Record x86 KPM loader 0.21 validation

Author: Ognisty321

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this WSA x86_64 ReSukiSU + SUSFS + KPM kernel are documen
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+### Changed
+
+1. Bumped the current `main` KPM loader marker to `ReSukiSU-x86_64-KPM-loader/0.21` for the native x86_64 syscall wrapper ABI.
+
+### Added
+
+1. Native x86_64 syscall-table wrapper backend for `hook_syscalln`, `fp_wrap_syscalln` and `inline_wrap_syscalln`; compat syscall wrapping remains unsupported.
+
 ## [v0.21] - 2026-04-27
 
 ### Changed

KernelSU

@@ -28,15 +28,15 @@ The result is a single WSA kernel where ReSukiSU root, SUSFS hide and KPM module
 | Validated WSA package | `2407.40000.4.0` |
 | Validated Windows build | `26200`, Memory Integrity on |
 
-`ReSukiSU-x86_64-KPM-loader/0.20` is the loader runtime/ABI marker. It is intentionally separate from the WSA kernel release tag.
+The published `wsa-x86_64-kpm-v0.21` binary reports `ReSukiSU-x86_64-KPM-loader/0.20`. Current `main` source builds report `ReSukiSU-x86_64-KPM-loader/0.21`; use `scripts/wsa-release-manifest.sh` next to every candidate binary so the release tag, source commit, submodule commit and loader marker stay tied to the exact artifact.
 
 ## Quick Start
 
 1. Download the kernel binary from the [latest release](https://github.com/Ognisty321/WSA-Linux-Kernel/releases/latest).
 2. Verify SHA256 against the value above.
 3. Replace `Tools\kernel` inside your unpacked WSA package and re-register the WSA appx.
 4. Boot WSA and run `adb shell uname -a`. The kernel string must contain `WSA-ReSukiSU+`.
-5. Open ReSukiSU Manager and confirm `KPM Version: Supported (ReSukiSU-x86_64-KPM-loader/0.20)`.
+5. Open ReSukiSU Manager and confirm the KPM marker for the artifact you installed: `ReSukiSU-x86_64-KPM-loader/0.20` for the published `v0.21` binary, or the manifest value for a local source build.
 6. For deeper diagnostics, run `adb shell su -c "ksud kpm doctor --json"`.
 
 Detailed step by step install for Windows is in [docs/INSTALL.md](docs/INSTALL.md).
@@ -74,11 +74,11 @@ Full technical write up of the port is in [docs/KPM_PORT.md](docs/KPM_PORT.md).
 1. WSA 2407 style `5.15.104` x86_64 is the tested target.
 2. ARM64 `.kpm` binaries cannot load on this kernel.
 3. KPMs with C source can be ported to x86_64 if they avoid ARM64 assembly, ARM64 syscall numbers, ARM64 system registers and ARM64 branch helpers. Recommended build flags are in [docs/KPM_PORT.md](docs/KPM_PORT.md#kpm-build-flags), with the longer checklist in [KernelSU/docs/KPM_X86_64_PORTING.md](KernelSU/docs/KPM_X86_64_PORTING.md).
-4. Direct syscall hook install is intentionally not exposed in this release. The wrapper symbols are present for compatibility, but install calls return `EOPNOTSUPP`.
+4. Native x86_64 syscall wrappers are available through `hook_syscalln`, `fp_wrap_syscalln` and `inline_wrap_syscalln`; compat syscall wrapping still returns `EOPNOTSUPP`.
 
 ## Validation
 
-The release build was stress tested with capability KPMs covering basic KPM ABI, hotpatch, function pointer hook, inline hook, trampoline restore, `hook_wrap`, `fp_hook_wrap`, x86_64 instruction relocation cases, malformed metadata rejection and unsupported syscall hook rejection.
+The x86_64 validation suite covers basic KPM ABI, hotpatch, function pointer hook, inline hook, trampoline restore, `hook_wrap`, `fp_hook_wrap`, x86_64 instruction relocation cases, malformed metadata rejection and native syscall wrapper load/unload and compat syscall rejection.
 
 ```text
 500 loops x 5 modules = 2500 load/control/unload cycles

README.md

@@ -43,7 +43,7 @@ arch/x86/boot/bzImage
 strings arch/x86/boot/bzImage | grep -E 'WSA-ReSukiSU|KPM-loader' | head
 ```
 
-You should see the `5.15.104-...-WSA-ReSukiSU+` release string and, on uncompressed images or extracted `vmlinux`, the `ReSukiSU-x86_64-KPM-loader/0.20` marker.
+You should see the `5.15.104-...-WSA-ReSukiSU+` release string and, on uncompressed images or extracted `vmlinux`, the `ReSukiSU-x86_64-KPM-loader/0.21` marker.
 
 ## Useful Targets
 

docs/BUILD.md

@@ -14,7 +14,7 @@ Tracked module status lives in [KPM_MODULE_COMPATIBILITY.md](KPM_MODULE_COMPATIB
 
 ## ReSukiSU Manager shows `Unsupported` after a Manager update
 
-The Manager ships its own `libksud.so`. After a Manager upgrade, Android may overwrite that library with a stock build that does not handle the `kpm` subcommand on x86_64. The kernel side is unaffected if `adb shell su -c "ksud kpm version"` still returns `ReSukiSU-x86_64-KPM-loader/0.20`.
+The Manager ships its own `libksud.so`. After a Manager upgrade, Android may overwrite that library with a stock build that does not handle the `kpm` subcommand on x86_64. The kernel side is unaffected if `adb shell su -c "ksud kpm version"` still returns the marker for your installed artifact, for example `ReSukiSU-x86_64-KPM-loader/0.20` on the published `v0.21` binary or `ReSukiSU-x86_64-KPM-loader/0.21` on current `main` builds.
 
 Before reinstalling, check the APK or extracted library:
 
@@ -89,9 +89,9 @@ adb shell su -c "ksud kpm version"
 adb shell su -c "ksud kpm doctor --json"
 ```
 
-The kernel string must contain `WSA-ReSukiSU+`. The KPM version must read `ReSukiSU-x86_64-KPM-loader/0.20`.
+The kernel string must contain `WSA-ReSukiSU+`. The KPM version must match the installed artifact: `ReSukiSU-x86_64-KPM-loader/0.20` for the published `v0.21` binary, or the `kpm_loader=` value from the sidecar manifest for a local build. Current `main` source builds report `ReSukiSU-x86_64-KPM-loader/0.21`.
 
-The `0.20` value is the x86_64 KPM loader runtime/ABI marker. It can stay unchanged across WSA kernel release tags such as `wsa-x86_64-kpm-v0.21`.
+The loader marker is separate from WSA kernel release tags such as `wsa-x86_64-kpm-v0.21`.
 
 ## Can I use this kernel with a different WSA build?
 
@@ -108,6 +108,6 @@ Open a [bug report](https://github.com/Ognisty321/WSA-Linux-Kernel/issues/new/ch
 5. Relevant `dmesg` slice.
 6. Whether Memory Integrity was on or off on the host.
 
-## Why is direct syscall hook install disabled?
+## What syscall hook path is supported?
 
-A direct `sys_call_table` hook on x86_64 carries known integrity hazards on FineIBT, CFI and ftrace owned syscall slots. In this release the API surface is exposed as wrappers, but install calls return `EOPNOTSUPP` rather than ship a backend that has not been fully validated. A future release may enable a validated path.
+Native x86_64 syscall wrapping is implemented through `hook_syscalln`, `fp_wrap_syscalln` and `inline_wrap_syscalln`. Compat syscall wrapping remains unsupported on WSA x86_64 and returns `EOPNOTSUPP`. Prefer these wrapper APIs over patching syscall entry text directly.

docs/FAQ.md

@@ -80,12 +80,14 @@ Or from `adb`:
 adb shell su -c "ksud kpm version"
 ```
 
-Expected:
+Expected for the published `v0.21` binary:
 
 ```text
 ReSukiSU-x86_64-KPM-loader/0.20
 ```
 
+For a local `main` source build, use the `kpm_loader=` value in the sidecar manifest; current source builds report `ReSukiSU-x86_64-KPM-loader/0.21`.
+
 For full runtime diagnostics:
 
 ```powershell

docs/INSTALL.md

@@ -51,7 +51,8 @@ Use the actual module name from `ksud kpm info` when unloading.
 | `hotpatch` example | `host-pass` | Same example preflight evidence. | Validates transactional hotpatch path. |
 | `failure_cases` example | `host-pass` | Same example preflight evidence. | Validates refusal and cleanup paths. |
 | ARM64-only prebuilt modules | `blocked-arch` | Checker rejects non-x86_64 ELF. | Rebuild from source is required. |
-| Direct syscall hook modules | `blocked-abi` | `hook_syscalln`, `fp_wrap_syscalln`, `inline_wrap_syscalln` return `EOPNOTSUPP`. | Wrapper symbols exist for compatibility, but install is intentionally refused. |
+| Native syscall wrapper modules | `source-candidate` | `hook_syscalln`, `fp_wrap_syscalln` and `inline_wrap_syscalln` are available in loader `0.21`; add live WSA evidence per module. | Compat syscall wrapping remains unsupported. |
+| Compat syscall hook modules | `blocked-abi` | Compat syscall wrapper calls return `EOPNOTSUPP`. | WSA x86_64 does not expose a compat syscall wrapper backend. |
 | Phone vendor driver modules | `blocked-wsa` | WSA does not ship the target vendor drivers. | Examples include modules built around device-specific battery, display, freezer or SoC drivers. |
 
 ## Row Template

docs/KPM_MODULE_COMPATIBILITY.md

@@ -29,16 +29,17 @@ Implemented:
 8. `synchronize_rcu_tasks_rude()` plus `synchronize_rcu_tasks()` before generated executable buffers are freed.
 9. Refusal of unsafe or conflicting hook targets owned by ftrace, kprobes, alternatives, jump labels or static calls.
 10. Refusal of patching from IRQ or atomic context.
+11. Native x86_64 syscall-table wrappers through `hook_syscalln`, `fp_wrap_syscalln` and `inline_wrap_syscalln`.
 
 Intentionally not implemented in this release:
 
-1. Direct syscall hook install. Wrapper symbols `hook_syscalln`, `fp_wrap_syscalln`, `inline_wrap_syscalln`, `syscalln_addr` exist but install calls return `EOPNOTSUPP`.
+1. Compat syscall-table wrapping; compat syscall install calls return `EOPNOTSUPP`.
 2. ARM64 branch helper APIs (`branch_from_to`, `branch_relative`, `branch_absolute`, `ret_absolute`).
 3. ARM64 `kpimg` style boot time patching of the kernel image.
 
 ## Loader ABI
 
-The formal x86_64 ABI contract is in [`KernelSU/docs/KPM_X86_64_ABI.md`](../KernelSU/docs/KPM_X86_64_ABI.md). The current loader marker is `ReSukiSU-x86_64-KPM-loader/0.20` with ABI version `1`.
+The formal x86_64 ABI contract is in [`KernelSU/docs/KPM_X86_64_ABI.md`](../KernelSU/docs/KPM_X86_64_ABI.md). The current loader marker is `ReSukiSU-x86_64-KPM-loader/0.21` with ABI version `1`.
 
 Patch hygiene and rebase rules are in [`KernelSU/docs/UPSTREAMING_X86_64.md`](../KernelSU/docs/UPSTREAMING_X86_64.md).
 
@@ -126,25 +127,26 @@ Rationale:
 
 ## Validation Done
 
-The release build was stress tested with capability KPMs covering:
+The x86_64 validation suite covers:
 
 1. Basic KPM ABI (`load`, `info`, `control`, `unload`).
 2. Hotpatch and function pointer hook capability checks.
 3. Inline hook install, trampoline call and restore checks.
 4. `hook_wrap` and `fp_hook_wrap` checks for argument counts up to 12.
 5. x86_64 instruction relocation cases including RIP relative MOV / LEA, ENDBR64, 10 byte `movabs`, refusal of `call rel32` and short branches in the prologue.
 6. Malformed `.kpm.info` rejection.
-7. Unsupported syscall hook rejection.
+7. Native syscall wrapper load/unload and compat syscall rejection.
 8. Hook ownership tagging from a `.kpm.ctl0` callback.
 9. `500` loops across `5` capability modules, for `2500` total load / control / unload cycles.
 10. Final `kpm num = 0`.
 11. Kernel log clean for `BUG`, `WARNING`, `Oops`, general protection faults, invalid opcode reports and use after free reports.
 
-The current local known-good row is WSA package `2407.40000.4.0` on Windows build `26200` with Memory Integrity enabled. Kernel `#30` (`037b9507707bffca33c56cc421b5ff7085f8ec8b8f3d2abedb93072bdadfae46`) passed:
+The current local known-good row is WSA package `2407.40000.4.0` on Windows build `26200` with Memory Integrity enabled. Kernel `#36` (`f6c7694e5d1c04f063ba6229ddf190634664c62b1fe6c62fbe6c6ec625819af1`) passed with loader `ReSukiSU-x86_64-KPM-loader/0.21`:
 
 ```bash
 cd KernelSU
 RUN_WSA=1 ADB="/mnt/d/Programy/Path Tools/adb.exe" ADB_TARGET=127.0.0.1:58526 \
+  KSUD=/data/local/tmp/ksud.kpm-capable REMOTE_DIR=/data/local/tmp/kpm-test CONTROL_LOOPS=20 \
   bash scripts/kpm-x86-preflight.sh
 cd ..
 ADB="/mnt/d/Programy/Path Tools/adb.exe" ADB_TARGET=127.0.0.1:58526 \

docs/KPM_PORT.md

@@ -6,9 +6,9 @@ WSA is now an archive-style target: Microsoft archived the public WSA app reposi
 
 | WSA package/build | Windows build | Kernel base | HVCI / Memory Integrity | Manager / libksud.so | KPM status | Notes |
 | --- | ---: | --- | --- | --- | --- | --- |
-| `D:\WSA` local install `2026-04-28` | `26200` | 5.15.104 | on | installed `/data/adb/ksud` is old and lacks `kpm`; temporary `/data/local/tmp/ksud.kpm-capable` SHA256 `68368b32b98adb6ffb2164c6551e0684c2d193e35fbde196384f4948b89573bf` used for validation | kernel/KPM pass, installed userspace pending | `D:\WSA\Tools\kernel` replaced with kernel `#34`, SHA256 `c93249f528f515cc0d0cd2030e55791bf3c12bdc07a18748af645a4aefeeb50e`; backup saved as `D:\WSA\Tools\kernel.backup.20260427-235453`; `uname -a` reported `#34 SMP PREEMPT Mon Apr 27 23:23:45 CEST 2026`; `RUN_WSA=1 KSUD=/data/local/tmp/ksud.kpm-capable REMOTE_DIR=/data/local/tmp/kpm-test bash KernelSU/scripts/kpm-x86-preflight.sh` passed with final `modules=0` and clean dmesg scan. |
+| `D:\WSA` local install `2026-04-28` | `26200` | 5.15.104 | on | installed `/data/adb/ksud` is old and lacks `kpm`; temporary `/data/local/tmp/ksud.kpm-capable` SHA256 `3f94c8ffaa8e2d030a18f6fc72819dd34ef5c625be31d1c2dcadb672d6f4c833` used for validation | kernel/KPM pass, installed userspace pending | `D:\WSA\Tools\kernel` replaced with kernel `#36`, SHA256 `f6c7694e5d1c04f063ba6229ddf190634664c62b1fe6c62fbe6c6ec625819af1`; backup saved as `D:\WSA\Tools\kernel.backup.20260428-112330`; `uname -a` reported `#36 SMP PREEMPT Tue Apr 28 11:21:24 CEST 2026`; `RUN_WSA=1 KSUD=/data/local/tmp/ksud.kpm-capable REMOTE_DIR=/data/local/tmp/kpm-test CONTROL_LOOPS=20 bash KernelSU/scripts/kpm-x86-preflight.sh` passed with native `syscall_wrap`, final `modules=0` and clean dmesg scan; `scripts/wsa-kpm-boot-smoke.sh LOOPS=5` also passed. |
 | booted local WSA before replacement `2026-04-27` | `26200` | 5.15.104 | on | installed `/data/adb/ksud` lacks `kpm` subcommand | blocked-userspace | ADB connected to `127.0.0.1:58526`; `uname -a` reported kernel `#28` with `WSA-ReSukiSU+`; `scripts/wsa-check-runtime-ksud.sh` and `KernelSU/scripts/kpm-x86-runtime-selftest.sh` stopped with a clear Manager/libksud mismatch before loading KPMs. |
-| local main build `2026-04-27` | `26200` | 5.15.104 | on | release `ksud` SHA256 `68368b32b98adb6ffb2164c6551e0684c2d193e35fbde196384f4948b89573bf`, guard pass | build pass, live pass with temporary `ksud` | Kernel `#34`, SHA256 `c93249f528f515cc0d0cd2030e55791bf3c12bdc07a18748af645a4aefeeb50e`; sidecar manifest verifies the current WSA commit, ReSukiSU submodule, helper script hashes and artifact SHA; host preflight and live WSA preflight passed. |
+| local main build `2026-04-28` | `26200` | 5.15.104 | on | release `ksud` SHA256 `3f94c8ffaa8e2d030a18f6fc72819dd34ef5c625be31d1c2dcadb672d6f4c833`, guard pass | build pass, live pass with temporary `ksud` | Kernel `#36`, SHA256 `f6c7694e5d1c04f063ba6229ddf190634664c62b1fe6c62fbe6c6ec625819af1`; sidecar manifest records WSA commit `fb64860b3e8e`, ReSukiSU submodule `b7b1e740195d`, loader `0.21`, helper script hashes and artifact SHA; host preflight, live WSA preflight and boot smoke passed. |
 | `MicrosoftCorporationII.WindowsSubsystemForAndroid_2407.40000.4.0_x64__8wekyb3d8bbwe` | `26200` | 5.15.104 | on | release `ksud` SHA256 `68368b32b98adb6ffb2164c6551e0684c2d193e35fbde196384f4948b89573bf` | pass | Validated locally with kernel `#30`, SHA256 `037b9507707bffca33c56cc421b5ff7085f8ec8b8f3d2abedb93072bdadfae46`, `scripts/kpm-x86-preflight.sh RUN_WSA=1` and `scripts/wsa-kpm-boot-smoke.sh`. |
 | 2407-style known-good local package | record exact package version | 5.15.104 | off | x86_64 KPM-capable ReSukiSU Manager | expected pass | Same package family as the validated HVCI-on row; validate separately before release claims. |
 | Store-updated or unknown WSA package | unknown | unknown | any | unknown | unsupported | Capture package SHA/build before debugging. |