On 10/16/2026 10:08 AM, Brian Cain wrote:
> The frame that allocframe pushes is {LR, FP}, and what is scrambled is
> the LR word: FRAMEKEY is XOR'd into the upper 32 bits. The generated
> code for fFRAME_SCRAMBLE built the key from FRAMEKEY in both halves of
> a 64-bit value, so it scrambled FP as well. deallocframe and
> dealloc_return only undo the upper word, so a FP restored from a frame
> pushed with a non-zero FRAMEKEY was corrupt.
>
> Uncovered by testing some boot images using QuRT.
>
> Signed-off-by: Brian Cain <[email protected]>
> ---
> target/hexagon/idef-parser/parser-helpers.c | 2 +-
> tests/tcg/hexagon/framekey.c | 67 +++++++++++++++++++++
> tests/tcg/hexagon/meson.build | 1 +
> 3 files changed, 69 insertions(+), 1 deletion(-)
> create mode 100644 tests/tcg/hexagon/framekey.c
>
Reviewed-by: Pierrick Bouvier <[email protected]>
