Re: [PATCH] csky: Fix a4/a5 restoration in syscall trace path

[Guo Ren]

On Thu, May 21, 2026 at 6:00 PM hlsong <pgeorge8929@xxxxxxxxx> wrote:
>
> From: hlsong89 <pgeorge8929@xxxxxxxxx>
>
> The syscall trace path reloads syscall arguments from pt_regs before
> calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall
> arguments are prepared as stack arguments before invoking syscallid.
>
> The current code adjusts sp before loading LSAVE_A4 and LSAVE_A5. Since
> those offsets are relative to the original pt_regs base, loading them
> after changing sp fetches the wrong slots. As a result, traced syscalls
> that use the 5th or 6th argument may receive corrupted arguments.
>
> This is visible with mmap2(), which takes six arguments. A small
> PTRACE_SYSCALL reproducer opens a file and maps one page with:
>
>   mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)
>
> Before the fix, the traced child fails the mmap and exits with 12.
> After the fix, the mapping succeeds and the child exits with 0.
>
> Fix the trace path by using the correct pt_regs offsets after adjusting sp.
>
> Tested on: ck860f, linux-4.19.15, C-SKY abiv2
>
> Signed-off-by: hlsong89 <pgeorge8929@xxxxxxxxx>
> ---
>  arch/csky/kernel/entry.S | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/csky/kernel/entry.S b/arch/csky/kernel/entry.S
> index c68cdcc76..98692fc78 100644
> --- a/arch/csky/kernel/entry.S
> +++ b/arch/csky/kernel/entry.S
> @@ -94,9 +94,9 @@ csky_syscall_trace:
>         ldw     a3, (sp, LSAVE_A3)
>  #if defined(__CSKYABIV2__)
>         subi    sp, 8
> -       ldw     r9, (sp, LSAVE_A4)
> +       ldw     r9, (sp, LSAVE_A4 + 8)
>         stw     r9, (sp, 0x0)
> -       ldw     r9, (sp, LSAVE_A5)
> +       ldw     r9, (sp, LSAVE_A5 + 8)
>         stw     r9, (sp, 0x4)
>         jsr     syscallid                     /* Do system call */
>         addi    sp, 8
> --
> 2.25.1
>

Thx for the fixup, but "LSAVE_A4 + 8" is really confusing for read. How about:

diff --git a/arch/csky/kernel/entry.S b/arch/csky/kernel/entry.S
index c68cdcc76d60..3261f46f2244 100644
--- a/arch/csky/kernel/entry.S
+++ b/arch/csky/kernel/entry.S
@@ -93,11 +93,11 @@ csky_syscall_trace:
        ldw     a2, (sp, LSAVE_A2)
        ldw     a3, (sp, LSAVE_A3)
 #if defined(__CSKYABIV2__)
-       subi    sp, 8
        ldw     r9, (sp, LSAVE_A4)
+       ldw     r10, (sp, LSAVE_A5)
+       subi    sp, 8
        stw     r9, (sp, 0x0)
-       ldw     r9, (sp, LSAVE_A5)
-       stw     r9, (sp, 0x4)
+       stw     r10, (sp, 0x4)
        jsr     syscallid                     /* Do system call */
        addi    sp, 8
 #else

-- 
Best Regards
 Guo Ren