From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:48752)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <laurent.desnogues@gmail.com>) id 1WS1cU-0000Ng-Md
	for qemu-devel@nongnu.org; Mon, 24 Mar 2014 05:56:39 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <laurent.desnogues@gmail.com>) id 1WS1cT-0005kd-UJ
	for qemu-devel@nongnu.org; Mon, 24 Mar 2014 05:56:38 -0400
Received: from mail-oa0-x22b.google.com ([2607:f8b0:4003:c02::22b]:52666)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <laurent.desnogues@gmail.com>) id 1WS1cT-0005kN-P3
	for qemu-devel@nongnu.org; Mon, 24 Mar 2014 05:56:37 -0400
Received: by mail-oa0-f43.google.com with SMTP id eb12so5564592oac.16
	for <qemu-devel@nongnu.org>; Mon, 24 Mar 2014 02:56:36 -0700 (PDT)
MIME-Version: 1.0
Date: Mon, 24 Mar 2014 10:56:36 +0100
Message-ID: <CABoDooPF-WDS9z653pfA+eCPsDYztQpypyo6Mn_0jB3pySOEUg@mail.gmail.com>
From: Laurent Desnogues <laurent.desnogues@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Subject: [Qemu-devel] Aarch64 MLS bug
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>, Peter Maydell <peter.maydell@linaro.org>

Hello,

the code that implements Aarch64 AdvSIMD MLS instruction looks like this:

            if (opcode == 0xf || opcode == 0x12) {
                /* SABA, UABA, MLA, MLS: accumulating ops */
                static NeonGenTwoOpFn * const fns[3][2] = {
                    { gen_helper_neon_add_u8, gen_helper_neon_sub_u8 },
                    { gen_helper_neon_add_u16, gen_helper_neon_sub_u16 },
                    { tcg_gen_add_i32, tcg_gen_sub_i32 },
                };
                bool is_sub = (opcode == 0x12 && u); /* MLS */

                genfn = fns[size][is_sub];
                read_vec_element_i32(s, tcg_op1, rd, pass, MO_32);
                genfn(tcg_res, tcg_res, tcg_op1);
            }

The genfn call has tcg_op1 and the second tcg_res swapped.

Thanks,

Laurent