Commit 7248dab3c9 for qemu.org

commit 7248dab3c9d73fcefe609f7a3414f9d048fefcc1
Author: Harald van Dijk <hdijk@accesssoftek.com>
Date:   Fri Nov 28 04:38:11 2025 +0000

    target/arm: Fix assert on BRA.

    trans_BRA does

        gen_a64_set_pc(s, dst);
        set_btype_for_br(s, a->rn);

    gen_a64_set_pc does

        s->pc_save = -1;

    set_btype_for_br (if aa64_bti is enabled and the register is not x16 or
    x17) does

        gen_pc_plus_diff(s, pc, 0);

    gen_pc_plus_diff does

        assert(s->pc_save != -1);

    Hence, this assert is getting hit. We need to call set_btype_for_br
    before gen_a64_set_pc, and there is nothing in set_btype_for_br that
    depends on gen_a64_set_pc having already been called, so this commit
    simply swaps the calls.

    (The commit message for 64678fc45d8f6 says that set_brtype_for_br()
    must be "moved after" get_a64_set_pc(), but this is a mistake in
    the commit message -- the actual changes in that commit move
    set_brtype_for_br() *before* get_a64_set_pc() and this is necessary
    to avoid the assert.)

    Cc: qemu-stable@nongnu.org
    Fixes: 64678fc45d8f6 ("target/arm: Fix BTI versus CF_PCREL")
    Signed-off-by: Harald van Dijk <hdijk@accesssoftek.com>
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Message-id: d2265ebb-84bc-41b7-a2d7-05dc9a5a2055@accesssoftek.com
    [PMM: added note about 64678fc45d8f6 to commit message]
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 08b21d7dbf..cde22a5cca 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1916,8 +1916,8 @@ static bool trans_BRA(DisasContext *s, arg_bra *a)
         return false;
     }
     dst = auth_branch_target(s, cpu_reg(s,a->rn), cpu_reg_sp(s, a->rm), !a->m);
-    gen_a64_set_pc(s, dst);
     set_btype_for_br(s, a->rn);
+    gen_a64_set_pc(s, dst);
     s->base.is_jmp = DISAS_JUMP;
     return true;
 }