Address Copilot review on PR termux#348 and cache sysnum-regset availability

Two follow-ups to the unmodifiable-sysnum workaround:

1) Rewrite the workaround comment in src/syscall/syscall.c to reflect
   the real failure point. The previous wording blamed the NT_PRSTATUS
   push carrying x8=-1, but push_specific_regs() bails out earlier: on
   arm64 it returns as soon as PTRACE_SETREGSET(NT_ARM_SYSTEM_CALL)
   returns EINVAL, so the general-register push is never even
   attempted. The comment now describes the syscall-number regset /
   register in architecture-agnostic terms (x8/x0 references kept only
   as concrete arm64 examples inside the explanation) and records why
   a "known-unsafe syscall" guard proposed by the reviewer is not
   added: (a) the legacy "keep sysnum=PR_void" path is strictly worse
   on affected kernels because it causes SIGSEGV and kills the tracee;
   (b) poisoning all six arg registers to -1 already traps the vast
   majority of side-effectful syscalls at the kernel's
   parameter-validation stage; (c) we have no empirically grounded
   list of syscalls that both reach this suppression path and cause
   harmful side effects when invoked with poisoned args, so a
   speculative allow/deny list would be dead code. sysexit still
   overrides the return-value register with the real error code.

2) Cache NT_ARM_SYSTEM_CALL availability in src/tracee/reg.c. The
   regset is a kernel-global capability: once PTRACE_SETREGSET rejects
   it with EINVAL, it will never succeed under the same running
   kernel. A process-local static bool short-circuits subsequent
   requests so the caller hits its workaround path immediately,
   without paying the cost of a guaranteed-failing ptrace call on
   every intercepted syscall. Only EINVAL is cached; ESRCH/EPERM/
   EFAULT are per-tracee state errors and are not treated as kernel-
   capability signals. The cache is memory-only and not persisted, so
   a new proot run always re-probes — this keeps behaviour correct
   across reboots, kernel upgrades, or chroots into different
   kernels, at the cost of a single failing ptrace per proot start
   on affected kernels.

Author: 埃博拉酱

src/syscall/syscall.c

@@ -243,28 +243,48 @@ void translate_syscall(Tracee *tracee)
 				tracee->restart_how = PTRACE_SYSCALL;
 			}
 
-			/* Handle syscall rejection when sysnum can't be modified.
+			/* Handle syscall rejection when the syscall number can't be modified.
 			 *
-			 * Normal path: proot sets sysnum to PR_void so the kernel runs
-			 * a harmless no-op, then overrides x0 at sysexit with the real
-			 * error code. On some kernels the NT_ARM_SYSTEM_CALL regset is
-			 * absent, so the NT_PRSTATUS push carrying x8=-1 (PR_void) is
-			 * rejected with EINVAL and we land in this workaround branch.
+			 * Normal path: proot sets the syscall number to PR_void so the
+			 * kernel runs a harmless no-op, then overrides the return-value
+			 * register at sysexit with the real error code. On some kernels
+			 * the dedicated syscall-number regset is absent/refused (on
+			 * arm64 this is PTRACE_SETREGSET(NT_ARM_SYSTEM_CALL) returning
+			 * EINVAL; see push_specific_regs() in tracee/reg.c which bails
+			 * out before even attempting the general-register push), and
+			 * we land in this workaround branch.
 			 *
 			 * Legacy strategy was to poke all 6 syscall args to -1 and
-			 * re-push NT_PRSTATUS, keeping x8=-1 so the kernel still saw
-			 * an illegal sysnum and rejected the call with ENOSYS. That
-			 * works on stock kernels, but on some kernels x8=-1 on restart
-			 * triggers a non-standard signal delivery path that
-			 * synthesizes a SIGSEGV and kills the tracee before it
-			 * executes a single user-mode instruction.
+			 * re-push the general register state while keeping the syscall
+			 * number set to PR_void, so the kernel still saw an illegal
+			 * syscall number and rejected the call with ENOSYS. That works
+			 * on stock kernels, but on some kernels restarting with the
+			 * syscall-number register set to PR_void triggers a
+			 * non-standard signal delivery path that synthesizes a SIGSEGV
+			 * and kills the tracee before it executes a single user-mode
+			 * instruction.
 			 *
-			 * Correct strategy: restore x8 to the original sysnum so the
+			 * Correct strategy: restore the original syscall number so the
 			 * kernel actually runs the rejected syscall, and poke all 6
 			 * args to -1 so the syscall fails naturally inside the kernel
-			 * (EFAULT/EBADF/EINVAL). The real error code is written to x0
-			 * by proot at sysexit. */
-			poke_reg(tracee, SYSARG_NUM, orig_sysnum); /* restore sysnum; x8=-1 triggers non-standard signal path on some kernels */
+			 * (EFAULT/EBADF/EINVAL). The real error code is written to the
+			 * return-value register by proot at sysexit.
+			 *
+			 * Known limitation:
+			 * syscalls that ignore arguments (e.g. getpid/sync) or take
+			 * fewer than 6 args will not necessarily fail inside the
+			 * kernel, so they will actually execute with whatever state
+			 * the tracee already has. We accept this: (a) the legacy
+			 * "keep sysnum=PR_void" path is strictly worse on affected
+			 * kernels — it kills the tracee with SIGSEGV; (b) -1 in every
+			 * arg slot already traps the overwhelming majority of
+			 * side-effectful syscalls at the kernel's parameter-validation
+			 * stage (EBADF/EFAULT/EINVAL); (c) we have no empirically
+			 * grounded list of syscalls that both reach this suppression
+			 * path and cause harmful side effects when run with poisoned
+			 * args, so a speculative allow/deny list would be dead code.
+			 * The real return value is still overridden at sysexit. */
+			poke_reg(tracee, SYSARG_NUM, orig_sysnum); /* restore original sysnum; PR_void in the syscall-number register triggers a non-standard SIGSEGV path on some kernels */
 			poke_reg(tracee, SYSARG_1, -1);
 			poke_reg(tracee, SYSARG_2, -1);
 			poke_reg(tracee, SYSARG_3, -1);

src/tracee/reg.c

@@ -332,12 +332,30 @@ int push_specific_regs(Tracee *tracee, bool including_sysnum)
 
 		/* Update syscall number if needed.  On arm64, a new
 		 * subcommand has been added to PTRACE_{S,G}ETREGSET
-		 * to allow write/read of current sycall number.  */
+		 * to allow write/read of current sycall number.
+		 *
+		 * Kernel-capability cache: NT_ARM_SYSTEM_CALL is a
+		 * kernel-global feature — if it is rejected once with
+		 * EINVAL, it will never succeed under the same running
+		 * kernel. We short-circuit subsequent requests so the
+		 * caller (see syscall.c unmodifiable-sysnum workaround)
+		 * hits its fallback path immediately without paying the
+		 * cost of a guaranteed-failing ptrace on every intercepted
+		 * syscall. Only EINVAL is cached: ESRCH/EPERM/EFAULT are
+		 * per-tracee state issues, not kernel capability. Memory
+		 * only (not persisted); a new proot run re-probes. */
+		static bool sysnum_regset_unavailable = false;
 		if (including_sysnum && current_sysnum != REG(tracee, ORIGINAL, SYSARG_NUM)) {
+			if (sysnum_regset_unavailable) {
+				errno = EINVAL;
+				return -1;
+			}
 			regs.iov_base = &current_sysnum;
 			regs.iov_len = sizeof(current_sysnum);
 			status = ptrace(PTRACE_SETREGSET, tracee->pid, NT_ARM_SYSTEM_CALL, &regs);
 			if (status < 0) {
+				if (errno == EINVAL)
+					sysnum_regset_unavailable = true;
 				//note(tracee, WARNING, SYSTEM, "can't set the syscall number");
 				return status;
 			}