Restore original sysnum in unmodifiable-sysnum workaround

[Ebola-Chan-bot]

Fixes tracee death (SIGSEGV) on kernels that both (a) reject modification of the syscall-number register via ptrace and (b) treat a restart with the syscall-number register set to PR_void (-1 on arm64, i.e. x8 = -1) as a fatal non-standard signal-delivery event. Also avoids a guaranteed-failing ptrace call on every intercepted syscall under the same kernel.

Background

When PRoot decides to suppress a syscall (turn it into a no-op whose return value it will later override at sysexit), it rewrites the syscall-number register to PR_void. On arm64 this requires PTRACE_SETREGSET(..., NT_ARM_SYSTEM_CALL, ...) because the regular general-register push does not carry the syscall number. Some kernels — notably certain vendor-modified arm64 kernels — do not accept writes to NT_ARM_SYSTEM_CALL and return EINVAL. PRoot detects this and falls back to a workaround that still tries to make the syscall fail inside the kernel by poisoning its argument registers, then relies on sysexit to substitute the real error code.

The legacy workaround kept the syscall-number register at PR_void (-1) and poked all six arg registers to -1, expecting the kernel to simply reject the illegal syscall number with ENOSYS. On affected kernels this expectation is wrong: restarting with the syscall-number register set to -1 triggers a non-standard signal-delivery path that synthesizes a SIGSEGV and kills the tracee before it executes a single user-mode instruction.

Changes

src/syscall/syscall.c — unmodifiable-sysnum workaround

Net behaviour change:

• Restore the original syscall number before re-pushing the general register state. With the syscall-number register back to the original value (not PR_void), the kernel actually runs the rejected syscall. Combined with every argument register set to -1, the overwhelming majority of side-effectful syscalls fail inside the kernel at the parameter-validation stage (EBADF / EFAULT / EINVAL). sysexit still overrides the return-value register with the real error code PRoot intended, so upper-layer semantics are preserved.
• Remove the PR_brk special case that forced SYSARG_1 = 0. This was a defensive workaround against a non-compliant kernel mishandling brk(-1). With the syscall number now explicitly restored and POSIX brk(addr) returning the current break without mutation when addr is out of range, the extra arg-0 poke is unnecessary and was removed to keep the fallback path uniform across syscalls.

src/tracee/reg.c — cache NT_ARM_SYSTEM_CALL availability

NT_ARM_SYSTEM_CALL acceptance is a kernel-global property. Once the running kernel rejects it with EINVAL, it will never succeed for the lifetime of that kernel. Without a cache, every intercepted syscall that needs sysnum modification pays the cost of a guaranteed-failing ptrace call before hitting the workaround.

Implementation:

• A process-local static bool sysnum_regset_unavailable inside push_specific_regs() records the capability.
• First PTRACE_SETREGSET(NT_ARM_SYSTEM_CALL) returning EINVAL sets the flag. Subsequent calls that would require sysnum modification short-circuit with errno = EINVAL; return -1;, so the existing caller (syscall.c:translate_syscall) hits its workaround path immediately.
• Only EINVAL is cached. ESRCH / EPERM / EFAULT are per-tracee state errors (tracee exited, wrong ptrace state, bad buffer) and are not treated as kernel-capability signals. Caching them would incorrectly disable the regset for unaffected tracees.
• Memory-only, not persisted. A new proot run always re-probes. This keeps behaviour correct across reboots, kernel upgrades, or chroots into different kernels, at the cost of one failing ptrace per proot start on affected kernels — negligible compared to proot's baseline ptrace volume.
• Scope is deliberately process-global (function-static) rather than per-tracee: all tracees share the same running kernel, so a per-tracee flag would re-probe uselessly on every new child.

[Copilot]

Pull request overview

Updates the “unmodifiable syscall-number” fallback logic so that when the kernel refuses syscall-number modification, PRoot restores the original syscall number before re-pushing registers while still poisoning the syscall arguments to force an in-kernel failure, and removes the brk-specific argument override.

Changes:

• Restore original syscall number before re-pushing registers in the sysnum-unmodifiable workaround path.
• Keep poisoning all six syscall argument registers to -1 to induce a natural kernel-side failure.
• Remove the brk() special-case that forced SYSARG_1=0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.