Re: [PATCH v4 1/2] ptrace: add PTRACE_SET_SYSCALL_INFO syscall skipping support

["Dmitry V. Levin" <ldv@strace.io>]

On Wed, Jul 08, 2026 at 11:06:54AM +0200, Renzo Davoli wrote:
> Extend PTRACE_SET_SYSCALL_INFO to support skipping a system call triggered
> via seccomp.
> 
> When a tracer retrieves a ptrace_syscall_info structure with 'op' set to
> PTRACE_SYSCALL_INFO_SECCOMP, it can now choose to skip the system call.
> To do this, the tracer changes 'op' to PTRACE_SYSCALL_INFO_EXIT and
> populates the exit union fields (rval and is_error) to define the return
> value and error status for the tracee.
> 
> System call suppression for PTRACE_SYSCALL_INFO_ENTRY is currently omitted
> because its implementation is architecture-dependent. On some architectures,
> the system call number and return value share the same register, making it
> difficult to suppress a system call without altering the return value. A
> portable implementation would require an audit of all supported architectures.

I suggest the following wording for the explanation why
PTRACE_SYSCALL_INFO_ENTRY is not supported yet:

System call suppression via PTRACE_SYSCALL_INFO_ENTRY is currently not
implemented.  On some architectures (e.g. MIPS), when a system call
is skipped by setting the syscall number to -1 at the entry stop, the
architecture entry path unconditionally overwrites the return value
register with -ENOSYS before the tracer can set a custom return value
at the exit stop.  A portable implementation of entry-based syscall
suppression would require an audit of all supported architectures
to ensure the tracer-provided return value is preserved.


-- 
ldv