[PATCH 0/2] tcg/optimize: Fix fold_multiply2 vs 1

[PATCH 0/2] tcg/optimize: Fix fold_multiply2 vs 1

[Richard Henderson]

Keeping the test case separate to ease backport of the fix to stable.

r~

Richard Henderson (2):
  tcg/optimize: Fix fold_multiply2 vs 1
  tests/tcg/arm: Add regression test for #4448

 tcg/optimize.c            | 17 ++++++-------
 tests/tcg/arm/issue4448.c | 51 +++++++++++++++++++++++++++++++++++++++
 tests/tcg/arm/meson.build |  1 +
 3 files changed, 59 insertions(+), 10 deletions(-)
 create mode 100644 tests/tcg/arm/issue4448.c

-- 
2.53.0

[PATCH 1/2] tcg/optimize: Fix fold_multiply2 vs 1

[Richard Henderson]

For muls2, we returned from fold_multiply2 without finish_folding
or any other mechanism to update value tracking for the rh output.
We might as well do this via fold_shift, which will also mark rh
as having all copies of the sign bit.

For the movi paths of multiply vs 0 or mulu2, we're better off tail
calling to tcg_opt_gen_movi rather than explicitly returning true.

Cc: qemu-stable@nongnu.org
Fixes: c9349965ce4 ("tcg: Optimize INDEX_op_mul[us]2 for 0 and 1")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4448
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index d291c844ca8..bd91220650b 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2213,6 +2213,7 @@ static bool fold_mul_highpart(OptContext *ctx, TCGOp *op)
     return finish_folding(ctx, op);
 }
 
+static bool fold_shift(OptContext *ctx, TCGOp *op);
 static bool fold_multiply2(OptContext *ctx, TCGOp *op)
 {
     swap_commutative(op->args[0], &op->args[2], &op->args[3]);
@@ -2253,15 +2254,13 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
             /* The proper opcode is supplied by tcg_opt_gen_mov. */
             op2 = opt_insert_before(ctx, op, 0, 2);
             tcg_opt_gen_movi(ctx, op, rl, l);
-            tcg_opt_gen_movi(ctx, op2, rh, h);
-            return true;
+            return tcg_opt_gen_movi(ctx, op2, rh, h);
         }
 
         if (b == 0) {
             op2 = opt_insert_before(ctx, op, 0, 2);
             tcg_opt_gen_movi(ctx, op2, rl, 0);
-            tcg_opt_gen_movi(ctx, op, rh, 0);
-            return true;
+            return tcg_opt_gen_movi(ctx, op, rh, 0);
         }
         if (b == 1) {
             op2 = opt_insert_before(ctx, op, 0, 2);
@@ -2269,20 +2268,18 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
 
             switch (op->opc) {
             case INDEX_op_mulu2:
-                tcg_opt_gen_movi(ctx, op, rh, 0);
-                break;
+                return tcg_opt_gen_movi(ctx, op, rh, 0);
             case INDEX_op_muls2:
                 op->opc = INDEX_op_sar;
                 op->args[0] = rh;
                 op->args[1] = rl;
                 op->args[2] =
                     arg_new_constant(ctx, tcg_type_size(ctx->type) * 8 - 1);
-                break;
+                return fold_shift(ctx, op);
             default:
-                g_assert_not_reached();
+                break;
             }
-
-            return true;
+            g_assert_not_reached();
         }
     }
     return finish_folding(ctx, op);
-- 
2.53.0

[PATCH 2/2] tests/tcg/arm: Add regression test for #4448

[Richard Henderson]

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/tcg/arm/issue4448.c | 51 +++++++++++++++++++++++++++++++++++++++
 tests/tcg/arm/meson.build |  1 +
 2 files changed, 52 insertions(+)
 create mode 100644 tests/tcg/arm/issue4448.c

diff --git a/tests/tcg/arm/issue4448.c b/tests/tcg/arm/issue4448.c
new file mode 100644
index 00000000000..180ff4029a2
--- /dev/null
+++ b/tests/tcg/arm/issue4448.c
@@ -0,0 +1,51 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include <assert.h>
+#include <stdint.h>
+
+/* Signed 64-bit product, constant operand first then second. */
+#define SMULL_CONST_LHS(k, x, lo, hi) \
+    __asm__("mov r0, #" #k "\n\tsmull %0, %1, r0, %2" \
+            : "=&r"(lo), "=&r"(hi) : "r"(x) : "r0", "cc")
+
+#define SMULL_CONST_RHS(k, x, lo, hi) \
+    __asm__("mov r0, #" #k "\n\tsmull %0, %1, %2, r0" \
+	    : "=&r"(lo), "=&r"(hi) : "r"(x) : "r0", "cc")
+
+/* Unsigned 64-bit product, for contrast: this one is folded correctly. */
+#define UMULL_CONST_LHS(k, x, lo, hi) \
+    __asm__("mov r0, #" #k "\n\tumull %0, %1, r0, %2" \
+	    : "=&r"(lo), "=&r"(hi) : "r"(x) : "r0", "cc")
+
+static int64_t s64(int32_t hi, int32_t lo)
+{
+    return ((int64_t)hi << 32) | (uint32_t)lo;
+}
+
+static uint64_t u64(int32_t hi, int32_t lo)
+{
+    return ((uint64_t)(uint32_t)hi << 32) | (uint32_t)lo;
+}
+
+int main(void)
+{
+    static const int32_t values[] = { 1961612, -1479053948, -7, 0 };
+
+    for (unsigned i = 0; i < sizeof(values) / sizeof(values[0]); i++) {
+        int32_t x = values[i];
+        int32_t lo, hi;
+
+        SMULL_CONST_LHS(1, x, lo, hi);
+        assert(x == s64(hi, lo));
+
+        SMULL_CONST_RHS(1, x, lo, hi);
+        assert(x == s64(hi, lo));
+
+        UMULL_CONST_LHS(1, x, lo, hi);
+        assert((uint32_t)x == u64(hi, lo));
+
+        SMULL_CONST_LHS(0, x, lo, hi);
+        assert(0 == u64(hi, lo));
+    }
+    return 0;
+}
diff --git a/tests/tcg/arm/meson.build b/tests/tcg/arm/meson.build
index 1b491cea026..5c2af2189c5 100644
--- a/tests/tcg/arm/meson.build
+++ b/tests/tcg/arm/meson.build
@@ -39,6 +39,7 @@ tests += {
     'expected_output': 'fcvt.ref',
   },
   'pcalign-a32.c': {'cflags': ['-marm']},
+  'issue4448.c': {},
 }
 
 # Vector SHA1
-- 
2.53.0

Re: [PATCH 2/2] tests/tcg/arm: Add regression test for #4448

[Jim MacArthur]

On Mon, Sep 14, 2026 at 03:41:15PM -1000, Richard Henderson wrote:
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tests/tcg/arm/issue4448.c | 51 +++++++++++++++++++++++++++++++++++++++
>  tests/tcg/arm/meson.build |  1 +
>  2 files changed, 52 insertions(+)
>  create mode 100644 tests/tcg/arm/issue4448.c
> 
> diff --git a/tests/tcg/arm/issue4448.c b/tests/tcg/arm/issue4448.c
> new file mode 100644
> index 00000000000..180ff4029a2
> --- /dev/null
> +++ b/tests/tcg/arm/issue4448.c

Reviewed-by: Jim MacArthur <jim.macarthur@linaro.org>

Re: [PATCH 1/2] tcg/optimize: Fix fold_multiply2 vs 1

[Jim MacArthur]

On Mon, Sep 14, 2026 at 03:41:14PM -1000, Richard Henderson wrote:
> For muls2, we returned from fold_multiply2 without finish_folding
> or any other mechanism to update value tracking for the rh output.
> We might as well do this via fold_shift, which will also mark rh
> as having all copies of the sign bit.
> 
> For the movi paths of multiply vs 0 or mulu2, we're better off tail
> calling to tcg_opt_gen_movi rather than explicitly returning true.
> 
> Cc: qemu-stable@nongnu.org
> Fixes: c9349965ce4 ("tcg: Optimize INDEX_op_mul[us]2 for 0 and 1")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4448
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/optimize.c | 17 +++++++----------
>  1 file changed, 7 insertions(+), 10 deletions(-)
> 

Reviewed-by: Jim MacArthur <jim.macarthur@linaro.org>