From 93a2c4d2ebad80c46fd6aefd67c104503e23286c Mon Sep 17 00:00:00 2001 From: buxiasen Date: Tue, 7 Apr 2026 16:55:01 +0800 Subject: [PATCH] arch/arm/arm_dispatch_syscall: fix callee-saved reg corruption in protected arm_dispatch_syscall in armv7-m clobbered r11 with 'mov r11, sp' and the user-space callee-saved register value leaked back through the exception frame when SYS_syscall_return restored the context, resulting in corrupted parameters on subsequent syscalls and system hangs in protected builds. In armv6-m, r4 was used to load g_stublookup (Thumb-1 cannot use ip for indexed addressing) but was not restored before SYS_syscall_return, causing the same class of register corruption. Fix with minimal changes: - armv7-m: remove 'mov r11, sp' to stop clobbering user r11 - armv6-m: restore r4 from the stack frame before SYS_syscall_return Signed-off-by: buxiasen --- arch/arm/src/armv6-m/arm_dispatch_syscall.S | 1 + arch/arm/src/armv7-m/arm_dispatch_syscall.S | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm/src/armv6-m/arm_dispatch_syscall.S b/arch/arm/src/armv6-m/arm_dispatch_syscall.S index 20b341477ab..9d1d73c1ce8 100644 --- a/arch/arm/src/armv6-m/arm_dispatch_syscall.S +++ b/arch/arm/src/armv6-m/arm_dispatch_syscall.S @@ -89,6 +89,7 @@ arm_dispatch_syscall: lsl r0, r0, #2 /* R0=Offset of the stub for this syscall */ ldr r4, [r4, r0] /* R4=Address of the stub for this syscall */ blx r4 /* Call the stub (modifies lr) */ + ldr r4, [sp, #0] /* Restore r4 */ add sp, sp, #32 /* Destroy the stack frame */ mov r2, r0 /* R2=Save return value in R2 */ mov r0, SYS_syscall_return /* R0=SYS_syscall_return */ diff --git a/arch/arm/src/armv7-m/arm_dispatch_syscall.S b/arch/arm/src/armv7-m/arm_dispatch_syscall.S index fcc87656420..6b2b88bfd5f 100644 --- a/arch/arm/src/armv7-m/arm_dispatch_syscall.S +++ b/arch/arm/src/armv7-m/arm_dispatch_syscall.S @@ -78,9 +78,8 @@ arm_dispatch_syscall: .cfi_sections .debug_frame .cfi_startproc - mov r11, sp - .cfi_register sp, r11 sub sp, sp, #32 + .cfi_def_cfa_offset 32 str r4, [sp, #0] .cfi_offset r4, 0 str r5, [sp, #4]