* [PATCH 1/2] tcg/optimize: Fix fold_multiply2 vs 1
2026-09-15 1:41 [PATCH 0/2] tcg/optimize: Fix fold_multiply2 vs 1 Richard Henderson
@ 2026-09-15 1:41 ` Richard Henderson
2026-09-23 10:38 ` Jim MacArthur
2026-09-15 1:41 ` [PATCH 2/2] tests/tcg/arm: Add regression test for #4448 Richard Henderson
1 sibling, 1 reply; 5+ messages in thread
From: Richard Henderson @ 2026-09-15 1:41 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, qemu-stable
For muls2, we returned from fold_multiply2 without finish_folding
or any other mechanism to update value tracking for the rh output.
We might as well do this via fold_shift, which will also mark rh
as having all copies of the sign bit.
For the movi paths of multiply vs 0 or mulu2, we're better off tail
calling to tcg_opt_gen_movi rather than explicitly returning true.
Cc: qemu-stable@nongnu.org
Fixes: c9349965ce4 ("tcg: Optimize INDEX_op_mul[us]2 for 0 and 1")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4448
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
tcg/optimize.c | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)
diff --git a/tcg/optimize.c b/tcg/optimize.c
index d291c844ca8..bd91220650b 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2213,6 +2213,7 @@ static bool fold_mul_highpart(OptContext *ctx, TCGOp *op)
return finish_folding(ctx, op);
}
+static bool fold_shift(OptContext *ctx, TCGOp *op);
static bool fold_multiply2(OptContext *ctx, TCGOp *op)
{
swap_commutative(op->args[0], &op->args[2], &op->args[3]);
@@ -2253,15 +2254,13 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
/* The proper opcode is supplied by tcg_opt_gen_mov. */
op2 = opt_insert_before(ctx, op, 0, 2);
tcg_opt_gen_movi(ctx, op, rl, l);
- tcg_opt_gen_movi(ctx, op2, rh, h);
- return true;
+ return tcg_opt_gen_movi(ctx, op2, rh, h);
}
if (b == 0) {
op2 = opt_insert_before(ctx, op, 0, 2);
tcg_opt_gen_movi(ctx, op2, rl, 0);
- tcg_opt_gen_movi(ctx, op, rh, 0);
- return true;
+ return tcg_opt_gen_movi(ctx, op, rh, 0);
}
if (b == 1) {
op2 = opt_insert_before(ctx, op, 0, 2);
@@ -2269,20 +2268,18 @@ static bool fold_multiply2(OptContext *ctx, TCGOp *op)
switch (op->opc) {
case INDEX_op_mulu2:
- tcg_opt_gen_movi(ctx, op, rh, 0);
- break;
+ return tcg_opt_gen_movi(ctx, op, rh, 0);
case INDEX_op_muls2:
op->opc = INDEX_op_sar;
op->args[0] = rh;
op->args[1] = rl;
op->args[2] =
arg_new_constant(ctx, tcg_type_size(ctx->type) * 8 - 1);
- break;
+ return fold_shift(ctx, op);
default:
- g_assert_not_reached();
+ break;
}
-
- return true;
+ g_assert_not_reached();
}
}
return finish_folding(ctx, op);
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 2/2] tests/tcg/arm: Add regression test for #4448
2026-09-15 1:41 [PATCH 0/2] tcg/optimize: Fix fold_multiply2 vs 1 Richard Henderson
2026-09-15 1:41 ` [PATCH 1/2] " Richard Henderson
@ 2026-09-15 1:41 ` Richard Henderson
2026-09-23 10:36 ` Jim MacArthur
1 sibling, 1 reply; 5+ messages in thread
From: Richard Henderson @ 2026-09-15 1:41 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
tests/tcg/arm/issue4448.c | 51 +++++++++++++++++++++++++++++++++++++++
tests/tcg/arm/meson.build | 1 +
2 files changed, 52 insertions(+)
create mode 100644 tests/tcg/arm/issue4448.c
diff --git a/tests/tcg/arm/issue4448.c b/tests/tcg/arm/issue4448.c
new file mode 100644
index 00000000000..180ff4029a2
--- /dev/null
+++ b/tests/tcg/arm/issue4448.c
@@ -0,0 +1,51 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include <assert.h>
+#include <stdint.h>
+
+/* Signed 64-bit product, constant operand first then second. */
+#define SMULL_CONST_LHS(k, x, lo, hi) \
+ __asm__("mov r0, #" #k "\n\tsmull %0, %1, r0, %2" \
+ : "=&r"(lo), "=&r"(hi) : "r"(x) : "r0", "cc")
+
+#define SMULL_CONST_RHS(k, x, lo, hi) \
+ __asm__("mov r0, #" #k "\n\tsmull %0, %1, %2, r0" \
+ : "=&r"(lo), "=&r"(hi) : "r"(x) : "r0", "cc")
+
+/* Unsigned 64-bit product, for contrast: this one is folded correctly. */
+#define UMULL_CONST_LHS(k, x, lo, hi) \
+ __asm__("mov r0, #" #k "\n\tumull %0, %1, r0, %2" \
+ : "=&r"(lo), "=&r"(hi) : "r"(x) : "r0", "cc")
+
+static int64_t s64(int32_t hi, int32_t lo)
+{
+ return ((int64_t)hi << 32) | (uint32_t)lo;
+}
+
+static uint64_t u64(int32_t hi, int32_t lo)
+{
+ return ((uint64_t)(uint32_t)hi << 32) | (uint32_t)lo;
+}
+
+int main(void)
+{
+ static const int32_t values[] = { 1961612, -1479053948, -7, 0 };
+
+ for (unsigned i = 0; i < sizeof(values) / sizeof(values[0]); i++) {
+ int32_t x = values[i];
+ int32_t lo, hi;
+
+ SMULL_CONST_LHS(1, x, lo, hi);
+ assert(x == s64(hi, lo));
+
+ SMULL_CONST_RHS(1, x, lo, hi);
+ assert(x == s64(hi, lo));
+
+ UMULL_CONST_LHS(1, x, lo, hi);
+ assert((uint32_t)x == u64(hi, lo));
+
+ SMULL_CONST_LHS(0, x, lo, hi);
+ assert(0 == u64(hi, lo));
+ }
+ return 0;
+}
diff --git a/tests/tcg/arm/meson.build b/tests/tcg/arm/meson.build
index 1b491cea026..5c2af2189c5 100644
--- a/tests/tcg/arm/meson.build
+++ b/tests/tcg/arm/meson.build
@@ -39,6 +39,7 @@ tests += {
'expected_output': 'fcvt.ref',
},
'pcalign-a32.c': {'cflags': ['-marm']},
+ 'issue4448.c': {},
}
# Vector SHA1
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread