Commit b5798481cb for qemu.org

commit b5798481cbc7d2c78e635fe552883cc8389e71c3
Author: Brian Cain <brian.cain@oss.qualcomm.com>
Date:   Sat Sep 5 12:59:53 2026 -0700

    target/hexagon: fix HVX predicate save size for histogram ops

    The masked histogram instructions save the predicate operand to the qtmp
    temporary with a gvec move sized sizeof(MMVector). Both source and
    destination are MMQReg, which is eight times smaller, so the move read
    112 bytes past the predicate register and wrote them over the fields
    following qtmp in CPUHexagonState, that is vstore[0]. Use the size of
    the registers actually being copied.

    Fixes: 7ba7657bc93 ("Hexagon HVX helper overrides for histogram  instructions")
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Reviewed-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
    Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>

diff --git a/target/hexagon/gen_tcg_hvx.h b/target/hexagon/gen_tcg_hvx.h
index f399291dc6..548b49b415 100644
--- a/target/hexagon/gen_tcg_hvx.h
+++ b/target/hexagon/gen_tcg_hvx.h
@@ -50,7 +50,7 @@ static inline void assert_vhist_tmp(DisasContext *ctx)
         if (ctx->pre_commit) { \
             intptr_t dstoff = offsetof(CPUHexagonState, qtmp); \
             tcg_gen_gvec_mov_var(MO_64, tcg_env, dstoff, QvV_base, QvV_off, \
-                                 sizeof(MMVector), sizeof(MMVector)); \
+                                 sizeof(MMQReg), sizeof(MMQReg)); \
         } else { \
             assert_vhist_tmp(ctx); \
             gen_helper_vhistq(tcg_env); \
@@ -66,7 +66,7 @@ static inline void assert_vhist_tmp(DisasContext *ctx)
         if (ctx->pre_commit) { \
             intptr_t dstoff = offsetof(CPUHexagonState, qtmp); \
             tcg_gen_gvec_mov_var(MO_64, tcg_env, dstoff, QvV_base, QvV_off, \
-                                 sizeof(MMVector), sizeof(MMVector)); \
+                                 sizeof(MMQReg), sizeof(MMQReg)); \
         } else { \
             assert_vhist_tmp(ctx); \
             gen_helper_vwhist256q(tcg_env); \
@@ -82,7 +82,7 @@ static inline void assert_vhist_tmp(DisasContext *ctx)
         if (ctx->pre_commit) { \
             intptr_t dstoff = offsetof(CPUHexagonState, qtmp); \
             tcg_gen_gvec_mov_var(MO_64, tcg_env, dstoff, QvV_base, QvV_off, \
-                                 sizeof(MMVector), sizeof(MMVector)); \
+                                 sizeof(MMQReg), sizeof(MMQReg)); \
         } else { \
             assert_vhist_tmp(ctx); \
             gen_helper_vwhist256q_sat(tcg_env); \
@@ -98,7 +98,7 @@ static inline void assert_vhist_tmp(DisasContext *ctx)
         if (ctx->pre_commit) { \
             intptr_t dstoff = offsetof(CPUHexagonState, qtmp); \
             tcg_gen_gvec_mov_var(MO_64, tcg_env, dstoff, QvV_base, QvV_off, \
-                                 sizeof(MMVector), sizeof(MMVector)); \
+                                 sizeof(MMQReg), sizeof(MMQReg)); \
         } else { \
             assert_vhist_tmp(ctx); \
             gen_helper_vwhist128q(tcg_env); \
@@ -115,7 +115,7 @@ static inline void assert_vhist_tmp(DisasContext *ctx)
         if (ctx->pre_commit) { \
             intptr_t dstoff = offsetof(CPUHexagonState, qtmp); \
             tcg_gen_gvec_mov_var(MO_64, tcg_env, dstoff, QvV_base, QvV_off, \
-                                 sizeof(MMVector), sizeof(MMVector)); \
+                                 sizeof(MMQReg), sizeof(MMQReg)); \
         } else { \
             TCGv tcgv_uiV = tcg_constant_tl(uiV); \
             assert_vhist_tmp(ctx); \