diff --git a/src/copro-65tubeasm.S b/src/copro-65tubeasm.S
index 525e4353..1d7f2470 100644
--- a/src/copro-65tubeasm.S
+++ b/src/copro-65tubeasm.S
@@ -346,9 +346,9 @@
         push    {temp2}
         orr     temp2, temp2, #ARM_INT_MASK
         msr     CPSR_c, temp2
-        push    {r3-r12}
+        push    {r2-r12}
         bl      copro_65tube_trace
-        pop     {r3-r12}
+        pop     {r2-r12}
         pop     {temp2}
         msr     CPSR, temp2
 .endm
@@ -3149,7 +3149,7 @@ timing_table:
 
 
 exec_65tube:
-        push    {r4-r11,lr}
+        push    {r4-r12,lr}
 #if defined(USE_MEMORY_POINTER)
         mov     memry, r0               // set memry (memry) to the 64K 6502 memory array
                                         // must be 64k aligned
@@ -3216,14 +3216,14 @@ exec_65tube_exit:                       // We get here from the Event handler wh
         ldrd  r2,old_irq_vector
         strd  r2,[r0]
 
-        pop     {r4-r11,pc}
+        pop     {r4-r12,pc}
 
 // ARM FIQ handler
 arm_fiq_handler_fast6502:
 
 #ifdef USE_DOORBELL
       ldrd     r10, doorbell_const      // Read the GPU doorbell
-      push     {r0-r3,r14}
+      push     {r0-r3,r12,r14}
 
       ldr      r1, [r10]               // Get Mailbox data
       ldr      r0, [r11]               // Get Mailbox data
@@ -3231,11 +3231,11 @@ arm_fiq_handler_fast6502:
 #else
       ldr      r10, =MBOX0_READ        // Read the GPU mailbox
 
-      push     {r0-r3,r14}
+      push     {r0-r3,r12,r14}
       ldr      r0, [r10]               // Get Mailbox data
 
       tst      r0, #0x0F               // Discard if the channel bits are non-zero
-      popne    {r0-r3,r14}             // Clean up the stack
+      popne    {r0-r3,r12,r14}             // Clean up the stack
       subnes   pc, lr, #4              // And return without invoking the handler
 #endif
 
@@ -3244,7 +3244,7 @@ arm_fiq_handler_fast6502:
 
       ldr      r9,fiq_status
       ldr      r12,[r12]
-      pop      {r0-r3,r14}
+      pop      {r0-r3,r12,r14}
       tst      r9,#2
       tstne    r12,#RESET_BIT+NMI_BIT+IRQ_BIT
       orrne    instt, instt, #copro6502asm_instruction_size
@@ -3253,7 +3253,7 @@ arm_fiq_handler_fast6502:
 
 arm_irq_handler_fast6502:
         sub   lr, lr, #4
-        push  {r0, r1, r2, r3, r4, ip, lr}
+        push  {r0, r1, r2, r3, r4, r5, ip, lr}
         ldr   r4,fiq_status
         mov   r0,#0
         str   r0,fiq_status
@@ -3269,7 +3269,7 @@ arm_irq_handler_fast6502:
         tstne   r1,#RESET_BIT+NMI_BIT+IRQ_BIT
         orrne    instt, instt, #copro6502asm_instruction_size
 
-        ldm sp!, {r0, r1, r2, r3, r4, ip, pc}^
+        ldm sp!, {r0, r1, r2, r3, r4, r5, ip, pc}^
 
 lastPC:
    .word 0
@@ -3397,7 +3397,7 @@ execute_one_instruction:
 // Tube access handlers
 
 tube_load_handler_regA_flags:
-        push    {r3,next_instr,r12}
+        push    {r3,next_instr,r7,r12}
         mrs     next_instr, CPSR               // Save 6502 flags
 
         str     instt,fiq_status
@@ -3413,7 +3413,7 @@ tube_load_handler_regA_flags:
 
         sxtb    regA,operand
         msr     CPSR_f, next_instr
-        pop     {r3,next_instr,r12}
+        pop     {r3,next_instr,r7,r12}
         FLAGS_QUICK_FETCH012   regA
 
 tube_load_handler:
@@ -3458,7 +3458,7 @@ tube_load_handler_sign:
 tube_store_handler_regA:
         mov     temp1, regA
 tube_store_handler:
-        push    {r2-r3,r12}
+        push    {r2-r4,r12}
         and     r1, temp1, #0xff
 
         str     instt,fiq_status
@@ -3473,7 +3473,7 @@ tube_store_handler:
         orrne   instt, instt, #copro6502asm_instruction_size
 
 
-        pop     {r2-r3,r12}
+        pop     {r2-r4,r12}
         msr     CPSR_f, r2           // restore 6502 flags, including ARM
         FETCH_NEXT_STAGE_012
 
diff --git a/src/copro-armnativeasm.S b/src/copro-armnativeasm.S
index f96bd960..201474fa 100644
--- a/src/copro-armnativeasm.S
+++ b/src/copro-armnativeasm.S
@@ -125,7 +125,7 @@ copro_armnative_fiq_handler:
         ldr     r8, [r11]
 
         sub     lr, lr, #4
-        push    {r0-r3, lr}            // Save everything that is not shadowed
+        push    {r0-r4, lr}            // Save everything that is not shadowed
 
         mov     r0,r8
         bl      tube_io_handler        // Update the Tube ULA emulation
@@ -135,7 +135,7 @@ copro_armnative_fiq_handler:
 
         bl      copro_armnative_tube_interrupt_handler
 
-        ldm sp!, {r0, r1, r2, r3, pc}^ // Return from ISR
+        ldm sp!, {r0, r1, r2, r3, r4, pc}^ // Return from ISR
 
 #endif
 
@@ -161,15 +161,14 @@ _user_exec:
 
     // This must only be called from supervisor mode....
 
-    stmfd    sp!, {r0-r5, lr}     // r0 contains address of the code to execute in user mode
+    stmfd    sp!, {r0-r4, lr}     // r0 contains address of the code to execute in user mode
                                   // r1..r3 contain parameters, r4 is a scratch register
-                                  // r5 is pushed to maintain 8 byte stack alignment
 
     mov      r4, r0               // Save r0 into the scratch register
 
     mrs      r0, spsr             // Get spsr
-    stmfd    sp!, {r0}            // Save spsr, as this (and lr) will be corrupted by nested swis
-
+    stmfd    sp!, {r0, r1}        // Save spsr, as this (and lr) will be corrupted by nested swis
+                                  // r1 is pushed to maintain 8 byte stack alignment
 #if (__ARM_ARCH >= 7 )
     stmfd    sp!, {r0-r3}         // Save the _user_exec params
     bl       CleanDataCache
@@ -215,10 +214,10 @@ _user_exec:
 
     str      r0, [sp, #4]         // Save the exit code so it will end up back in r0
 
-    ldmfd    sp!, {r0}            // Get spsr from stack.
+    ldmfd    sp!, {r0,r1}         // Get spsr from stack.
     msr      spsr_c, r0           // Restore spsr.
 
-    ldmfd    sp!, {r0-r5, pc}     // Restore registers and return.
+    ldmfd    sp!, {r0-r4, pc}     // Restore registers and return.
 
 
     // Called with the error buffer pointer in R0, the last known value of R12 in R1 and the error handler address in R2
diff --git a/src/jit.S b/src/jit.S
index 09ef0f9a..e2181510 100644
--- a/src/jit.S
+++ b/src/jit.S
@@ -291,18 +291,18 @@ then return to our secret stack This relies on instructions being re entrant , b
 .if \reg==r0
    mrs   r1, CPSR               // Save 6502 flags
    CPSID if
-   push  {r1}
+   push  {r1,r2}
 .else
    mrs   r0, CPSR               // Save 6502 flags
    CPSID if
-   push  {r0}
+   push  {r0,r2}
 .endif
 
    mov   r0,\reg
    mov   r1,#\bits
    mov   r2,#00
    BL    dump_hex
-   pop   {r0}
+   pop   {r0,r2}
    msr   CPSR, r0
    pop   {r0-r3,r12,r14}
 .endm
@@ -311,10 +311,10 @@ then return to our secret stack This relies on instructions being re entrant , b
    push  {r0-r3,r12,r14}
    mrs   r0, CPSR               // Save 6502 flags
    CPSID if
-   push  {r0}
+   push  {r0,r1}
    mov   r0,#\char
    BL    RPI_AuxMiniUartWrite
-   pop    {r0}
+   pop    {r0,r1}
    msr   CPSR, r0
    pop   {r0-r3,r12,r14}
 .endm
@@ -1834,7 +1834,7 @@ opc_FE: // Opcode FE - INC $0000,X
 // **********************************************
 
 setupjitram:
-   push  {r0,r1,r2,r3,r4,r5,r6,r12,r14}
+   push  {r0-r7,r12,r14}
 // setup table JITLET ( 64K x bl JITLET)
 // setup JITTEDTABLE16 with 64K x mov pc,r14
    ldr   temp2,=dojit-JITLET-8
@@ -1927,7 +1927,7 @@ cacheflushloopjittable:
    MCR   p15, 0, temp, c7, c10, 0 //; clean data cache
    MCR   p15, 0, temp, c7, c5, 0 //; invalidate I cache & BTB
 #endif
-   pop  {r0,r1,r2,r3,r4,r5,r6,r12,pc}
+   pop  {r0-r7,r12,pc}
 
 
 // **********************************************
@@ -1937,7 +1937,7 @@ cacheflushloopjittable:
 // R0 Points to memory
 
 exec_65tubejit:
-   push  {r4-r11,lr}
+   push  {r4-r12,lr}
    mov   ram6502,r0  // this is assumed to be zero
 
 // setup ARM cycle counter
@@ -2037,7 +2037,7 @@ reset_handler_jit:
    CPSIE if
 
    ldr   r13,stackptr  // Hack to ensure the stack ptr is on the right place
-   pop   {r4-r11,pc}
+   pop   {r4-r12,pc}
 
 .ltorg
    .align 3
@@ -2082,18 +2082,18 @@ CACHELINE_ALIGN = 5
 arm_fiq_handler_jit:
 #ifdef USE_DOORBELL
    ldrd     r10, doorbell_const      // Read the GPU doorbell
-   push  {r0-r3,r14}
+   push  {r0-r4,r14}
    ldr   r1, [r10]               // read doorbell
 #else
    ldr   r11, =MBOX0_READ        // Read the GPU mailbox
-   push  {r0-r3,r14}
+   push  {r0-r4,r14}
 
 #endif
    ldr   r0, [r11]               // Get data
    ldr   r10, =tube_irq
    BL    tube_io_handler
    ldr   r12,[r10]
-   pop   {r0-r3,r14}
+   pop   {r0-r4,r14}
    tst   r12,#RESET_BIT+NMI_BIT+IRQ_BIT
    subeqs pc, lr, #4
 
@@ -2328,7 +2328,7 @@ dojit:
    mrs   r4, CPSR                   // Save interrupt state (restored by dojitexit)
 
    sub   r3,r14,#4                  // return address ( first address of jitted code)
-   push  {r3-r11}
+   push  {r3-r12}
 #ifdef DEBUG_TIMING
       ldr     r8, =ASS_GPSET0     // timing debug code
       mov     r7, #TEST2_MASK
@@ -3159,7 +3159,7 @@ cacheflushloopI:
         mov     r7, #TEST2_MASK
         str     r7, [r8]
 #endif
-   pop {r3-r11}
+   pop {r3-r12}
 #if __ARM_ARCH>6
    PLI   [r3]
 #endif