fw/syscall: run syscalls on the dedicated stack on ARMv7-M too

be4d98d gave App/Worker syscalls their own 2 KiB privileged stack but
only on ARMv8-M, because the relocation bounded that stack with PSPLIM.
ARMv7-M apps kept running the whole privileged call chain on their 2 KiB
task stack, and asterix reboots with StackOverflow / HardFault when a
text-heavy watchface renders a glyph that misses the cache: text layout
-> text_resources -> sys_resource_load_range -> resource_storage ->
pfs_open -> FTL -> flash consumes ~1.3 KB on top of whatever the app
already used, and the overflow happens privileged, so the kernel cannot
recover and resets.

Enable the relocation everywhere. The kernel side already handles the
missing PSPLIM; on ARMv7-M the syscall stacks get a 32 B no-access MPU
region below them instead, programmed through the free fourth per-task
slot (MemoryRegion_Task4). The fault handler treats a hit in that region
like the other stack guards, so a genuine kernel-side over-budget still
reboots with StackOverflow, while an app that runs out of its own stack
now faults unprivileged and is killed.

Verified on qemu_flint with a stress app that burns N bytes of stack and
then draws text in a custom font: with the guard alone, 512 B of extra
app usage reboots the emulator (the device failure mode); with this
change the same load succeeds (app peak 1968/2016 B, syscall stack peak
608 B) and 768 B only kills the app. WeatherGraph from the app store runs
unchanged.

Fixes FIRM-4306

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Gerard Marull-Paretas <gerard@teslabs.com>

Author: gmarull

src/fw/kernel/fault_handling.c

@@ -19,6 +19,7 @@
 #include "process_state/worker_state/worker_state.h"
 #include "syscall/syscall.h"
 #include "syscall/syscall_internal.h"
+#include "pbl/util/size.h"
 #include <pbl/logging/logging.h>
 #include "system/reboot_reason.h"
 #include "syscall/syscall.h"
@@ -335,13 +336,17 @@ static void mem_manage_handler_c(unsigned int* stacked_args, unsigned int lr) {
   const uint8_t mmfsr = cfsr & 0xff;
   if (mmfsr & (1 << 7)) {
     uint32_t fault_addr = SCB->MMFAR;
-    MpuRegion mpu_region = mpu_get_region(MemoryRegion_IsrStackGuard);
-    if (memory_layout_is_pointer_in_region(&mpu_region, (void *)fault_addr)) {
-      stack_overflow = true;
-    } else {
-      mpu_region = mpu_get_region(MemoryRegion_TaskStackGuard);
-      if (memory_layout_is_pointer_in_region(&mpu_region, (void *)fault_addr)) {
+    static const uint8_t s_guard_regions[] = {
+      MemoryRegion_IsrStackGuard,
+      MemoryRegion_TaskStackGuard,
+      MemoryRegion_Task4,  // syscall stack guard, when the task has one
+    };
+    for (unsigned int i = 0; i < ARRAY_LENGTH(s_guard_regions); i++) {
+      MpuRegion mpu_region = mpu_get_region(s_guard_regions[i]);
+      if (mpu_region.enabled &&
+          memory_layout_is_pointer_in_region(&mpu_region, (void *)fault_addr)) {
         stack_overflow = true;
+        break;
       }
     }
   }

src/fw/kernel/pebble_tasks.c

@@ -295,7 +295,7 @@ struct pbl_thread *pebble_task_create(PebbleTask pebble_task, struct pbl_thread_
   attr->regions[0] = &app_region;
   attr->regions[1] = &worker_region;
   attr->regions[2] = stack_guard_region;
-  attr->regions[3] = NULL;
+  attr->regions[3] = syscall_get_stack_guard_region(pebble_task);
 
   struct pbl_thread *thread = &s_threads[pebble_task];
   PBL_ASSERT(pbl_thread_create(thread, attr) == 0, "Could not start task %s", attr->name);

src/fw/syscall/syscall_internal.c

@@ -5,6 +5,7 @@
 #include "syscall_internal.h"
 
 #include "applib/app_logging.h"
+#include "kernel/memory_layout.h"
 #include "kernel/pebble_tasks.h"
 #include "pbl/mcu/privilege.h"
 #include "process_management/app_manager.h"
@@ -22,13 +23,10 @@
 // Run App/Worker syscalls on a dedicated privileged stack instead of the
 // caller's small unprivileged one, so a task that exhausts its stack faults
 // unprivileged (only that process dies) instead of rebooting the system.
-// Enabled on ARMv8-M (needs PSPLIM); ARMv7-M keeps the old behaviour.
+// ARMv8-M bounds the syscall stack with PSPLIM; ARMv7-M plants a no-access
+// MPU guard below it (MemoryRegion_Task4, see pebble_tasks.c).
 #if !defined(SYSCALL_PRIVILEGED_STACK)
-#  if defined(CONFIG_MPU_TYPE_ARMV8M)
-#    define SYSCALL_PRIVILEGED_STACK 1
-#  else
-#    define SYSCALL_PRIVILEGED_STACK 0
-#  endif
+#  define SYSCALL_PRIVILEGED_STACK 1
 #endif
 
 // Per-thread slots for the syscall return address and pre-syscall stack pointer
@@ -277,8 +275,57 @@ void syscall_assert_userspace_buffer(const void* buf, size_t num_bytes) {
 // in the privileged-only .kernel_bss output (RAM): unreadable by app
 // code, zeroed at boot. (Not section(".kernel_bss") -- that would orphan them.)
 #define SYSCALL_STACK_WORDS 512u  // 2 KiB each; size against measured high-water.
-static uint32_t s_app_syscall_stack[SYSCALL_STACK_WORDS] __attribute__((aligned(8)));
-static uint32_t s_worker_syscall_stack[SYSCALL_STACK_WORDS] __attribute__((aligned(8)));
+#ifdef CONFIG_MPU_TYPE_ARMV8M
+#define SYSCALL_STACK_GUARD_WORDS 0u
+#else
+#define SYSCALL_STACK_GUARD_WORDS 8u  // smallest ARMv7-M MPU region, naturally aligned
+#endif
+
+typedef struct SyscallStack {
+#if SYSCALL_STACK_GUARD_WORDS
+  uint32_t guard[SYSCALL_STACK_GUARD_WORDS];
+#endif
+  uint32_t words[SYSCALL_STACK_WORDS];
+} SyscallStack;
+
+static SyscallStack s_app_syscall_stack __attribute__((aligned(32)));
+static SyscallStack s_worker_syscall_stack __attribute__((aligned(32)));
+
+#if SYSCALL_STACK_GUARD_WORDS
+static const MpuRegion s_app_syscall_stack_guard_region = {
+  .region_num = MemoryRegion_Task4,
+  .enabled = true,
+  .base_address = (uintptr_t)s_app_syscall_stack.guard,
+  .size = sizeof(s_app_syscall_stack.guard),
+  .cache_policy = MpuCachePolicy_NotCacheable,
+  .permissions = MpuPermissions_NoAccess,
+};
+
+static const MpuRegion s_worker_syscall_stack_guard_region = {
+  .region_num = MemoryRegion_Task4,
+  .enabled = true,
+  .base_address = (uintptr_t)s_worker_syscall_stack.guard,
+  .size = sizeof(s_worker_syscall_stack.guard),
+  .cache_policy = MpuCachePolicy_NotCacheable,
+  .permissions = MpuPermissions_NoAccess,
+};
+#endif
+
+const MpuRegion *syscall_get_stack_guard_region(PebbleTask task) {
+#if SYSCALL_STACK_GUARD_WORDS
+  switch (task) {
+    case PebbleTask_App:
+      return &s_app_syscall_stack_guard_region;
+    case PebbleTask_Worker:
+      return &s_worker_syscall_stack_guard_region;
+    default:
+      break;
+  }
+#else
+  (void)task;
+#endif
+  return NULL;
+}
 
 // Kernel hook: top of the current task's dedicated syscall stack (base in
 // *base_out), or NULL to keep it on the caller's stack. App + Worker only;
@@ -295,10 +342,10 @@ uint32_t *pbl_kernel_syscall_stack(uintptr_t *base_out) {
         }
       }
 #endif
-      stack = s_app_syscall_stack;
+      stack = s_app_syscall_stack.words;
       break;
     case PebbleTask_Worker:
-      stack = s_worker_syscall_stack;
+      stack = s_worker_syscall_stack.words;
       break;
     default:
       return NULL;
@@ -315,8 +362,8 @@ static bool prv_psp_in_syscall_stack(uintptr_t psp, const uint32_t *stack) {
 // packed as (psplim << 32 | sp) to return in r0:r1; 0 = no switch needed.
 USED uint64_t syscall_stack_restore_target(void) {
   const uintptr_t psp = __get_PSP();
-  if (prv_psp_in_syscall_stack(psp, s_app_syscall_stack) ||
-      prv_psp_in_syscall_stack(psp, s_worker_syscall_stack)) {
+  if (prv_psp_in_syscall_stack(psp, s_app_syscall_stack.words) ||
+      prv_psp_in_syscall_stack(psp, s_worker_syscall_stack.words)) {
     const uint32_t sp = (uint32_t)prv_get_syscall_sp();  // slot1 = pre-syscall task SP
     struct pbl_thread_stack_info info;
     pbl_thread_stack_info(pbl_thread_current(), &info);
@@ -337,11 +384,11 @@ static uint16_t prv_syscall_stack_free_bytes(const uint32_t *stack) {
 }
 
 uint16_t syscall_app_stack_free_bytes(void) {
-  return prv_syscall_stack_free_bytes(s_app_syscall_stack);
+  return prv_syscall_stack_free_bytes(s_app_syscall_stack.words);
 }
 
 uint16_t syscall_worker_stack_free_bytes(void) {
-  return prv_syscall_stack_free_bytes(s_worker_syscall_stack);
+  return prv_syscall_stack_free_bytes(s_worker_syscall_stack.words);
 }
 
 // Drop privilege and return to the task. If the syscall ran on a dedicated
@@ -360,7 +407,9 @@ EXTERNALLY_VISIBLE void NAKED_FUNC USED prv_drop_privilege(void) {
     " pop {r0, r1} \n"                         // r0,r1 = syscall return value
     " cbz r2, 1f \n"                           // skip stack switch if not relocated
     " msr psp, r2 \n"                          // back to the app stack (higher addr; safe vs low limit)
+#ifdef CONFIG_MPU_TYPE_ARMV8M
     " msr psplim, r3 \n"                       // restore the app stack limit
+#endif
     " isb \n"
     "1: \n"
     " mrs r2, control \n"                      // drop privilege: CONTROL.nPRIV = 1
@@ -371,6 +420,10 @@ EXTERNALLY_VISIBLE void NAKED_FUNC USED prv_drop_privilege(void) {
   );
 }
 #else
+const MpuRegion *syscall_get_stack_guard_region(PebbleTask task) {
+  (void)task;
+  return NULL;
+}
 uint16_t syscall_app_stack_free_bytes(void) { return 0xFFFF; }
 uint16_t syscall_worker_stack_free_bytes(void) { return 0xFFFF; }
 

src/fw/syscall/syscall_internal.h

@@ -3,8 +3,11 @@
 
 #pragma once
 
+#include "kernel/pebble_tasks.h"
 #include "pbl/util/attributes.h"
 
+#include <pbl/drivers/mpu.h>
+
 #include <stdbool.h>
 #include <stdint.h>
 #include <stddef.h>
@@ -59,6 +62,10 @@ bool mcu_call_unprivileged_reentry_setup(uintptr_t orig_sp, uintptr_t *lr_ptr);
 uint16_t syscall_app_stack_free_bytes(void);
 uint16_t syscall_worker_stack_free_bytes(void);
 
+//! No-access MPU region guarding the bottom of @p task's syscall stack, or
+//! NULL when the platform bounds it some other way (PSPLIM) or has none.
+const MpuRegion *syscall_get_stack_guard_region(PebbleTask task);
+
 // Test overrides.
 // TODO: really implement privilege escalation in unit tests. See PBL-9688
 #if defined(UNITTEST)