[Qemu-devel] Aarch64 MLS bug

[Laurent Desnogues]

Hello,

the code that implements Aarch64 AdvSIMD MLS instruction looks like this:

            if (opcode == 0xf || opcode == 0x12) {
                /* SABA, UABA, MLA, MLS: accumulating ops */
                static NeonGenTwoOpFn * const fns[3][2] = {
                    { gen_helper_neon_add_u8, gen_helper_neon_sub_u8 },
                    { gen_helper_neon_add_u16, gen_helper_neon_sub_u16 },
                    { tcg_gen_add_i32, tcg_gen_sub_i32 },
                };
                bool is_sub = (opcode == 0x12 && u); /* MLS */

                genfn = fns[size][is_sub];
                read_vec_element_i32(s, tcg_op1, rd, pass, MO_32);
                genfn(tcg_res, tcg_res, tcg_op1);
            }

The genfn call has tcg_op1 and the second tcg_res swapped.

Thanks,

Laurent