<!-- This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, ensure this ticket is marked 'confidential' before submission. See https://www.qemu.org/contribute/security-process/ for additional guidance --> ## Host environment - Operating system: GNU/Linux - OS/kernel version: Linux 6.17.0 - Architecture: MIPS64EL Release 2 execution ABI - QEMU flavor: `qemu-aarch64` - QEMU version: QEMU 11.0.3, built from the official release tarball - QEMU command line: ```sh ./qemu-aarch64 ./aarch64-varshifts ``` ## Emulated/Virtualized environment - Operating system: None; freestanding statically linked test - OS/kernel version: None - Architecture: AArch64 ## Description of problem Automated testing assisted in identifying this issue. The finding was manually triaged, reduced to the standalone reproducer below, and independently validated against the MIPS64 architecture semantics. On a pre-Release-6 MIPS64 host, QEMU 11.0.3 reverses the value and count operands for TCG variable shifts and rotates. The problem affects the I32 and I64 forms of `shl`, `shr`, `sar`, and `rotr`. The reproducer checks all eight forms and returns one failure bit for each incorrect result: ```text unpatched QEMU 11.0.3: exit status 255 (0xff) expected: exit status 0 ``` For example, QEMU emits: ```asm dsrav s0,s0,s1 ``` where `s0` contains the count and `s1` contains the value. The instruction must instead be: ```asm dsrav s0,s1,s0 ``` The issue cannot be reproduced on current `qemu.git` master because MIPS host support and `tcg/mips64/` were removed in commits `bfa0801e91ca` and `586663f1fa29`. The affected code remains in the supported QEMU 11.0.3 release. ## Steps to reproduce 1. Save the following as `aarch64-varshifts.S`: ```asm .text .global _start _start: mov w19, #0 mov x0, #3 mov x1, #5 b test_lsl64 test_lsl64: lsl x2, x0, x1 cmp x2, #96 cset w3, ne orr w19, w19, w3 mov x0, #0x800 mov x1, #3 b test_lsr64 test_lsr64: lsr x2, x0, x1 cmp x2, #0x100 cset w3, ne orr w19, w19, w3, lsl #1 mov x0, #-256 mov x1, #3 b test_asr64 test_asr64: asr x2, x0, x1 cmp x2, #-32 cset w3, ne orr w19, w19, w3, lsl #2 mov x0, #0x100 mov x1, #4 b test_ror64 test_ror64: ror x2, x0, x1 cmp x2, #0x10 cset w3, ne orr w19, w19, w3, lsl #3 mov w0, #3 mov w1, #5 b test_lsl32 test_lsl32: lsl w2, w0, w1 cmp w2, #96 cset w3, ne orr w19, w19, w3, lsl #4 mov w0, #0x800 mov w1, #3 b test_lsr32 test_lsr32: lsr w2, w0, w1 cmp w2, #0x100 cset w3, ne orr w19, w19, w3, lsl #5 mov w0, #-256 mov w1, #3 b test_asr32 test_asr32: asr w2, w0, w1 cmp w2, #-32 cset w3, ne orr w19, w19, w3, lsl #6 mov w0, #0x100 mov w1, #4 b test_ror32 test_ror32: ror w2, w0, w1 cmp w2, #0x10 cset w3, ne orr w0, w19, w3, lsl #7 mov x8, #93 svc #0 ``` 2. Build the test: ```sh aarch64-linux-gnu-gcc -nostdlib -static -fno-pie -no-pie \ -Wl,-e,_start -o aarch64-varshifts aarch64-varshifts.S ``` 3. Run it in a pre-Release-6 MIPS64EL Linux environment: ```sh ./qemu-aarch64 ./aarch64-varshifts echo $? ``` 4. Observe exit status `255`; the expected status is `0`. ## Additional information `TCGOutOpBinary` passes `(output, value, count)`. `tcg_out_opc_reg()` takes `(rd, rs, rt)`, while MIPS variable shifts encode `rd, rt, rs`, with the count in `rs` and the value in `rt`. The four emitters currently pass: ```c tcg_out_opc_reg(s, insn, a0, a1, a2); ``` Changing `tgen_rotr`, `tgen_sar`, `tgen_shl`, and `tgen_shr` to pass `a0, a2, a1` makes the reproducer exit with status `0`. A two-patch stable-only RFC is prepared for submission to `qemu-devel`.