target-ppc: Fix SUBFE carry

While ~T0+T1+CF = T1-T0+CF-1 is true for the low 32-bits,
it does not produce the correct carry-out to bit 33.  Do
exactly what the manual says.

Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index f88644118b..80d5366d27 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -1120,14 +1120,15 @@ static inline void gen_op_arith_subf(DisasContext *ctx, TCGv ret, TCGv arg1,
     }
 
     if (add_ca) {
-        /* dest = ~arg1 + arg2 + ca = arg2 - arg1 + ca - 1.  */
+        /* dest = ~arg1 + arg2 + ca.  */
         if (compute_ca) {
-            TCGv zero;
-            tcg_gen_subi_tl(cpu_ca, cpu_ca, 1);
+            TCGv zero, inv1 = tcg_temp_new();
+            tcg_gen_not_tl(inv1, arg1);
             zero = tcg_const_tl(0);
             tcg_gen_add2_tl(t0, cpu_ca, arg2, zero, cpu_ca, zero);
-            tcg_gen_sub2_tl(t0, cpu_ca, t0, cpu_ca, arg1, zero);
+            tcg_gen_add2_tl(t0, cpu_ca, t0, cpu_ca, inv1, zero);
             tcg_temp_free(zero);
+            tcg_temp_free(inv1);
         } else {
             tcg_gen_sub_tl(t0, arg2, arg1);
             tcg_gen_add_tl(t0, t0, cpu_ca);