL;
-	}
-
-	/* Do the secure computing after ptrace; failures should be fast. */
-	if (secure_computing() == -1)
-		return NO_SYSCALL;
-
-	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
-		trace_sys_enter(regs, regs->syscallno);
-
-	audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
-			    regs->regs[2], regs->regs[3]);
-
-	return regs->syscallno;
-}
-
-void syscall_trace_exit(struct pt_regs *regs)
-{
-	unsigned long flags = read_thread_flags();
-
-	audit_syscall_exit(regs);
-
-	if (flags & _TIF_SYSCALL_TRACEPOINT)
-		trace_sys_exit(regs, syscall_get_return_value(current, regs));
-
-	if (flags & (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP))
-		report_syscall_exit(regs);
-
-	rseq_syscall(regs);
-}
-
 /*
  * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487D.a.
  * We permit userspace to set SSBS (AArch64 bit 12, AArch32 bit 23) which is
diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
index 38e6fa204c17b5..093eebb9d764ac 100644
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -8,8 +8,8 @@
 
 #include <linux/cache.h>
 #include <linux/compat.h>
+#include <linux/entry-common.h>
 #include <linux/errno.h>
-#include <linux/irq-entry-common.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
 #include <linux/freezer.h>
diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
index 358ddfbf1401ac..e0a98fac3b8567 100644
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -2,6 +2,7 @@
 
 #include <linux/compiler.h>
 #include <linux/context_tracking.h>
+#include <linux/entry-common.h>
 #include <linux/errno.h>
 #include <linux/nospec.h>
 #include <linux/ptrace.h>
@@ -54,15 +55,11 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,
 	syscall_set_return_value(current, regs, 0, ret);
 }
 
-static inline bool has_syscall_work(unsigned long flags)
-{
-	return unlikely(flags & _TIF_SYSCALL_WORK);
-}
-
-static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
-			   const syscall_fn_t syscall_table[])
+static __always_inline void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
+					   const syscall_fn_t syscall_table[])
 {
 	unsigned long flags = read_thread_flags();
+	unsigned long work;
 
 	regs->orig_x0 = regs->regs[0];
 	regs->syscallno = scno;
@@ -95,7 +92,8 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
 		return;
 	}
 
-	if (has_syscall_work(flags)) {
+	work = READ_ONCE(current_thread_info()->syscall_work);
+	if (unlikely(work & SYSCALL_WORK_ENTER)) {
 		/*
 		 * The de-facto standard way to skip a system call using ptrace
 		 * is to set the system call to -1 (NO_SYSCALL) and set x0 to a
@@ -113,26 +111,14 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
 		 */
 		if (scno == NO_SYSCALL)
 			syscall_set_return_value(current, regs, -ENOSYS, 0);
-		scno = syscall_trace_enter(regs);
+		scno = syscall_trace_enter(regs, work);
 		if (scno == NO_SYSCALL)
 			goto trace_exit;
 	}
 
 	invoke_syscall(regs, scno, sc_nr, syscall_table);
-
-	/*
-	 * The tracing status may have changed under our feet, so we have to
-	 * check again. However, if we were tracing entry, then we always trace
-	 * exit regardless, as the old entry assembly did.
-	 */
-	if (!has_syscall_work(flags) && !IS_ENABLED(CONFIG_DEBUG_RSEQ)) {
-		flags = read_thread_flags();
-		if (!has_syscall_work(flags) && !(flags & _TIF_SINGLESTEP))
-			return;
-	}
-
 trace_exit:
-	syscall_trace_exit(regs);
+	syscall_exit_to_user_mode_work(regs);
 }
 
 void do_el0_svc(struct pt_regs *regs)
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 592dd8668de463..5a0314a3c26e82 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -343,3 +343,19 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
 
 	return ret;
 }
+
+bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)
+{
+	unsigned long sigtramp;
+
+#ifdef CONFIG_COMPAT
+	if (is_compat_task()) {
+		unsigned long sigpage = (unsigned long)current->mm->context.sigpage;
+
+		return regs->pc >= sigpage && regs->pc < (sigpage + PAGE_SIZE);
+	}
+#endif
+	sigtramp = (unsigned long)VDSO_SYMBOL(current->mm->context.vdso, sigtramp);
+
+	return regs->pc == (sigtramp + 8);
+}
diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c
index 6bb685a2646b56..11c5eff41e9d6a 100644
--- a/arch/csky/kernel/ptrace.c
+++ b/arch/csky/kernel/ptrace.c
@@ -323,7 +323,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 		if (ptrace_report_syscall_entry(regs))
 			return -1;
 
-	if (secure_computing() == -1)
+	if (!secure_computing())
 		return -1;
 
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
diff --git a/arch/loongarch/include/asm/syscall.h b/arch/loongarch/include/asm/syscall.h
index df8ea223c77b1a..946886794cedf0 100644
--- a/arch/loongarch/include/asm/syscall.h
+++ b/arch/loongarch/include/asm/syscall.h
@@ -85,9 +85,4 @@ static inline int syscall_get_arch(struct task_struct *task)
 #endif
 }
 
-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)
-{
-	return false;
-}
-
 #endif	/* __ASM_LOONGARCH_SYSCALL_H */
diff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c
index cfa2df24eced12..d2411404b9dfcf 100644
--- a/arch/m68k/kernel/ptrace.c
+++ b/arch/m68k/kernel/ptrace.c
@@ -281,7 +281,7 @@ asmlinkage int syscall_trace_enter(void)
 	if (test_thread_flag(TIF_SYSCALL_TRACE))
 		ret = ptrace_report_syscall_entry(task_pt_regs(current));
 
-	if (secure_computing() == -1)
+	if (!secure_computing())
 		return -1;
 
 	return ret;
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 3f4c94c8812417..0d809cda754292 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -1328,7 +1328,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 			return -1;
 	}
 
-	if (secure_computing())
+	if (!secure_computing())
 		return -1;
 
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 8a17ab7e6e0b93..565b51a48c8a87 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -351,7 +351,7 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 	}
 
 	/* Do the secure computing check after ptrace. */
-	if (secure_computing() == -1)
+	if (!secure_computing())
 		return -1;
 
 #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h
index 834fcc4f7b543b..4b3c52ed6e9d2b 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -139,9 +139,4 @@ static inline int syscall_get_arch(struct task_struct *task)
 	else
 		return AUDIT_ARCH_PPC64;
 }
-
-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)
-{
-	return false;
-}
 #endif	/* _ASM_SYSCALL_H */
diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h
index 8067e666a4ca68..987c9a78806f78 100644
--- a/arch/riscv/include/asm/syscall.h
+++ b/arch/riscv/include/asm/syscall.h
@@ -112,11 +112,6 @@ static inline void syscall_handler(struct pt_regs *regs, ulong syscall)
 	regs->a0 = fn(regs);
 }
 
-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)
-{
-	return false;
-}
-
 asmlinkage long sys_riscv_flush_icache(uintptr_t, uintptr_t, uintptr_t);
 
 asmlinkage long sys_riscv_hwprobe(struct riscv_hwprobe *, size_t, size_t,
diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
index 4271e4169f45b6..5f310caad1fcec 100644
--- a/arch/s390/include/asm/syscall.h
+++ b/arch/s390/include/asm/syscall.h
@@ -89,11 +89,6 @@ static inline int syscall_get_arch(struct task_struct *task)
 	return AUDIT_ARCH_S390X;
 }
 
-static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)
-{
-	return false;
-}
-
 #define SYSCALL_FMT_0
 #define SYSCALL_FMT_1 , "0" (r2)
 #define SYSCALL_FMT_2 , "d" (r3) SYSCALL_FMT_1
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 06f765d71a2951..8687f17cbe5adc 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -460,7 +460,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		return -1;
 	}
 
-	if (secure_computing() == -1)
+	if (!secure_computing())
 		return -1;
 
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
diff --git a/arch/um/kernel/skas/syscall.c b/arch/um/kernel/skas/syscall.c
index ba7494f9bfe412..916cd7acceafdf 100644
--- a/arch/um/kernel/skas/syscall.c
+++ b/arch/um/kernel/skas/syscall.c
@@ -27,7 +27,7 @@ void handle_syscall(struct uml_pt_regs *r)
 		goto out;
 
 	/* Do the seccomp check after ptrace; failures should be fast. */
-	if (secure_computing() == -1)
+	if (!secure_computing())
 		goto out;
 
 	syscall = UPT_SYSCALL_NR(r);
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index ea36de9fa8641d..6aed3987b9f966 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -198,7 +198,7 @@ static bool __emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 	regs->orig_ax = syscall_nr;
 	regs->ax = -ENOSYS;
 	tmp = secure_computing();
-	if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
+	if ((tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
 		warn_bad_vsyscall(KERN_DEBUG, regs,
 				  "seccomp tried to change syscall nr or ip");
 		force_exit_sig(SIGSYS);
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index b80d54b2ea34e6..ef78fcd318ffcc 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -553,8 +553,7 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 		return 0;
 	}
 
-	if (regs->syscall == NO_SYSCALL ||
-	    secure_computing() == -1) {
+	if (regs->syscall == NO_SYSCALL || !secure_computing()) {
 		do_syscall_trace_leave(regs);
 		return 0;
 	}
diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h
index 416a3352261fe8..3f66320e46d331 100644
--- a/include/linux/entry-common.h
+++ b/include/linux/entry-common.h
@@ -100,9 +100,8 @@ static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned l
 
 	/* Do seccomp after ptrace, to catch any tracer changes. */
 	if (work & SYSCALL_WORK_SECCOMP) {
-		ret = __secure_computing();
-		if (ret == -1L)
-			return ret;
+		if (!__secure_computing())
+			return -1L;
 	}
 
 	/* Either of the above might have changed the syscall number */
@@ -113,7 +112,7 @@ static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned l
 
 	syscall_enter_audit(regs, syscall);
 
-	return ret ? : syscall;
+	return syscall;
 }
 
 /**
diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index 9b959972bf4a22..7af3173f40e985 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h
@@ -22,14 +22,14 @@
 #include <linux/atomic.h>
 #include <asm/seccomp.h>
 
-extern int __secure_computing(void);
+extern bool __secure_computing(void);
 
 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
-static inline int secure_computing(void)
+static inline bool secure_computing(void)
 {
 	if (unlikely(test_syscall_work(SECCOMP)))
 		return  __secure_computing();
-	return 0;
+	return true;
 }
 #else
 extern void secure_computing_strict(int this_syscall);
@@ -50,11 +50,11 @@ static inline int seccomp_mode(struct seccomp *s)
 struct seccomp_data;
 
 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
-static inline int secure_computing(void) { return 0; }
+static inline bool secure_computing(void) { return true; }
 #else
 static inline void secure_computing_strict(int this_syscall) { return; }
 #endif
-static inline int __secure_computing(void) { return 0; }
+static inline bool __secure_computing(void) { return true; }
 
 static inline long prctl_get_seccomp(void)
 {
diff --git a/include/linux/syscall_user_dispatch.h b/include/linux/syscall_user_dispatch.h
index 3858a6ffdd5c84..73d69e02807d85 100644
--- a/include/linux/syscall_user_dispatch.h
+++ b/include/linux/syscall_user_dispatch.h
@@ -10,6 +10,7 @@
 
 #ifdef CONFIG_GENERIC_ENTRY
 
+bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs);
 int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,
 			      unsigned long len, char __user *selector);
 
diff --git a/kernel/entry/syscall_user_dispatch.c b/kernel/entry/syscall_user_dispatch.c
index d89dffcc2d6429..acf545774d3720 100644
--- a/kernel/entry/syscall_user_dispatch.c
+++ b/kernel/entry/syscall_user_dispatch.c
@@ -32,6 +32,11 @@ static void trigger_sigsys(struct pt_regs *regs)
 	force_sig_info(&info);
 }
 
+bool __weak arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)
+{
+	return false;
+}
+
 bool syscall_user_dispatch(struct pt_regs *regs)
 {
 	struct syscall_user_dispatch *sd = &current->syscall_dispatch;
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 066909393c38f5..1fec6efedab627 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1100,12 +1100,12 @@ void secure_computing_strict(int this_syscall)
 	else
 		BUG();
 }
-int __secure_computing(void)
+bool __secure_computing(void)
 {
 	int this_syscall = syscall_get_nr(current, current_pt_regs());
 
 	secure_computing_strict(this_syscall);
-	return 0;
+	return true;
 }
 #else
 
@@ -1256,7 +1256,7 @@ static int seccomp_do_user_notification(int this_syscall,
 	return -1;
 }
 
-static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
+static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)
 {
 	u32 filter_ret, action;
 	struct seccomp_data sd;
@@ -1294,7 +1294,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
 	case SECCOMP_RET_TRACE:
 		/* We've been put in this state by the ptracer already. */
 		if (recheck_after_trace)
-			return 0;
+			return true;
 
 		/* ENOSYS these calls if there is no tracer attached. */
 		if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
@@ -1330,19 +1330,19 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
 		 * a skip would have already been reported.
 		 */
 		if (__seccomp_filter(this_syscall, true))
-			return -1;
+			return false;
 
-		return 0;
+		return true;
 
 	case SECCOMP_RET_USER_NOTIF:
 		if (seccomp_do_user_notification(this_syscall, match, &sd))
 			goto skip;
 
-		return 0;
+		return true;
 
 	case SECCOMP_RET_LOG:
 		seccomp_log(this_syscall, 0, action, true);
-		return 0;
+		return true;
 
 	case SECCOMP_RET_ALLOW:
 		/*
@@ -1350,7 +1350,7 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
 		 * this action since SECCOMP_RET_ALLOW is the starting
 		 * state in seccomp_run_filters().
 		 */
-		return 0;
+		return true;
 
 	case SECCOMP_RET_KILL_THREAD:
 	case SECCOMP_RET_KILL_PROCESS:
@@ -1367,46 +1367,46 @@ static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
 		} else {
 			do_exit(SIGSYS);
 		}
-		return -1; /* skip the syscall go directly to signal handling */
+		return false; /* skip the syscall go directly to signal handling */
 	}
 
 	unreachable();
 
 skip:
 	seccomp_log(this_syscall, 0, action, match ? match->log : false);
-	return -1;
+	return false;
 }
 #else
-static int __seccomp_filter(int this_syscall, const bool recheck_after_trace)
+static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)
 {
 	BUG();
 
-	return -1;
+	return false;
 }
 #endif
 
-int __secure_computing(void)
+bool __secure_computing(void)
 {
 	int mode = current->seccomp.mode;
 	int this_syscall;
 
 	if (IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) &&
 	    unlikely(current->ptrace & PT_SUSPEND_SECCOMP))
-		return 0;
+		return true;
 
 	this_syscall = syscall_get_nr(current, current_pt_regs());
 
 	switch (mode) {
 	case SECCOMP_MODE_STRICT:
 		__secure_computing_strict(this_syscall);  /* may call do_exit */
-		return 0;
+		return true;
 	case SECCOMP_MODE_FILTER:
 		return __seccomp_filter(this_syscall, false);
 	/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
 	case SECCOMP_MODE_DEAD:
 		WARN_ON_ONCE(1);
 		do_exit(SIGKILL);
-		return -1;
+		return false;
 	default:
 		BUG();
 	}

gemini-3.1-pro-preview

							input: 13412
							output: 37
							thoughts: 601

**Analyzing a Significant Arm64 Syscall Entry Architectural Shift**

Okay, so I'm looking at this patch and it's making some big changes to how `secure_computing()` handles syscalls and tracing on arm64. First off, it looks like `secure_computing()` is now returning a `bool` instead of an `int`. A `true` means the syscall should proceed, `false` means it gets skipped. Interesting, the old way used `0` for success and `-1` for skip. Seems cleaner, more semantic.

My immediate thought is the changes to `arch/arm64/kernel/syscall.c` and `arch/arm64/Kconfig` are the key here, it looks like arm64 is moving over to the `GENERIC_ENTRY` code. And yup, the `Kconfig` confirms it selects `GENERIC_ENTRY`. The `syscall.c` file is now using `syscall_trace_enter(regs, work)` and `syscall_exit_to_user_mode_work(regs)`. This is a big architectural shift for arm64, moving to this generic entry point.

Okay, let's dig deeper. The patch also removes `syscall_trace_enter` and `syscall_trace_exit` from `arch/arm64/kernel/ptrace.c`, and a bunch of `TIF_SYSCALL_TRACE` flags from `arch/arm64/include/asm/thread_info.h` are gone, replaced with `syscall_work`. `arch/arm64/kernel/debug-monitors.c` is setting `SYSCALL_EXIT_TRAP`. And, `arch/arm64/kernel/signal.c` now includes `<linux/entry-common.h>`. Plus, `arch/arm64/kernel/vdso.c` adds `arch_syscall_is_vdso_sigreturn`.

This is *definitely* a functional change. The migration to generic entry code for syscalls on arm64 is substantial. The whole syscall path is being rewritten.

Worth fuzzing? Absolutely. This is touching the very core of syscall entry and exit for arm64. This warrants thorough testing.

Now, which functions are critical to focus on for fuzzing? From a quick glance, I'd say `el0_svc_common` in `arch/arm64/kernel/syscall.c` is front and center. I’ll also look at `arch_syscall_is_vdso_sigreturn` in `arch/arm64/kernel/vdso.c` since the vDSO is always a sensitive area. And anything related to ptrace, namely `ptrace_save_reg`, `arch_ptrace_report_syscall_entry` and `arch_ptrace_report_syscall_exit` in `arch/arm64/include/asm/entry-common.h` is critical. These will need a close look at `arch/arm64/kernel/syscall.c`.

{
  "Expression": "el0_svc_common",
  "PathPrefix": "arch/arm64/kernel/syscall.c"
}

{
  "Output": "arch/arm64/kernel/syscall.c=39=static void invoke_syscall(struct pt_regs *regs, unsigned int scno,\n--\narch/arm64/kernel/syscall.c-57-\narch/arm64/kernel/syscall.c:58:static __always_inline void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,\narch/arm64/kernel/syscall.c-59-\t\t\t\t\t   const syscall_fn_t syscall_table[])\n--\narch/arm64/kernel/syscall.c=124=void do_el0_svc(struct pt_regs *regs)\narch/arm64/kernel/syscall.c-125-{\narch/arm64/kernel/syscall.c:126:\tel0_svc_common(regs, regs-\u003eregs[8], __NR_syscalls, sys_call_table);\narch/arm64/kernel/syscall.c-127-}\n--\narch/arm64/kernel/syscall.c=130=void do_el0_svc_compat(struct pt_regs *regs)\narch/arm64/kernel/syscall.c-131-{\narch/arm64/kernel/syscall.c:132:\tel0_svc_common(regs, regs-\u003eregs[7], __NR_compat32_syscalls,\narch/arm64/kernel/syscall.c-133-\t\t       compat_sys_call_table);\n"
}

gemini-3.1-pro-preview

							input: 15084
							output: 37
							thoughts: 192

**Analyzing the ARM64 System Call Entry Point**

Okay, so I'm trying to trace the system call path on ARM64. Since `el0_svc_common` is `__always_inline`, I'm going to bypass that and focus directly on the functions it calls: `do_el0_svc` and `do_el0_svc_compat`. Those are the prime suspects, along with `arch_syscall_is_vdso_sigreturn` in `arch/arm64/kernel/vdso.c`, since that's another area where syscalls would be handled.

Initially, I also considered `syscall_trace_enter` in `include/linux/entry-common.h`. However, it looks like that's also an `__always_inline` function. The generic entry functions are `syscall_enter_from_user_mode`, and `syscall_exit_to_user_mode`.

Given that I'm specifically looking at the ARM64 architecture, I think the generic ones are not what I need to focus on. I need to see what those inlines expand to. So, back to `do_el0_svc` and `do_el0_svc_compat`.

Right, let's head over to `arch/arm64/kernel/syscall.c` and see what we can find. That should be the place to find the implementations for `do_el0_svc` and `do_el0_svc_compat`.

{
  "Expression": "do_el0_svc",
  "PathPrefix": "arch/arm64/kernel/syscall.c"
}

{
  "Output": "arch/arm64/kernel/syscall.c=58=static __always_inline void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,\n--\narch/arm64/kernel/syscall.c-123-\narch/arm64/kernel/syscall.c:124:void do_el0_svc(struct pt_regs *regs)\narch/arm64/kernel/syscall.c-125-{\n--\narch/arm64/kernel/syscall.c-129-#ifdef CONFIG_COMPAT\narch/arm64/kernel/syscall.c:130:void do_el0_svc_compat(struct pt_regs *regs)\narch/arm64/kernel/syscall.c-131-{\n"
}

gemini-3.1-pro-preview

							input: 15836
							output: 43
							thoughts: 32

Here's a summary of my thought process:

**Diving into the ARM64 VDSO for Sigreturn Verification**

Okay, so I need to understand how the architecture handles `sigreturn` calls, specifically in the context of the VDSO on ARM64. My first instinct, as always, is to go directly to the source code. Let's see... I'm thinking I should start by looking into `arch/arm64/kernel/vdso.c`. That's the likely location for code related to the Virtual Dynamic Shared Object and the kernel's interaction with user-space for syscalls and related functionality. Specifically, I'm zeroing in on a function or macro named `arch_syscall_is_vdso_sigreturn`. This name suggests it's the key to figuring out how the kernel determines if a syscall is a VDSO-provided `sigreturn` rather than a standard one. This is crucial for security and performance optimization, making sure the right context is restored. I'm hoping to understand how it's implemented and what assumptions it makes about the VDSO setup.

{
  "Expression": "arch_syscall_is_vdso_sigreturn",
  "PathPrefix": "arch/arm64/kernel/vdso.c"
}

{
  "Output": "arch/arm64/kernel/vdso.c=333=int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)\n--\narch/arm64/kernel/vdso.c-346-\narch/arm64/kernel/vdso.c:347:bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\narch/arm64/kernel/vdso.c-348-{\n"
}

gemini-3.1-pro-preview

							input: 16277
							output: 41
							thoughts: 40

Here's my take on the thought process:

**Diving into the Arm64 Single-Stepping Implementation**

Okay, so I need to understand how user-mode single-stepping is enabled and disabled on Arm64. My first instinct, given my experience, is to head directly into the kernel source. Specifically, I'm thinking the relevant code will be within the architecture-specific directory. I'm going to look for the implementation that deals with the debug monitors, as that's where this functionality is likely handled. So, let's start by checking out `arch/arm64/kernel/debug-monitors.c`. The key functions I'm expecting to find are probably named something like `user_enable_single_step` and `user_disable_single_step`. That's where I'll start digging to understand the mechanics of how the kernel manages this feature. Let's see what's in there.

{
  "Expression": "user_enable_single_step",
  "PathPrefix": "arch/arm64/kernel/debug-monitors.c"
}

{
  "Output": "arch/arm64/kernel/debug-monitors.c=376=void kernel_fastforward_single_step(struct pt_regs *regs)\n--\narch/arm64/kernel/debug-monitors.c-381-/* ptrace API */\narch/arm64/kernel/debug-monitors.c:382:void user_enable_single_step(struct task_struct *task)\narch/arm64/kernel/debug-monitors.c-383-{\n--\narch/arm64/kernel/debug-monitors.c-395-}\narch/arm64/kernel/debug-monitors.c:396:NOKPROBE_SYMBOL(user_enable_single_step);\narch/arm64/kernel/debug-monitors.c-397-\n"
}

gemini-3.1-pro-preview

							input: 16768
							output: 31
							thoughts: 29

Okay, here's my take on those thoughts, tailored for an expert audience:

**Diving into seccomp.c**

Alright, time to dig in. My initial thought process is leading me straight to `kernel/seccomp.c`. I need to refresh my understanding, so I'm honing in on the key pieces: `__secure_computing` and `__seccomp_filter`. I'm especially interested in how those interact. I'm probably looking at the core machinery here, seeing how the kernel actually *does* secure computing. I expect to be looking for where the checks are enforced, where the filters are installed, and how the syscall interface is modified, if at all. It's a fundamental part of the security posture, so I want to be certain I have a solid grip on the specifics. I'm going to start by getting a handle on the data structures.

{
  "Expression": "__secure_computing",
  "PathPrefix": "kernel/seccomp.c"
}

{
  "Output": "kernel/seccomp.c=1056=static const int mode1_syscalls[] = {\n--\nkernel/seccomp.c-1066-\nkernel/seccomp.c:1067:static void __secure_computing_strict(int this_syscall)\nkernel/seccomp.c-1068-{\n--\nkernel/seccomp.c=1088=void secure_computing_strict(int this_syscall)\n--\nkernel/seccomp.c-1098-\telse if (mode == SECCOMP_MODE_STRICT)\nkernel/seccomp.c:1099:\t\t__secure_computing_strict(this_syscall);\nkernel/seccomp.c-1100-\telse\n--\nkernel/seccomp.c-1102-}\nkernel/seccomp.c:1103:bool __secure_computing(void)\nkernel/seccomp.c-1104-{\n--\nkernel/seccomp.c=1380=static bool __seccomp_filter(int this_syscall, const bool recheck_after_trace)\n--\nkernel/seccomp.c-1387-\nkernel/seccomp.c:1388:bool __secure_computing(void)\nkernel/seccomp.c-1389-{\n--\nkernel/seccomp.c-1400-\tcase SECCOMP_MODE_STRICT:\nkernel/seccomp.c:1401:\t\t__secure_computing_strict(this_syscall);  /* may call do_exit */\nkernel/seccomp.c-1402-\t\treturn true;\n"
}

gemini-3.1-pro-preview

							input: 17435
							output: 36
							thoughts: 25

Here's a first-person summary, tailored for an expert audience, as requested:

**Digging into the Syscall Dispatch**

Okay, time to get to the heart of the matter. Let's start by looking at `kernel/entry/syscall_user_dispatch.c`. I need to understand exactly how the system call `syscall_user_dispatch` works. I know it's a critical point for user-space interaction and I need to confirm my understanding of the execution path, data flow, and any potential vulnerabilities. I want to see precisely where the kernel intercepts a system call from user space and how the right handler is selected and called. I'm especially interested in the register passing, privilege level checks, and any context switching that occurs at that point. It's time to refresh my memory on the intricacies there, and ensure I'm up to speed on the latest implementation.

{
  "Expression": "syscall_user_dispatch",
  "PathPrefix": "kernel/entry/syscall_user_dispatch.c"
}

{
  "Output": "kernel/entry/syscall_user_dispatch.c-9-#include \u003clinux/ptrace.h\u003e\nkernel/entry/syscall_user_dispatch.c:10:#include \u003clinux/syscall_user_dispatch.h\u003e\nkernel/entry/syscall_user_dispatch.c-11-#include \u003clinux/uaccess.h\u003e\n--\nkernel/entry/syscall_user_dispatch.c=35=bool __weak arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\n--\nkernel/entry/syscall_user_dispatch.c-39-\nkernel/entry/syscall_user_dispatch.c:40:bool syscall_user_dispatch(struct pt_regs *regs)\nkernel/entry/syscall_user_dispatch.c-41-{\nkernel/entry/syscall_user_dispatch.c:42:\tstruct syscall_user_dispatch *sd = \u0026current-\u003esyscall_dispatch;\nkernel/entry/syscall_user_dispatch.c-43-\tchar state;\n--\nkernel/entry/syscall_user_dispatch.c-76-\nkernel/entry/syscall_user_dispatch.c:77:static int task_set_syscall_user_dispatch(struct task_struct *task, unsigned long mode,\nkernel/entry/syscall_user_dispatch.c-78-\t\t\t\t\t  unsigned long offset, unsigned long len,\n--\nkernel/entry/syscall_user_dispatch.c-99-\t\t/*\nkernel/entry/syscall_user_dispatch.c:100:\t\t * Invert the range, the check in syscall_user_dispatch()\nkernel/entry/syscall_user_dispatch.c-101-\t\t * supports wrap-around.\n--\nkernel/entry/syscall_user_dispatch.c-135-\nkernel/entry/syscall_user_dispatch.c:136:int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,\nkernel/entry/syscall_user_dispatch.c-137-\t\t\t      unsigned long len, char __user *selector)\nkernel/entry/syscall_user_dispatch.c-138-{\nkernel/entry/syscall_user_dispatch.c:139:\treturn task_set_syscall_user_dispatch(current, mode, offset, len, selector);\nkernel/entry/syscall_user_dispatch.c-140-}\nkernel/entry/syscall_user_dispatch.c-141-\nkernel/entry/syscall_user_dispatch.c:142:int syscall_user_dispatch_get_config(struct task_struct *task, unsigned long size,\nkernel/entry/syscall_user_dispatch.c-143-\t\t\t\t     void __user *data)\nkernel/entry/syscall_user_dispatch.c-144-{\nkernel/entry/syscall_user_dispatch.c:145:\tstruct syscall_user_dispatch *sd = \u0026task-\u003esyscall_dispatch;\nkernel/entry/syscall_user_dispatch.c-146-\tstruct ptrace_sud_config cfg;\n--\nkernel/entry/syscall_user_dispatch.c-165-\nkernel/entry/syscall_user_dispatch.c:166:int syscall_user_dispatch_set_config(struct task_struct *task, unsigned long size,\nkernel/entry/syscall_user_dispatch.c-167-\t\t\t\t     void __user *data)\n--\nkernel/entry/syscall_user_dispatch.c-176-\nkernel/entry/syscall_user_dispatch.c:177:\treturn task_set_syscall_user_dispatch(task, cfg.mode, cfg.offset, cfg.len,\nkernel/entry/syscall_user_dispatch.c-178-\t\t\t\t\t      (char __user *)(uintptr_t)cfg.selector);\n"
}

gemini-3.1-pro-preview

							input: 18582
							output: 34
							thoughts: 39

Okay, here's my interpretation of those thoughts, tailored for an expert audience:

**Analyzing the System Call Trace Entry Point Modification**

Right, so this patch is zeroing in on `syscall_trace_enter`, specifically in `include/linux/entry-common.h`. That immediately piques my interest. Any modification to this area is going to have a potentially significant impact on tracing, debugging, and potentially even performance, given the frequency with which it's likely called. Before diving deep into the specifics of the patch itself, I need to get a mental map of what's already there. Let's see... I'm going to pull up `include/linux/entry-common.h` in my head and mentally walk through it. I want to quickly recall the usual prologue structure, the register saving/restoration conventions, and any potential instrumentation points that might be in or around `syscall_trace_enter`. I need to assess the context of this function. I'm thinking about whether this is a direct entry point, or if there is another layer of abstraction or wrapper function, that the patch modifies. Understanding the surrounding code will be critical to fully grasp the patch's purpose and any potential side effects.

{
  "Expression": "syscall_trace_enter",
  "PathPrefix": "include/linux/entry-common.h"
}

{
  "Output": "include/linux/entry-common.h-42- *\ninclude/linux/entry-common.h:43: * Invoked from syscall_trace_enter() to wrap ptrace_report_syscall_entry().\ninclude/linux/entry-common.h-44- *\n--\ninclude/linux/entry-common.h=62=static inline void syscall_enter_audit(struct pt_regs *regs, long syscall)\n--\ninclude/linux/entry-common.h-71-\ninclude/linux/entry-common.h:72:static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned long work)\ninclude/linux/entry-common.h-73-{\n--\ninclude/linux/entry-common.h=141=static __always_inline long syscall_enter_from_user_mode_work(struct pt_regs *regs, long syscall)\n--\ninclude/linux/entry-common.h-145-\tif (work \u0026 SYSCALL_WORK_ENTER)\ninclude/linux/entry-common.h:146:\t\tsyscall = syscall_trace_enter(regs, work);\ninclude/linux/entry-common.h-147-\n--\ninclude/linux/entry-common.h=223=static __always_inline void syscall_exit_work(struct pt_regs *regs, unsigned long work)\n--\ninclude/linux/entry-common.h-229-\t * then the tracers below are not invoked for the same reason as\ninclude/linux/entry-common.h:230:\t * the entry side was not invoked in syscall_trace_enter(): The ABI\ninclude/linux/entry-common.h-231-\t * of these syscalls is unknown.\n"
}

gemini-3.1-pro-preview

							input: 19334
							output: 23
							thoughts: 381

**Analyzing the `syscall_trace_enter` Patch**

Okay, so this patch is modifying `syscall_trace_enter` within `include/linux/entry-common.h`. I see that the code now directly checks the return value of `__secure_computing()`. Previously, the return value was stored in `ret`, which could indicate an error. Now, the logic is simplified: if `__secure_computing()` returns `false`, it immediately returns `-1L`. Makes sense. The intent is to catch tracer changes, which were possibly a pre-existing issue.

I see that this change is generic, not architecture-specific. Interesting. Given that fact, I need to understand which architectures are affected. I notice that the `arch/arm64/Kconfig` file selects `GENERIC_ENTRY`. This tells me that ARM64 is now using this generic code, which is good. That likely explains why the change is generic.

Now, I need to determine if any specific configurations are needed. It appears that `GENERIC_ENTRY` is selected through the ARM64 architecture, so I'm not overly concerned there. I need to make sure the build environment is set up. To test the `__secure_computing()` functionality, I'll need `SECCOMP`. I'll also need `SYSCALL_USER_DISPATCH` for `syscall_user_dispatch` and `arch_syscall_is_vdso_sigreturn` testing. I'll need to check the relevant `Kconfig` files to confirm that `SECCOMP` and `SYSCALL_USER_DISPATCH` are appropriately configured.

{
  "Expression": "config SECCOMP",
  "PathPrefix": ""
}

{
  "Output": "arch/Kconfig=628=config HAVE_ARCH_SECCOMP_FILTER\n--\narch/Kconfig-646-\narch/Kconfig:647:config SECCOMP\narch/Kconfig-648-\tprompt \"Enable seccomp to safely execute untrusted bytecode\"\n--\narch/Kconfig-663-\narch/Kconfig:664:config SECCOMP_FILTER\narch/Kconfig-665-\tdef_bool y\n--\narch/Kconfig-673-\narch/Kconfig:674:config SECCOMP_CACHE_DEBUG\narch/Kconfig-675-\tbool \"Show seccomp filter cache status in /proc/pid/seccomp_cache\"\n"
}

gemini-3.1-pro-preview

							input: 20266
							output: 29
							thoughts: 14

Okay, let's dive into this. Here's my take on those thoughts, as if they're my own:

**Investigating the System Call Dispatch**

Alright, time to get to the heart of the matter. My first instinct is to zero in on `SYSCALL_USER_DISPATCH`. That's where the rubber meets the road, isn't it? The core of the system call mechanism, where the user-space requests are finally sorted and directed to the appropriate kernel handlers. I need to understand exactly how this dispatch is being handled – how the system call number gets translated into the correct kernel function. Is there any potential bottleneck or misdirection I should be aware of? This is the starting point for understanding how this system actually works. Gotta check how this mechanism works. I'm going to look through the documentation to check how this function works. It seems like a lot to do, but that is the only place to start.

{
  "Expression": "config SYSCALL_USER_DISPATCH",
  "PathPrefix": ""
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 20522
							output: 28
							thoughts: 28

Here's my thought process, as if I were considering this myself:

**Kconfig Location Hunt for SYSCALL_USER_DISPATCH**

Okay, so I'm trying to track down where `SYSCALL_USER_DISPATCH` is defined within the kernel's build configuration. My initial hunch is that it's likely going to be in either `init/Kconfig` or `kernel/Kconfig`. These are the classic places where you'd find core kernel features and their associated build options defined. I'll need to check those files closely to verify. I'll start with a quick grep or find in those directories and see what turns up.

{
  "Expression": "SYSCALL_USER_DISPATCH",
  "PathPrefix": ""
}

{
  "Output": "Documentation/admin-guide/syscall-user-dispatch.rst=52=following prctl:\nDocumentation/admin-guide/syscall-user-dispatch.rst-53-\nDocumentation/admin-guide/syscall-user-dispatch.rst:54:  prctl(PR_SET_SYSCALL_USER_DISPATCH, \u003cop\u003e, \u003coffset\u003e, \u003clength\u003e, [selector])\nDocumentation/admin-guide/syscall-user-dispatch.rst-55-\n--\nDocumentation/admin-guide/syscall-user-dispatch.rst=81=Additionally, a tasks syscall user dispatch configuration can be peeked\nDocumentation/admin-guide/syscall-user-dispatch.rst:82:and poked via the PTRACE_(GET|SET)_SYSCALL_USER_DISPATCH_CONFIG ptrace\nDocumentation/admin-guide/syscall-user-dispatch.rst-83-requests. This is useful for checkpoint/restart software.\n--\ninclude/linux/entry-common.h-27-\t\t\t\t SYSCALL_WORK_SYSCALL_AUDIT |\t\t\\\ninclude/linux/entry-common.h:28:\t\t\t\t SYSCALL_WORK_SYSCALL_USER_DISPATCH |\t\\\ninclude/linux/entry-common.h-29-\t\t\t\t SYSCALL_WORK_SYSCALL_RSEQ_SLICE)\n--\ninclude/linux/entry-common.h-35-\t\t\t\t SYSCALL_WORK_SYSCALL_AUDIT |\t\t\\\ninclude/linux/entry-common.h:36:\t\t\t\t SYSCALL_WORK_SYSCALL_USER_DISPATCH |\t\\\ninclude/linux/entry-common.h-37-\t\t\t\t SYSCALL_WORK_SYSCALL_EXIT_TRAP)\n--\ninclude/linux/entry-common.h=72=static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned long work)\n--\ninclude/linux/entry-common.h-80-\t */\ninclude/linux/entry-common.h:81:\tif (work \u0026 SYSCALL_WORK_SYSCALL_USER_DISPATCH) {\ninclude/linux/entry-common.h-82-\t\tif (syscall_user_dispatch(regs))\n--\ninclude/linux/entry-common.h=223=static __always_inline void syscall_exit_work(struct pt_regs *regs, unsigned long work)\n--\ninclude/linux/entry-common.h-232-\t */\ninclude/linux/entry-common.h:233:\tif (work \u0026 SYSCALL_WORK_SYSCALL_USER_DISPATCH) {\ninclude/linux/entry-common.h-234-\t\tif (unlikely(current-\u003esyscall_dispatch.on_dispatch)) {\n--\ninclude/linux/syscall_user_dispatch.h-4- */\ninclude/linux/syscall_user_dispatch.h:5:#ifndef _SYSCALL_USER_DISPATCH_H\ninclude/linux/syscall_user_dispatch.h:6:#define _SYSCALL_USER_DISPATCH_H\ninclude/linux/syscall_user_dispatch.h-7-\n--\ninclude/linux/syscall_user_dispatch.h=14=int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,\n--\ninclude/linux/syscall_user_dispatch.h-17-#define clear_syscall_work_syscall_user_dispatch(tsk) \\\ninclude/linux/syscall_user_dispatch.h:18:\tclear_task_syscall_work(tsk, SYSCALL_USER_DISPATCH)\ninclude/linux/syscall_user_dispatch.h-19-\n--\ninclude/linux/syscall_user_dispatch.h=44=static inline int syscall_user_dispatch_set_config(struct task_struct *task,\n--\ninclude/linux/syscall_user_dispatch.h-51-\ninclude/linux/syscall_user_dispatch.h:52:#endif /* _SYSCALL_USER_DISPATCH_H */\n--\ninclude/linux/syscall_user_dispatch_types.h-1-/* SPDX-License-Identifier: GPL-2.0 */\ninclude/linux/syscall_user_dispatch_types.h:2:#ifndef _SYSCALL_USER_DISPATCH_TYPES_H\ninclude/linux/syscall_user_dispatch_types.h:3:#define _SYSCALL_USER_DISPATCH_TYPES_H\ninclude/linux/syscall_user_dispatch_types.h-4-\n--\ninclude/linux/syscall_user_dispatch_types.h=18=struct syscall_user_dispatch {};\n--\ninclude/linux/syscall_user_dispatch_types.h-21-\ninclude/linux/syscall_user_dispatch_types.h:22:#endif /* _SYSCALL_USER_DISPATCH_TYPES_H */\n--\ninclude/linux/thread_info.h=41=enum syscall_work_bit {\n--\ninclude/linux/thread_info.h-46-\tSYSCALL_WORK_BIT_SYSCALL_AUDIT,\ninclude/linux/thread_info.h:47:\tSYSCALL_WORK_BIT_SYSCALL_USER_DISPATCH,\ninclude/linux/thread_info.h-48-\tSYSCALL_WORK_BIT_SYSCALL_EXIT_TRAP,\n--\ninclude/linux/thread_info.h-56-#define SYSCALL_WORK_SYSCALL_AUDIT\t\tBIT(SYSCALL_WORK_BIT_SYSCALL_AUDIT)\ninclude/linux/thread_info.h:57:#define SYSCALL_WORK_SYSCALL_USER_DISPATCH\tBIT(SYSCALL_WORK_BIT_SYSCALL_USER_DISPATCH)\ninclude/linux/thread_info.h-58-#define SYSCALL_WORK_SYSCALL_EXIT_TRAP\t\tBIT(SYSCALL_WORK_BIT_SYSCALL_EXIT_TRAP)\n--\ninclude/uapi/linux/prctl.h=134=struct prctl_mm_map {\n--\ninclude/uapi/linux/prctl.h-267-/* Dispatch syscalls to a userspace handler */\ninclude/uapi/linux/prctl.h:268:#define PR_SET_SYSCALL_USER_DISPATCH\t59\ninclude/uapi/linux/prctl.h-269-# define PR_SYS_DISPATCH_OFF\t\t0\n--\ninclude/uapi/linux/ptrace.h=110=struct ptrace_rseq_configuration {\n--\ninclude/uapi/linux/ptrace.h-117-\ninclude/uapi/linux/ptrace.h:118:#define PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG 0x4210\ninclude/uapi/linux/ptrace.h:119:#define PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG 0x4211\ninclude/uapi/linux/ptrace.h-120-\n--\nkernel/entry/syscall_user_dispatch.c=77=static int task_set_syscall_user_dispatch(struct task_struct *task, unsigned long mode,\n--\nkernel/entry/syscall_user_dispatch.c-128-\tif (mode != PR_SYS_DISPATCH_OFF)\nkernel/entry/syscall_user_dispatch.c:129:\t\tset_task_syscall_work(task, SYSCALL_USER_DISPATCH);\nkernel/entry/syscall_user_dispatch.c-130-\telse\nkernel/entry/syscall_user_dispatch.c:131:\t\tclear_task_syscall_work(task, SYSCALL_USER_DISPATCH);\nkernel/entry/syscall_user_dispatch.c-132-\n--\nkernel/entry/syscall_user_dispatch.c=142=int syscall_user_dispatch_get_config(struct task_struct *task, unsigned long size,\n--\nkernel/entry/syscall_user_dispatch.c-150-\nkernel/entry/syscall_user_dispatch.c:151:\tif (test_task_syscall_work(task, SYSCALL_USER_DISPATCH))\nkernel/entry/syscall_user_dispatch.c-152-\t\tcfg.mode = PR_SYS_DISPATCH_ON;\n--\nkernel/ptrace.c=1162=int ptrace_request(struct task_struct *child, long request,\n--\nkernel/ptrace.c-1397-\nkernel/ptrace.c:1398:\tcase PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG:\nkernel/ptrace.c-1399-\t\tret = syscall_user_dispatch_set_config(child, addr, datavp);\n--\nkernel/ptrace.c-1401-\nkernel/ptrace.c:1402:\tcase PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG:\nkernel/ptrace.c-1403-\t\tret = syscall_user_dispatch_get_config(child, addr, datavp);\n--\nkernel/sys.c=2534=SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,\n--\nkernel/sys.c-2801-\t\tbreak;\nkernel/sys.c:2802:\tcase PR_SET_SYSCALL_USER_DISPATCH:\nkernel/sys.c-2803-\t\terror = set_syscall_user_dispatch(arg2, arg3, arg4,\n--\ntools/include/uapi/linux/prctl.h=134=struct prctl_mm_map {\n--\ntools/include/uapi/linux/prctl.h-255-/* Dispatch syscalls to a userspace handler */\ntools/include/uapi/linux/prctl.h:256:#define PR_SET_SYSCALL_USER_DISPATCH\t59\ntools/include/uapi/linux/prctl.h-257-# define PR_SYS_DISPATCH_OFF\t\t0\n--\ntools/perf/trace/beauty/include/uapi/linux/prctl.h=134=struct prctl_mm_map {\n--\ntools/perf/trace/beauty/include/uapi/linux/prctl.h-267-/* Dispatch syscalls to a userspace handler */\ntools/perf/trace/beauty/include/uapi/linux/prctl.h:268:#define PR_SET_SYSCALL_USER_DISPATCH\t59\ntools/perf/trace/beauty/include/uapi/linux/prctl.h-269-# define PR_SYS_DISPATCH_OFF\t\t0\n--\ntools/testing/selftests/ptrace/get_set_sud.c=18=TEST(get_set_sud)\n--\ntools/testing/selftests/ptrace/get_set_sud.c-39-\ntools/testing/selftests/ptrace/get_set_sud.c:40:\tret = sys_ptrace(PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG, child,\ntools/testing/selftests/ptrace/get_set_sud.c-41-\t\t\t (void *)sizeof(config), \u0026config);\n--\ntools/testing/selftests/ptrace/get_set_sud.c-53-\ntools/testing/selftests/ptrace/get_set_sud.c:54:\tret = sys_ptrace(PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG, child,\ntools/testing/selftests/ptrace/get_set_sud.c-55-\t\t\t (void *)sizeof(config), \u0026config);\n--\ntools/testing/selftests/ptrace/get_set_sud.c-59-\tmemset(\u0026config, 1, sizeof(config));\ntools/testing/selftests/ptrace/get_set_sud.c:60:\tret = sys_ptrace(PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG, child,\ntools/testing/selftests/ptrace/get_set_sud.c-61-\t\t\t (void *)sizeof(config), \u0026config);\n--\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c-20-\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c:21:#ifndef PR_SET_SYSCALL_USER_DISPATCH\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c:22:# define PR_SET_SYSCALL_USER_DISPATCH\t59\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c-23-# define PR_SYS_DISPATCH_OFF\t0\n--\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c=136=int main(void)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c-162-\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c:163:\tif (prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_ON,\ntools/testing/selftests/syscall_user_dispatch/sud_benchmark.c-164-\t\t  syscall_dispatcher_start,\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-18-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:19:#ifndef PR_SET_SYSCALL_USER_DISPATCH\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:20:# define PR_SET_SYSCALL_USER_DISPATCH\t59\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-21-# define PR_SYS_DISPATCH_OFF\t0\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-45- *\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:46: * - dispatch_trigger_sigsys: Verify if PR_SET_SYSCALL_USER_DISPATCH is\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-47- *   able to trigger SIGSYS on a syscall.\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=65=TEST_SIGNAL(dispatch_trigger_sigsys, SIGSYS)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-73-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:74:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, 0, \u0026sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-75-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:76:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-77-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=88=static void prctl_valid(struct __test_metadata *_metadata,\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-91-{\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:92:\tEXPECT_EQ(0, prctl(PR_SET_SYSCALL_USER_DISPATCH, op, off, size, sel));\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-93-}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=95=static void prctl_invalid(struct __test_metadata *_metadata,\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-98-{\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:99:\tEXPECT_EQ(-1, prctl(PR_SET_SYSCALL_USER_DISPATCH, op, off, size, sel));\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-100-\tEXPECT_EQ(err, errno);\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=210=TEST(dispatch_and_return)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-223-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:224:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, 0, \u0026glob_sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-225-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:226:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-227-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=255=TEST_SIGNAL(bad_selector, SIGSYS)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-279-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:280:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, 0, \u0026glob_sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-281-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:282:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-283-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=298=TEST(disable_dispatch)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-303-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:304:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, 0, \u0026sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-305-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:306:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-307-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-311-\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:312:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_OFF, 0, 0, 0);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-313-\tEXPECT_EQ(0, ret) {\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=326=TEST(direct_dispatch_range)\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-335-\t */\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:336:\tret = prctl(PR_SET_SYSCALL_USER_DISPATCH, PR_SYS_DISPATCH_EXCLUSIVE_ON, 0, -1L, \u0026sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-337-\tASSERT_EQ(0, ret) {\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:338:\t\tTH_LOG(\"Kernel does not support CONFIG_SYSCALL_USER_DISPATCH\");\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-339-\t}\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c=349=static void test_range(struct __test_metadata *_metadata,\n--\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-354-\tSYSCALL_DISPATCH_OFF(glob_sel);\ntools/testing/selftests/syscall_user_dispatch/sud_test.c:355:\tEXPECT_EQ(0, prctl(PR_SET_SYSCALL_USER_DISPATCH, op, off, size, \u0026glob_sel));\ntools/testing/selftests/syscall_user_dispatch/sud_test.c-356-\tSYSCALL_DISPATCH_ON(glob_sel);\n"
}

gemini-3.1-pro-preview

							input: 25956
							output: 33
							thoughts: 75

Okay, here's my take on those thoughts, framed as my own internal monologue:

**Navigating the Kconfig Maze**

Right, so I was looking for `CONFIG_SYSCALL_USER_DISPATCH`, but that name doesn't seem to be sticking. Hmm, could it be just `SYSCALL_USER_DISPATCH` without the `CONFIG_` prefix? No, wait a minute... I seem to recall that the generic entry point stuff is what enables it. Let me just double check. Yeah, I should really consult `init/Kconfig` to confirm where `SYSCALL_USER_DISPATCH` is actually defined and what enables it. Need to make sure I'm not chasing a ghost here, or, worse, misunderstanding a critical dependency.

{
  "Expression": "config SYSCALL_USER_DISPATCH",
  "PathPrefix": "init/Kconfig"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 26244
							output: 29
							thoughts: 28

Here's my thought process, summarized as you requested:

**Investigating the `SYSCALL_USER_DISPATCH` Configuration Option**

Okay, so I need to track down the configuration option `SYSCALL_USER_DISPATCH`. The logical place to start looking for this would be the Kconfig files. Considering the system architecture, it's likely defined within the kernel source. Therefore, I'm going to check the `kernel/entry/Kconfig` file first. If it's not located there, then I'll broaden the search and go to the more general `Kconfig` files that are commonly used. That should pinpoint where this option is defined and how it's used in the build process.

{
  "Expression": "config SYSCALL_USER_DISPATCH",
  "PathPrefix": ""
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 26468
							output: 33
							thoughts: 45

Okay, here's my take on those thoughts, tailored for an expert audience:

**Investigating `SYSCALL_USER_DISPATCH`**

Hmm, so `SYSCALL_USER_DISPATCH` is a kernel config option, is it? Interesting. Given my experience, I'd immediately want to check how this affects the system calls path. Specifically, I need to know how the kernel handles the dispatch based on this.

My first thought is to dive into `kernel/entry/syscall_user_dispatch.c`. I'll want to see if this particular file is conditional on that config option. It will also be important to understand how the code behaves differently when the option is enabled vs when it's not. Is it a compile-time inclusion? A conditional branch within the main syscall handling path? Understanding the implications of this option is going to be crucial for profiling the syscall path and determining if this impacts performance in any way. I'll need to look for `#ifdef` or similar preprocessor directives that guard blocks of code related to user dispatch. And if it's there, then I'm going to want to understand what the differences are when it's not there!

{
  "Expression": "SYSCALL_USER_DISPATCH",
  "PathPrefix": "kernel/entry/Makefile"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 26811
							output: 30
							thoughts: 11

Here's my take on the thought process:

**Diving into the Kernel Entry Point Makefile**

Alright, time to get my hands dirty. I need to understand how this system initializes. My first instinct is always to check the entry point configuration. Let's see what's in `kernel/entry/Makefile`. This file should hold the keys to how the kernel's initial setup is orchestrated – the initial boot process, the early environment configuration, and what calls the `start` routine. Gotta see how the linker scripts are used, any architecture-specific assembly files that are linked early, any pre-main setup steps... It's the starting gun of the whole damn thing, and I need to see what's written on the barrel. The Makefile itself should illuminate the process.

{
  "Expression": "syscall_user_dispatch",
  "PathPrefix": "kernel/entry/Makefile"
}

{
  "Output": "kernel/entry/Makefile=15=obj-$(CONFIG_GENERIC_IRQ_ENTRY) \t+= common.o\nkernel/entry/Makefile:16:obj-$(CONFIG_GENERIC_SYSCALL) \t\t+= syscall-common.o syscall_user_dispatch.o\nkernel/entry/Makefile-17-obj-$(CONFIG_VIRT_XFER_TO_GUEST_WORK)\t+= virt.o\n"
}

gemini-3.1-pro-preview

							input: 27126
							output: 34
							thoughts: 93

Okay, here's my interpretation of that thought process, assuming I'm an expert in kernel development and configuration:

**Navigating Kernel Configuration for System Call Implementation**

Alright, so I'm looking at some code related to system calls. My first thought is whether we're using `CONFIG_GENERIC_SYSCALL` or `CONFIG_GENERIC_ENTRY`. It seems like a core part of the generic system call support. Let's dig in. Okay, the Makefile is revealing a dependency: `obj-$(CONFIG_GENERIC_SYSCALL) += syscall-common.o syscall_user_dispatch.o`. That confirms it – `CONFIG_GENERIC_SYSCALL` is controlling the inclusion of those crucial object files. But it makes me wonder, precisely what does this option entail? My knee-jerk reaction is to verify the definition of `GENERIC_SYSCALL` (since `CONFIG_GENERIC_SYSCALL` is its configuration counterpart) and how it’s used within the ARM64 architecture; so, I'm heading over to `arch/arm64/Kconfig` to refresh my memory and understand the relationship. I need a clear picture of how system call entry points are handled here.

{
  "Expression": "GENERIC_SYSCALL",
  "PathPrefix": "arch/arm64/Kconfig"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 27531
							output: 29
							thoughts: 32

Okay, here's my interpretation of that thought process, assuming I'm deep in the weeds of kernel development:

**Digging into the Entry Point Configuration**

Hmm, so `arch/arm64/Kconfig` is actually selecting `GENERIC_ENTRY`. I need to make sure I haven't missed anything. I thought I had the relationship of `GENERIC_ENTRY` pinned down, but it wouldn't hurt to double check it and see what's actually happening at `kernel/entry/Makefile`. Maybe I misremembered some of its relationships with the Kconfigs and Makefiles. Time to dive back in.

{
  "Expression": "GENERIC_ENTRY",
  "PathPrefix": "kernel/entry/Makefile"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 27740
							output: 31
							thoughts: 11

Here's my take on the kernel entry Makefile, from an expert's perspective:

**Diving into the Kernel Entry Makefile**

Okay, let's get down to brass tacks. I'm going to take a look at `kernel/entry/Makefile`. This is a crucial file, the starting point for understanding how the kernel's entry code is structured and compiled. I'm expecting to see how the initial setup is handled, things like architecture-specific code, boot-time initialization, and the linking of the entry point. I want to see which object files are being included, what compiler flags are being used, and any architecture-specific assembly code that's involved. I'll be looking for clues about the boot process itself; things like the early interrupt handling set-up and where the initial stacks are established are going to be key. Depending on the architecture, I'll be particularly interested in how the bootloader hands off control to the kernel proper. I'm keen to spot any unusual build configurations or dependencies that might offer insight into specific design choices. Time to crack it open and see what gems are inside.

{
  "File": "kernel/entry/Makefile",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0\n   2:\t\n   3:\t# Prevent the noinstr section from being pestered by sanitizer and other goodies\n   4:\t# as long as these things cannot be disabled per function.\n   5:\tKASAN_SANITIZE := n\n   6:\tUBSAN_SANITIZE := n\n   7:\tKCOV_INSTRUMENT := n\n   8:\t\n   9:\t# Branch profiling isn't noinstr-safe\n  10:\tccflags-$(CONFIG_TRACE_BRANCH_PROFILING) += -DDISABLE_BRANCH_PROFILING\n  11:\t\n  12:\tCFLAGS_REMOVE_common.o\t = -fstack-protector -fstack-protector-strong\n  13:\tCFLAGS_common.o\t\t+= -fno-stack-protector\n  14:\t\n  15:\tobj-$(CONFIG_GENERIC_IRQ_ENTRY) \t+= common.o\n  16:\tobj-$(CONFIG_GENERIC_SYSCALL) \t\t+= syscall-common.o syscall_user_dispatch.o\n  17:\tobj-$(CONFIG_VIRT_XFER_TO_GUEST_WORK)\t+= virt.o\n"
}

gemini-3.1-pro-preview

							input: 28326
							output: 27
							thoughts: 23

Here's my thought process, summarized as requested:

**Navigating Kernel Configuration Options**

Okay, so `CONFIG_GENERIC_SYSCALL`... that rings a bell, but I need to make sure I'm on the right track with my understanding. Time to drill down. Where exactly *is* this option defined? I need to quickly ascertain the context. I'm thinking I should start digging around in the configuration files, because that's the obvious first step. I need to understand its implications for the current architecture I'm working with and how this impacts the overall system call implementation. Let's get cracking.

{
  "Expression": "config GENERIC_SYSCALL",
  "PathPrefix": ""
}

{
  "Output": "arch/Kconfig=105=config GENERIC_IRQ_ENTRY\n--\narch/Kconfig-107-\narch/Kconfig:108:config GENERIC_SYSCALL\narch/Kconfig-109-\tbool\n"
}

gemini-3.1-pro-preview

							input: 28579
							output: 27
							thoughts: 14

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Analyzing the GENERIC_SYSCALL Usage**

Alright, so the initial thought process kicks off with a directed focus: *Let's see what selects `GENERIC_SYSCALL`.* This is where I begin the investigative process, the analysis. I'm not just idly pondering; I'm actively formulating a plan to understand the context and implications of this specific system call definition. The selection of `GENERIC_SYSCALL` is the focal point. I need to understand what pieces of the kernel are tying into this. My next steps are probably, to dig into the source tree and trace where this symbol is used. Is it a legacy thing? A performance optimization? Some sort of abstraction? Understanding the "what" and the "why" of the selection will be key to understanding the deeper architectural design considerations at play. I'm already mentally running through potential scenarios: Is it a common fallback? Part of a modular system? Does its selection correlate to other kernel features? This is going to be a fun dig.

{
  "Expression": "select GENERIC_SYSCALL",
  "PathPrefix": ""
}

{
  "Output": "arch/Kconfig=112=config GENERIC_ENTRY\n--\narch/Kconfig-114-\tselect GENERIC_IRQ_ENTRY\narch/Kconfig:115:\tselect GENERIC_SYSCALL\narch/Kconfig-116-\n"
}

gemini-3.1-pro-preview

							input: 28936
							output: 29
							thoughts: 390

**Analyzing the ARM64 Generic Syscall Entry Patch**

Okay, let's break this down. My initial thought was: the generic entry point (`GENERIC_ENTRY`) is the one being used to dispatch `GENERIC_SYSCALL`, and I remember that `arch/arm64/Kconfig` selects it. Therefore, this patch must be selecting it... wait, let's double-check. *Examines the diff* Ah, the diff confirms it: the patch explicitly *adds* `select GENERIC_ENTRY` in `arch/arm64/Kconfig`, while removing `GENERIC_IRQ_ENTRY`. So, that's straightforward.

Now, what about testing this? Which configurations will be important? Hmm, `SECCOMP` is a no-brainer because `secure_computing` gets modified and is used by the patch. Of course, `SECCOMP_FILTER` should also be enabled. Then, `COMPAT` looks to be used by the functions `arch_syscall_is_vdso_sigreturn` and `do_el0_svc_compat`, which are being modified, so I'll need to confirm that. As for `DEBUG_RSEQ`, that looks like it's being removed from `arch/arm64/kernel/syscall.c`, but the `rseq_syscall` is handled by the generic entry, so I'll need to check how that impacts the test configuration. Let me confirm if `SYSCALL_USER_DISPATCH` is a configuration option, since it's just enabled if `GENERIC_SYSCALL` is enabled. Okay, I'll need to check where that's defined.

{
  "Expression": "config SYSCALL_USER_DISPATCH",
  "PathPrefix": ""
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

							input: 29726
							output: 45
							thoughts: 455

**My Investigation into Arm64 System Call Configuration**

Okay, so it looks like `CONFIG_SYSCALL_USER_DISPATCH` isn't a standalone option. It's automatically included when `GENERIC_SYSCALL` is enabled, which simplifies things. That's good to know.

Now, let me dive into the code itself. In `arch/arm64/kernel/syscall.c`, I need to confirm the entry points. Ah, yes, `do_el0_svc` is the main handler for syscalls, and `do_el0_svc_compat` handles the compatibility calls. Excellent. And, as expected, `arch_syscall_is_vdso_sigreturn` is in `arch/arm64/kernel/vdso.c`, and `user_enable_single_step` is in `arch/arm64/kernel/debug-monitors.c`. Makes perfect sense.

Next, I should look at the security aspects. Let's see what's happening with seccomp. I remember that the `__secure_computing` function is, as expected, enabled through `CONFIG_SECCOMP`.

Now, I want to confirm the role of `syscall_user_dispatch`, which should be in `kernel/entry/syscall_user_dispatch.c`. Yep, it's there and built when `CONFIG_GENERIC_SYSCALL` is active.

So, to properly exercise the relevant functionality, the key configurations I need to focus on are:

*   `SECCOMP`
*   `SECCOMP_FILTER`
*   `COMPAT` (to test those compatibility syscalls)

I know `SECCOMP` and `SECCOMP_FILTER` are usually enabled. However, I want to be certain, so I will list them here.

Oh, wait, there's `GENERIC_ENTRY`. I recall it's selected by `ARM64`, which means it's always active on arm64 architectures. Good to keep in mind.

Are there any other relevant configurations? Let's check `arch/arm64/kernel/ptrace.c`. Hmm, `ptrace_save_reg` has moved from `ptrace.c` to `entry-common.h`, and, more importantly, `arch_ptrace_report_syscall_entry` and `arch_ptrace_report_syscall_exit` have been added to `entry-common.h`. So these are compiled in all the time. Now I should check what is in `arch/arm64/include/asm/entry-common.h`.

{
  "Expression": "arch_ptrace_report_syscall_entry",
  "PathPrefix": "arch/arm64/include/asm/entry-common.h"
}

{
  "Output": "arch/arm64/include/asm/entry-common.h=64=static __always_inline unsigned long ptrace_save_reg(struct pt_regs *regs,\n--\narch/arm64/include/asm/entry-common.h-92-\narch/arm64/include/asm/entry-common.h:93:static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs *regs)\narch/arm64/include/asm/entry-common.h-94-{\n--\narch/arm64/include/asm/entry-common.h-106-\narch/arm64/include/asm/entry-common.h:107:#define arch_ptrace_report_syscall_entry arch_ptrace_report_syscall_entry\narch/arm64/include/asm/entry-common.h-108-\n"
}

gemini-3.1-pro-preview

							input: 31014
							output: 34
							thoughts: 298

**My Analysis of Function Hotness for Test Distribution**

Okay, so I'm thinking about which functions are going to skew my test distributions, and these ones jumped out: `do_el0_svc`, `do_el0_svc_compat`, `arch_syscall_is_vdso_sigreturn`, `syscall_user_dispatch`, `__secure_computing`, `__seccomp_filter`, `user_enable_single_step`, and `user_disable_single_step`.

The instructions explicitly say to avoid generic hot-path functions, and, hang on... `do_el0_svc` is a *huge* offender here. It’s the entry point for *every* EL0 system call! That's going to dominate any test and invalidate the results. Definitely avoiding that.

Then, `__secure_computing` and `__seccomp_filter` – they're on the fast path too if seccomp is enabled, so, depending on the system config, we should probably ignore them.

`syscall_user_dispatch` is the next one. It's executed for every syscall if `SYSCALL_USER_DISPATCH` is enabled, but it looks like that's controlled by a flag, so maybe not *as* hot as the others, but still on the syscall path, so potentially problematic.

And `arch_syscall_is_vdso_sigreturn` is called from `syscall_user_dispatch`, so that's indirectly hot.

But wait, `syscall_user_dispatch` is only actually *called* if `SYSCALL_WORK_SYSCALL_USER_DISPATCH` is set! Good to know, I need to check `include/linux/entry-common.h` to see how this flag is set and how common it is.

{
  "Expression": "syscall_user_dispatch",
  "PathPrefix": "include/linux/entry-common.h"
}

{
  "Output": "include/linux/entry-common.h=52=static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs *regs)\n--\ninclude/linux/entry-common.h-57-\ninclude/linux/entry-common.h:58:bool syscall_user_dispatch(struct pt_regs *regs);\ninclude/linux/entry-common.h-59-long trace_syscall_enter(struct pt_regs *regs, long syscall);\n--\ninclude/linux/entry-common.h=72=static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned long work)\n--\ninclude/linux/entry-common.h-81-\tif (work \u0026 SYSCALL_WORK_SYSCALL_USER_DISPATCH) {\ninclude/linux/entry-common.h:82:\t\tif (syscall_user_dispatch(regs))\ninclude/linux/entry-common.h-83-\t\t\treturn -1L;\n"
}

gemini-3.1-pro-preview

							input: 31983
							output: 38
							thoughts: 124

**Fuzzing Candidate Identification**

Okay, let's see. My initial scan has pointed me towards some promising areas for fuzzing within the kernel. The logic flow seems to indicate that `syscall_user_dispatch` is only invoked when that specific flag is set, making it a prime target for in-depth analysis. This seems like it could have some interesting edge cases to explore.

Then, there's `arch_syscall_is_vdso_sigreturn`. This function is another compelling avenue to investigate, and warrants further attention.

Furthermore, the pair of functions `user_enable_single_step` and `user_disable_single_step` look particularly relevant. The fact that they are invoked during ptrace operations, specifically when enabling and disabling single-stepping, suggests they're handling low-level control of the execution flow. I need to dig into these, as ptrace is notoriously complex.

Finally, `set_syscall_user_dispatch` is intriguing. It's the prctl handler, so it offers a way to configure the system call dispatch. I need to check the code in `kernel/entry/syscall_user_dispatch.c` to see precisely what is being controlled and how this impacts the rest of the kernel's execution path.

{
  "Expression": "set_syscall_user_dispatch",
  "PathPrefix": "kernel/entry/syscall_user_dispatch.c"
}

{
  "Output": "kernel/entry/syscall_user_dispatch.c=40=bool syscall_user_dispatch(struct pt_regs *regs)\n--\nkernel/entry/syscall_user_dispatch.c-76-\nkernel/entry/syscall_user_dispatch.c:77:static int task_set_syscall_user_dispatch(struct task_struct *task, unsigned long mode,\nkernel/entry/syscall_user_dispatch.c-78-\t\t\t\t\t  unsigned long offset, unsigned long len,\n--\nkernel/entry/syscall_user_dispatch.c-135-\nkernel/entry/syscall_user_dispatch.c:136:int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,\nkernel/entry/syscall_user_dispatch.c-137-\t\t\t      unsigned long len, char __user *selector)\nkernel/entry/syscall_user_dispatch.c-138-{\nkernel/entry/syscall_user_dispatch.c:139:\treturn task_set_syscall_user_dispatch(current, mode, offset, len, selector);\nkernel/entry/syscall_user_dispatch.c-140-}\n--\nkernel/entry/syscall_user_dispatch.c=166=int syscall_user_dispatch_set_config(struct task_struct *task, unsigned long size,\n--\nkernel/entry/syscall_user_dispatch.c-176-\nkernel/entry/syscall_user_dispatch.c:177:\treturn task_set_syscall_user_dispatch(task, cfg.mode, cfg.offset, cfg.len,\nkernel/entry/syscall_user_dispatch.c-178-\t\t\t\t\t      (char __user *)(uintptr_t)cfg.selector);\n"
}

gemini-3.1-pro-preview

							input: 32829
							output: 38
							thoughts: 611

**My Initial Thoughts on Fuzzing Target Candidates**

Okay, so I'm thinking about where to start with fuzzing targets.  `set_syscall_user_dispatch` and `task_set_syscall_user_dispatch` immediately jump out as possibilities, along with the configuration getters and setters: `syscall_user_dispatch_get_config` and `syscall_user_dispatch_set_config`. These seem like good starting points.

Let's do some digging. I'll check `arch/arm64/kernel/ptrace.c`. Ah, right, the patch removed the `syscall_trace_enter` and `syscall_trace_exit` functions. They've been replaced by `arch_ptrace_report_syscall_entry` and `arch_ptrace_report_syscall_exit`, which are now in `arch/arm64/include/asm/entry-common.h`.  Hmm, but `arch_ptrace_report_syscall_entry` is declared as `__always_inline`.  That's a no-go for direct fuzzing. What about the generic `ptrace_report_syscall_entry`? It's a possibility, but potentially not as interesting as others.

Now, let's look at `arch/arm64/kernel/debug-monitors.c`.  Ah, here we go, `user_enable_single_step` and `user_disable_single_step` are being modified to set or clear the `SYSCALL_EXIT_TRAP` flag. Those are definitely good candidates!

Then, I'll move on to `kernel/seccomp.c`. I see `__secure_computing` and `__seccomp_filter` now return a `bool`.  They are both called on syscall entry if seccomp is enabled.  The question is: are they too hot?  Generally, in a fuzzing setup, seccomp is usually only enabled for specific tests, but I need to consider if Syzkaller heavily leverages seccomp to isolate processes. *Wait, it doesn't use seccomp for its own processes, but it might fuzz it.* Actually, `__seccomp_filter` is likely a good choice because it's the core of seccomp filtering.

However, the prompt says to avoid "generic hot-path functions," so I need to be careful here. I know `__secure_computing` is probably a hot path if seccomp is enabled. I should stick to the less frequently used options. So, let me narrow it down to:

*   `arch_syscall_is_vdso_sigreturn`
*   `syscall_user_dispatch`
*   `set_syscall_user_dispatch`
*   `task_set_syscall_user_dispatch`
*   `syscall_user_dispatch_get_config`
*   `syscall_user_dispatch_set_config`
*   `user_enable_single_step`
*   `user_disable_single_step`

Okay, hold on...I need to make sure I'm not missing anything. I need to make sure I've exhausted `kernel/entry/syscall_user_dispatch.c`. Are there any other functions in there? That should be a good area to start looking at more closely.

{
  "Expression": "^bool syscall_user_dispatch",
  "PathPrefix": "kernel/entry/syscall_user_dispatch.c"
}

{
  "Output": "kernel/entry/syscall_user_dispatch.c=35=bool __weak arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)\n--\nkernel/entry/syscall_user_dispatch.c-39-\nkernel/entry/syscall_user_dispatch.c:40:bool syscall_user_dispatch(struct pt_regs *regs)\nkernel/entry/syscall_user_dispatch.c-41-{\n"
}

gemini-3.1-pro-preview

							input: 34313
							output: 34
							thoughts: 735

**Analyzing the Kernel Patch: Arm64 and Generic Syscall Entry**

Okay, so initially I was a bit confused. `syscall_user_dispatch` is a general mechanism, but this patch is enabling it specifically for arm64 by selecting `GENERIC_ENTRY`. The patch doesn't actually *add* `syscall_user_dispatch.c` directly, it's modifying `arch/arm64/Kconfig` to set `GENERIC_ENTRY`, which conditionally includes `syscall_user_dispatch.c` if `GENERIC_SYSCALL` is also chosen. Right, got it.

But hold on, let me double-check the diff itself... *Aha!* The diff *does* touch `kernel/entry/syscall_user_dispatch.c`. Now I see it. The patch adds `arch_syscall_is_vdso_sigreturn` as a weak function there. Okay, so that's a key function for this change. Now I understand. This function is implemented in `arch/arm64/kernel/vdso.c`, and it's definitely a core piece.

Let's broaden the scope and look at other affected files within the patch. I'm seeing changes to `arch/alpha/kernel/ptrace.c`, `arch/arm/kernel/ptrace.c`, `arch/csky/kernel/ptrace.c`, `arch/m68k/kernel/ptrace.c`, `arch/mips/kernel/ptrace.c`, `arch/parisc/kernel/ptrace.c`, `arch/sh/kernel/ptrace_32.c`, `arch/um/kernel/skas/syscall.c`, `arch/x86/entry/vsyscall/vsyscall_64.c`, and `arch/xtensa/kernel/ptrace.c`. They're all being modified to use `!secure_computing()` instead of `secure_computing() == -1`. This means there's a wider, fundamental change across the kernel where `secure_computing()` is now returning a boolean.

So, summing it up, the core of this patch is two-fold: First, it's a tree-wide change to convert `secure_computing()` to a boolean return. But the bigger, architectural change is migrating arm64 to this generic entry point mechanism. That's the primary area of interest, I believe.

To solidify my understanding, let's list the relevant symbols. The key functions are:
*   `arch_syscall_is_vdso_sigreturn`
*   `user_enable_single_step`
*   `user_disable_single_step`

Wait, hang on... `user_enable_single_step` is actually defined in `arch/arm64/kernel/debug-monitors.c`. I'll need to remember that.

Let's quickly check the contents of `arch/arm64/kernel/syscall.c` too. While it won't be as important to understanding the *impact* of the change, it's important to understand the arm64 specific code. Looks like `do_el0_svc` and `do_el0_svc_compat` are hot paths, and I'll need to consider `invoke_syscall`, although I'm pretty sure that it's static and likely inlined. I need to keep this context when reviewing the code. I'll need to check the actual `arch/arm64/kernel/syscall.c` file itself.

{
  "Expression": "invoke_syscall",
  "PathPrefix": "arch/arm64/kernel/syscall.c"
}

{
  "Output": "arch/arm64/kernel/syscall.c=23=static long do_ni_syscall(struct pt_regs *regs, int scno)\n--\narch/arm64/kernel/syscall.c-33-\narch/arm64/kernel/syscall.c:34:static long __invoke_syscall(struct pt_regs *regs, syscall_fn_t syscall_fn)\narch/arm64/kernel/syscall.c-35-{\n--\narch/arm64/kernel/syscall.c-38-\narch/arm64/kernel/syscall.c:39:static void invoke_syscall(struct pt_regs *regs, unsigned int scno,\narch/arm64/kernel/syscall.c-40-\t\t\t   unsigned int sc_nr,\n--\narch/arm64/kernel/syscall.c-49-\t\tsyscall_fn = syscall_table[array_index_nospec(scno, sc_nr)];\narch/arm64/kernel/syscall.c:50:\t\tret = __invoke_syscall(regs, syscall_fn);\narch/arm64/kernel/syscall.c-51-\t} else {\n--\narch/arm64/kernel/syscall.c=58=static __always_inline void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,\n--\narch/arm64/kernel/syscall.c-118-\narch/arm64/kernel/syscall.c:119:\tinvoke_syscall(regs, scno, sc_nr, syscall_table);\narch/arm64/kernel/syscall.c-120-trace_exit:\n"
}

gemini-3.1-pro-preview

							input: 36259
							output: 31
							thoughts: 1787

**My Analysis of the System Call Patch**

Okay, let's break this down. My initial thought process focused on identifying the most interesting changes within this system call patch. I quickly honed in on the hot paths, like `invoke_syscall` and `__invoke_syscall`, which I filtered out to focus on the key modifications. I started by looking into `syscall_trace_enter`, which led me to specific architecture implementations.

My attention then shifted to the less frequently executed functions that were actually changed. Specifically, I noticed modifications to:

* `arch_syscall_is_vdso_sigreturn`
* `user_enable_single_step`
* `user_disable_single_step`

I then double-checked `syscall_user_dispatch`. It wasn't directly modified but saw the addition of `arch_syscall_is_vdso_sigreturn` and therefore bears relevance. I moved on to analyze the implications of these changes, particularly how `arch_syscall_is_vdso_sigreturn` is implemented for ARM64. The differences, specifically those related to the VDSO sigreturn mechanism, seem critical.

I then considered `__secure_computing` and `__seccomp_filter`. While those are core seccomp changes in the patch, my focus is on less-frequently called functions. Since this patch modifies the seccomp, but the hot path functions are not the focus, I discarded these.

I revisited the question of generic hot paths, making sure to avoid including them in my selection, to prevent skewed test distributions. Therefore, I settled on listing the following:

* `arch_syscall_is_vdso_sigreturn`
* `user_enable_single_step`
* `user_disable_single_step`

These functions seem to capture the essence of the changes without being overly generic.

Finally, I checked the required configurations to ensure proper testability.
* `SECCOMP`
* `SECCOMP_FILTER`
* `COMPAT` (needed because of compat-related logic in `arch_syscall_is_vdso_sigreturn`)

{
  "Expression": "config COMPAT",
  "PathPrefix": "arch/arm64/Kconfig"
}

{
  "Output": "arch/arm64/Kconfig=1746=config ARM64_TAGGED_ADDR_ABI\n--\narch/arm64/Kconfig-1754-\narch/arm64/Kconfig:1755:menuconfig COMPAT\narch/arm64/Kconfig-1756-\tbool \"Kernel support for 32-bit EL0\"\n--\narch/arm64/Kconfig=1775=config KUSER_HELPERS\n--\narch/arm64/Kconfig-1801-\narch/arm64/Kconfig:1802:config COMPAT_VDSO\narch/arm64/Kconfig-1803-\tbool \"Enable vDSO for 32-bit applications\"\n--\narch/arm64/Kconfig=1815=config THUMB2_COMPAT_VDSO\n--\narch/arm64/Kconfig-1822-\narch/arm64/Kconfig:1823:config COMPAT_ALIGNMENT_FIXUPS\narch/arm64/Kconfig-1824-\tbool \"Fix up misaligned multi-word loads and stores in user space\"\n"
}

gemini-3.1-pro-preview

							input: 38831
							output: 27
							thoughts: 28

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Configuration Verification: A Quick Check**

Right, so we're looking at a config here. Good, `COMPAT` is definitely a valid option; that's straightforward. Now, let's just make sure we haven't overlooked anything related to security, particularly with this `SECCOMP` and `SECCOMP_FILTER` combo. I need to quickly refresh my mental map of how these interact and the potential implications of their settings. Gotta ensure no oversights here. Gotta confirm the SECCOMP policies are well-defined. Alright, let's delve deeper to confirm that.

{
  "Expression": "config SECCOMP",
  "PathPrefix": "arch/Kconfig"
}

{
  "Output": "arch/Kconfig=628=config HAVE_ARCH_SECCOMP_FILTER\n--\narch/Kconfig-646-\narch/Kconfig:647:config SECCOMP\narch/Kconfig-648-\tprompt \"Enable seccomp to safely execute untrusted bytecode\"\n--\narch/Kconfig-663-\narch/Kconfig:664:config SECCOMP_FILTER\narch/Kconfig-665-\tdef_bool y\n--\narch/Kconfig-673-\narch/Kconfig:674:config SECCOMP_CACHE_DEBUG\narch/Kconfig-675-\tbool \"Show seccomp filter cache status in /proc/pid/seccomp_cache\"\n"
}

gemini-3.1-pro-preview

							input: 39212
							output: 220
							thoughts: 481

**My Assessment of the Arm64 System Call Migration Patch**

Okay, this looks valid. Let me quickly run through this patch's implications for fuzzing. Are there any other configuration details I need to consider? Right, it modifies `arch/arm64/Kconfig` to select `GENERIC_ENTRY`. `GENERIC_ENTRY` is *selected*, so I don't need to enable it explicitly. That simplifies things.

Let's break down the core of this: the patch moves arm64 to the generic entry code for system calls. This means it's ditching the custom arm64 syscall entry/exit tracing and switching to the generic `syscall_trace_enter()` and `syscall_exit_to_user_mode_work()` functions. It also modifies `secure_computing()` across the tree to return a boolean instead of an integer. That's a substantial functional shift in how syscalls work on arm64, and it ripples out to seccomp handling across architectures.

Therefore, fuzzing efforts should target the specific new entry points on arm64 introduced by the generic entry mechanism. I'm thinking specifically about things like `arch_syscall_is_vdso_sigreturn`. And, I need to look closely at single-step ptrace interaction, since that was modified to work with the generic entry.

To exercise the seccomp changes and the compat branch of the vdso sigreturn check, I should definitely enable `SECCOMP`, `SECCOMP_FILTER`, and `COMPAT`.

My key focus symbols here are:

*   `arch_syscall_is_vdso_sigreturn`
*   `user_enable_single_step`
*   `user_disable_single_step`

Wait... I see `arch_syscall_is_vdso_sigreturn` is *also* added as a weak function in `kernel/entry/syscall_user_dispatch.c`. Alright, so the function is defined in more than one place.

Hmm, what about fuzzing `__secure_computing` directly? It's a hot path, and it's been touched by this patch. However, it's too risky to include in this current focus. I don't want to skew the results by including code that is too broadly changed.

Let me just quickly verify if there are any other relevant functions to consider... Okay, `ptrace_save_reg` in `arch/arm64/include/asm/entry-common.h` and `arch_ptrace_report_syscall_entry` and `arch_ptrace_report_syscall_exit` are all `__always_inline`. That means I can't target them directly for fuzzing.

Okay, I'm confident with these three focus symbols. Let's call `set-results`.

{
  "EnableConfigs": [
    "SECCOMP",
    "SECCOMP_FILTER",
    "COMPAT"
  ],
  "FocusSymbols": [
    "arch_syscall_is_vdso_sigreturn",
    "user_enable_single_step",
    "user_disable_single_step"
  ],
  "Reasoning": "The patch migrates arm64 to use the generic entry code for system calls, replacing custom arm64 syscall entry/exit tracing with generic hooks. It also modifies secure_computing() tree-wide to return a boolean. This is a major functional change to the core syscall path on arm64 and seccomp handling. Fuzzing should focus on the newly added arm64-specific generic entry hooks (e.g., arch_syscall_is_vdso_sigreturn) and ptrace single-step toggling which was modified to interact with generic entry. SECCOMP and COMPAT configs are required to exercise the modified seccomp logic and compat vdso checks.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "SECCOMP",
    "SECCOMP_FILTER",
    "COMPAT"
  ],
  "FocusSymbols": [
    "arch_syscall_is_vdso_sigreturn",
    "user_enable_single_step",
    "user_disable_single_step"
  ],
  "Reasoning": "The patch migrates arm64 to use the generic entry code for system calls, replacing custom arm64 syscall entry/exit tracing with generic hooks. It also modifies secure_computing() tree-wide to return a boolean. This is a major functional change to the core syscall path on arm64 and seccomp handling. Fuzzing should focus on the newly added arm64-specific generic entry hooks (e.g., arch_syscall_is_vdso_sigreturn) and ptrace single-step toggling which was modified to interact with generic entry. SECCOMP and COMPAT configs are required to exercise the modified seccomp logic and compat vdso checks.",
  "WorthFuzzing": true
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)