On 9/4/2026 5:33 AM, Philippe Mathieu-Daudé wrote:
On 4/9/26 03:22, Brian Cain wrote:
The region-length bounds check compared (EA + i0) <= (EA + LEN),
which reduces to i0 <= LEN and never actually depends on the region
base. This let vgather/vscatter keep elements whose offset was
beyond the declared region instead of dropping them. Compare the
offset to the region length directly instead.
Only load bytes for gather lanes that are kept. A dropped or
predicate-false lane must not access memory and raise an exception.
Reviewed-by: Matheus Tavares Bernardino
<[email protected]>
Signed-off-by: Brian Cain <[email protected]>
---
target/hexagon/mmvec/macros.h | 31 +++++++++++++++++--------------
1 file changed, 17 insertions(+), 14 deletions(-)
diff --git a/target/hexagon/mmvec/macros.h
b/target/hexagon/mmvec/macros.h
index e85beed3387..858afd995d9 100644
--- a/target/hexagon/mmvec/macros.h
+++ b/target/hexagon/mmvec/macros.h
@@ -130,9 +130,9 @@
do { \
int log_byte = 0; \
target_ulong va = EA; \
- target_ulong va_high = EA + LEN; \
+ int in_region = (OFFSET) <= (LEN); \
I'm a bit confused here (and hopefully wrong), shouldn't it be
(OFFSET) < (LEN), otherwise the byte accessed is out of the limit?
Yeah, it's confusing as-is. I'll change the code to make it clearer.
s/LEN/OFFS_REG_END/ should make the code look more conventional, I think.
HVX PRM
https://docs.qualcomm.com/doc/80-N2040-54/80-N2040-54_REV_AB_Qualcomm_Hexagon_V73_HVX_Programmers_Reference_Manual.pdf
Refer to section 5.3, "Scatter and Gather" Table 5-3 - "Mu: Byte offset
of last valid byte of the region (for example, region size - 1)" - the
Mu value is what's been interpreted here as "LEN."
(pattern used multiple times in this patch)
