From nobody Fri Oct 23 14:30:04 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792170576; cv=none; d=zohomail.com; s=zohoarc; b=Dws0MzTsADGjI3n3+Ma8qY+/LVZ4zTRk6w6uM4hdZEACzBEwfL5iZVzi0bHGOtxnLZ9tkxBZAVmgizL7iTIInLkY9rqav80zbYutnGeeD7MuAu62u36Mhdb67rkgrL8DC6YG/j3oPD78cgUxyN4XHlUjp3anJSh5UOXFYEPpLgQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792170576; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=sXXRvnZD3IL2PaUM+pAhcPoiorjQA0fKae720tcLKqc=; b=f8oIm66ZH6XlCXuBEtMeO5t3iKG0udCAJKIx/AuATcHq18a2CCBJeSz/L8jcnUFY2sm4ohiLkkddf5OTaa1tmYXr6gVrtnLhKE+/D++Z83fv/ZbjBsL7MLt4nWJCSnlm+ynQm5/SJypYJiyRZgQxHQ3EbbAANAzDtfhfGrq8PVE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179217057689049.48847972454564; Fri, 16 Oct 2026 10:09:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xHlQS-0003mX-RC; Fri, 16 Oct 2026 13:09:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHlQO-0003ky-QW for qemu-devel@nongnu.org; Fri, 16 Oct 2026 13:08:57 -0400 Received: from mx0b-0031df01.pphosted.com ([205.220.180.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHlQM-0006mR-K2 for qemu-devel@nongnu.org; Fri, 16 Oct 2026 13:08:56 -0400 Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69GE5qV01450473 for ; Fri, 16 Oct 2026 17:08:52 GMT Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hbhur1jt3-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 16 Oct 2026 17:08:52 +0000 (GMT) Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-3ab27eb38d6so177402a91.2 for ; Fri, 16 Oct 2026 10:08:52 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ac94748c6csm10155552a91.10.2026.10.16.10.08.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2026 10:08:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=sXXRvnZD3IL2PaUM+pAhcP oiorjQA0fKae720tcLKqc=; b=ZyTk/Sl/NNXP++GIxeeC/Q8/mj4N4fI1Lz7gvZ eJZIeWPJ+nbG0T2+OI5LXkQdswepuBXBrpDqhQg1f1DQ+96yOHXB2Ys7+T8Tz5PC /j9Nl/Nq+s6yrOZNwTvHJJBuLJk+i+q4bK54L6ijn88CcTtRjp1cduKVsWKnW1QN F5JVbAm0KK7J1JKss/2fK/IeRvOnkLNYSt1Zkkerye5EekzHgD80uyMwlYlkVrXD Ax7Zjh5roizEG6WH3ycLBW6CEdWgvkKN/gIujNPTr2W3nC4ESLUsgzB+vb4Ot2gt GHv41Q8+KQ4/SUCxjG/NcKxKzfkbL/cHX71sJO6GrdgbsP4A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792170531; x=1792775331; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=sXXRvnZD3IL2PaUM+pAhcPoiorjQA0fKae720tcLKqc=; b=X9FoWw9M3hsPIfgHJPVtKXZImcoNni3TOth+avv40/mN/ewnKaKuo0JlkXtNmwrNKL dLQ6kGZehWzOxPPGF4nkgFb9qBumf1AhFcuogdMTCEc690Y8VaDuIZtidUpSQ28yOECE xUfiKd9rF3BivSLVcsaKSmX8Czr2AF3nweXKdk3vFXzSELrUnoElCKevc4VZlLAXtEAZ p5VPAp4OUY35T7z+kn+pU6QK8XDbakWGbwmCMK5kNo1ZZ14if08MPRkWkllBhmddvbdd 5sFhgCdJnHUss5TDFc5jSe6eDRybbkAVwQQg9GcV5owuXariaoIpTZKDmhUKzQYeW7lx qeXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792170531; x=1792775331; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=sXXRvnZD3IL2PaUM+pAhcPoiorjQA0fKae720tcLKqc=; b=sm3I06+zq1fGXyzPS8ULIwShk4f3uowGiCJp4OL8ce3PdFCY850aZXNbvtbtbzumpa H5SgCT8da+Cpc4db7TzMhMrfFO3mfhQyhcKmZMU5o+cN/B0OPgYNbifxzxcFmAMHfHLk 5tja5K5hd4iXsr5kQRtuMcB9JWEAsgAgavhb2p20NLg6Gp1gQ3qXoCJt8mA3Oh7IESei sTSZYpc1Pq2KUQ8u0lbc3q2HhlrFsfrIKMrrIagTKWexn5x/fRM7RVI0ZXJruULQu4aW 5vxB6DSSJ9QOBQwYDDza2mYabFCkZYscnri/7ZPHqGkJ+9LTRnozfnS7P7TX4yAB7GgB Q7rQ== X-Gm-Message-State: AFq9FYI8ITa+Gh8twRs3VXakg4Xdkf9l1RyMW6ON6xot24DqCHg7nH2Q Wo+Cve4HLgx6Wn2rv4FgrLP5FejVlkfYCjOUAy0wR1ZwmamXlJ5wU4RO8i1A/PL0yDsbSIhdqyF +0999/n9GtTau5UNPZ7hVNgOeo6WCutbAmVVbvfM43KvMWpgLIbEH7vangGytY3El0A== X-Gm-Gg: AYBFou3MbqBjE6r5YOWRYB77632P7MlcIhwbyMgTesh3lM5rTN4XF5o9K10+lCncYPQ Fha5Z5sL+IRP/gj4NLkAdENlu7g0i1eKZm5lh8eDJlPWFWF/VheZgv82UCetq2jMm84ju75OqS3 J4GIduKSh+lrUuIL1CkXXNDEGeTgmNZXVAuAVP1yTdapHv4DgktmEUhyeujLxh4l1OtrWddWFH5 iBGTLXclW40su4LaKBo0kdr9UGYwDoyxNlO82wey69xt7mwffwUthLFDmTO04PAh4mNwpUbwfFB zOsW/ns4F0K4yDlT2EZzCDU3BPtvmQi7M5ygGrcvxlIlIGFSP8Ou9PQ5dpuDTA/B/o2FCGNVB1D 9/cmdNdo5ongw7WQkVAC3+7DAVcMXk0GuEt+blTe8cqo92eo= X-Received: by 2002:a17:90b:4a4b:b0:3ac:80dc:f40c with SMTP id 98e67ed59e1d1-3aceefbdefamr442998a91.14.1792170531258; Fri, 16 Oct 2026 10:08:51 -0700 (PDT) X-Received: by 2002:a17:90b:4a4b:b0:3ac:80dc:f40c with SMTP id 98e67ed59e1d1-3aceefbdefamr442955a91.14.1792170530609; Fri, 16 Oct 2026 10:08:50 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: Marco Liebel , Alessandro Di Federico , Anton Johansson , Brian Cain , Pierrick Bouvier Subject: [PATCH] target/hexagon: fix the allocframe framekey Date: Fri, 16 Oct 2026 10:08:48 -0700 Message-Id: <20261016170848.4024042-1-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDE2MDA2OCBTYWx0ZWRfX695/MkOp6kxo 63AQu5IME0IvbP50vh5badEFNy0qUn9yksJuX8+i3YPhk/acNeCnBXp2CZznwothOGPieZ2aX3A ljwK4V0JyhZ0nt2v6Csxyy2MsAw8HRHJcBvHERUUFTB9tYN4gRrUnxgdysVeHKGJChdrrMZ80v2 fBb15Arccg4I0w+QYvCj6I77HT22PUYnXsdvzQ/utWM1fp+kToQHM5128MU7idrP7NoiTMc5izA VNyW+DhCH/0ytVtvsp7WgFOPAZtQVSuPBwIO8LKfHXYn4+wtnV9U7uncbdqVt/8KlTkXWMrtPws ascb2zE9LSQy9uIYhH+4SQ5JFIrrz5YKY5Xl4HvkB0gFVKs8cLXUBgPfLO2aX27GquF1/5XoOYR /psL7s/3iDU2G40L9w/UVoSMlZiMQe9YAQAfGv8tfV/0Y9Ke7VN9DbH8K4CSmwePZQ2ol94RLMN ALJmyE/xH0MjQ1JXWOQ== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDE2MDA2OCBTYWx0ZWRfXzja3zMMpoMX3 v5rWlPO4UEyMQGWu9iGlecufqV+nNZyKl/ZM48OF6ewLuTti9cvB6m+nJKOOvxKtZXe5UFMGDvu fDJfGv0dbfWizoPmKzaBQ10hTaOyDnI= X-Authority-Analysis: v=2.4 cv=PqsG/AM3 c=1 sm=1 tr=0 ts=6ad25a24 cx=c_pps a=vVfyC5vLCtgYJKYeQD43oA==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22 a=EUspDBNiAAAA:8 a=_X05_UiFBxjwBGZApkgA:9 a=QEXdDO2ut3YA:10 a=rl5im9kqc5Lf4LNbBjHf:22 X-Proofpoint-ORIG-GUID: oDPfm-f1xBkL46Rg0zlSYIR-jgbawoGQ X-Proofpoint-GUID: oDPfm-f1xBkL46Rg0zlSYIR-jgbawoGQ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-16_02,2026-10-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 priorityscore=1501 lowpriorityscore=0 impostorscore=0 phishscore=0 clxscore=1015 malwarescore=0 suspectscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610080000 definitions=main-2610160068 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.180.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0b-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792170579207158500 The frame that allocframe pushes is {LR, FP}, and what is scrambled is the LR word: FRAMEKEY is XOR'd into the upper 32 bits. The generated code for fFRAME_SCRAMBLE built the key from FRAMEKEY in both halves of a 64-bit value, so it scrambled FP as well. deallocframe and dealloc_return only undo the upper word, so a FP restored from a frame pushed with a non-zero FRAMEKEY was corrupt. Uncovered by testing some boot images using QuRT. Signed-off-by: Brian Cain Reviewed-by: Pierrick Bouvier --- target/hexagon/idef-parser/parser-helpers.c | 2 +- tests/tcg/hexagon/framekey.c | 67 +++++++++++++++++++++ tests/tcg/hexagon/meson.build | 1 + 3 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 tests/tcg/hexagon/framekey.c diff --git a/target/hexagon/idef-parser/parser-helpers.c b/target/hexagon/i= def-parser/parser-helpers.c index 49cc11fddd8..14840d98737 100644 --- a/target/hexagon/idef-parser/parser-helpers.c +++ b/target/hexagon/idef-parser/parser-helpers.c @@ -1989,7 +1989,7 @@ HexValue gen_rvalue_fscr(Context *c, YYLTYPE *locp, H= exValue *value) *value =3D gen_rvalue_extend(c, locp, value); OUT(c, locp, "gen_read_reg(", &frame_key, ", HEX_REG_FRAMEKEY);\n"); OUT(c, locp, "tcg_gen_concat_i32_i64(", - &key, ", ", &frame_key, ", ", &frame_key, ");\n"); + &key, ", tcg_constant_tl(0), ", &frame_key, ");\n"); OUT(c, locp, "tcg_gen_xor_i64(", &res, ", ", value, ", ", &key, ");\n"= ); return res; } diff --git a/tests/tcg/hexagon/framekey.c b/tests/tcg/hexagon/framekey.c new file mode 100644 index 00000000000..5d579293477 --- /dev/null +++ b/tests/tcg/hexagon/framekey.c @@ -0,0 +1,67 @@ +/* + * Copyright(c) Qualcomm Technologies, Inc. and/or its subsidiaries. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include +#include + +int err; + +#include "hex_test.h" + +/* + * allocframe pushes {LR, FP}, scrambling LR with FRAMEKEY, and deallocfra= me + * restores them. Push a frame and return the words that were stored, FP + * through the return value and LR through @lr_stored, and the FP and LR + * that deallocframe restores. + */ +static inline uint32_t frame_roundtrip(uint32_t key, uint32_t fp, + uint32_t lr, uint32_t *lr_stored, + uint32_t *fp_back, uint32_t *lr_bac= k) +{ + uint32_t fp_stored, saved_fp, saved_lr; + + asm volatile("%[saved_fp] =3D r30\n\t" + "%[saved_lr] =3D r31\n\t" + "framekey =3D %[key]\n\t" + "r30 =3D %[fp]\n\t" + "r31 =3D %[lr]\n\t" + "allocframe(#0)\n\t" + "%[fp_stored] =3D memw(r30)\n\t" + "%[lr_stored] =3D memw(r30 + #4)\n\t" + "r31 =3D #0\n\t" + "deallocframe\n\t" + "%[fp_back] =3D r30\n\t" + "%[lr_back] =3D r31\n\t" + "framekey =3D %[zero]\n\t" + "r30 =3D %[saved_fp]\n\t" + "r31 =3D %[saved_lr]\n" + : [fp_stored] "=3D&r"(fp_stored), [lr_stored] "=3D&r"(*lr= _stored), + [fp_back] "=3D&r"(*fp_back), [lr_back] "=3D&r"(*lr_back= ), + [saved_fp] "=3D&r"(saved_fp), [saved_lr] "=3D&r"(saved_= lr) + : [key] "r"(key), [fp] "r"(fp), [lr] "r"(lr), [zero] "r"(= 0) + : "memory", "framekey"); + return fp_stored; +} + +static void check_frame(uint32_t key, uint32_t fp, uint32_t lr) +{ + uint32_t lr_stored, fp_back, lr_back; + + /* Only LR is scrambled, FP is stored as is */ + check32(frame_roundtrip(key, fp, lr, &lr_stored, &fp_back, &lr_back), = fp); + check32(lr_stored, lr ^ key); + check32(fp_back, fp); + check32(lr_back, lr); +} + +int main() +{ + check_frame(0, 0x1234fff0, 0x5678abcc); + check_frame(0xf21f20a0, 0x1234fff0, 0x5678abcc); + + puts(err ? "FAIL" : "PASS"); + return err; +} diff --git a/tests/tcg/hexagon/meson.build b/tests/tcg/hexagon/meson.build index a6ace4c77c2..0fd62ce7e4c 100644 --- a/tests/tcg/hexagon/meson.build +++ b/tests/tcg/hexagon/meson.build @@ -68,6 +68,7 @@ tests +=3D { 'overflow.c': {'cflags': cflags, 'exe_name': 'hex-overflow'}, 'preg_alias.c': {'cflags': cflags}, 'dual_stores.c': {'cflags': cflags}, + 'framekey.c': {'cflags': cflags}, 'multi_result.c': {'cflags': cflags}, 'mem_noshuf.c': {'cflags': cflags}, 'mem_noshuf_exception.c': {'cflags': cflags}, --=20 2.34.1