syscall_ent...er_mode_work(9)

💅 syscall_ent...er_mode_work(9) 💅

ok so this is a page from the Kernel API Manual (yes, the kernel has its own manual, we love that for it) and it's about syscall_enter_from_user_mode_work — the little pre-flight check that happens right before a syscall gets to actually do syscall things. buckle up bestie 🎀

---

✨ NAME ✨

syscall_enter_from_user_mode_work — check and handle work before invoking a syscall 🦋

---

✨ SYNOPSIS ✨

bool syscall_enter_from_user_mode_work (struct pt_regs *regs , long
*syscall );

---

✨ ARGUMENTS ✨

• regs — pointer to current's pt_regs 💖 (like, the register snapshot of whatever task is running right now)
• syscall — the syscall number 👑

---

✨ DESCRIPTION ✨

okay so picture this: you're in architecture specific syscall entry code, interrupts are enabled, and you've already invoked enter_from_user_mode, enabled interrupts, and done the extra architecture specific work — and the syscall return value is preset to -ENOSYS going in. that's the exact moment this function gets invoked. iconic timing honestly ⭐

here's the part you cannot miss: if the return value is false, the caller must skip the syscall and leave the syscall return value unmodified — like, do NOT touch it, because one of the entry work functions might have already set it. hands off 🙈

it handles these work items, in order:

1. syscall_work flag dependent invocations of ptrace_report_syscall_permit_entry, __seccomp_permit_syscall, trace_sys_enter 🔥
2. invocation of audit_syscall_entry 👑

---

✨ RETURN ✨

True if the syscall should be invoked, False otherwise 💀 (and remember, False means skip it and don't mess with the return value, k?)

---

✨ SEE ALSO ✨

kernel file ./include/linux/entry-common.h 🌸

• arch_ptrace_report_syscall_permit_entry(9)
• enter_from_user_mode_randomize_stack(9)
• syscall_enter_from_user_mode_randomize_stack(9)
• arch_ptrace_report_syscall_exit(9)
• syscall_exit_work(9)
• syscall_exit_to_user_mode_work(9)
• syscall_exit_to_user_mode(9)

---

lowkey the whole entry/exit family is a vibe, go read the exit ones next, bestie 🫶

---

and that's the whole page!! source lives at ./include/linux and the version stamp says October 2026 — so yeah, print it, frame it, put it on your wall, periodt 💜🧚✨