From nobody Sun Dec 14 12:14:49 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17647546963631010.1794018791744; Wed, 3 Dec 2025 01:38:16 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1vQjIk-0002PK-VV; Wed, 03 Dec 2025 04:37:35 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vQjId-0001uE-UT; Wed, 03 Dec 2025 04:37:29 -0500 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1vQjIc-0007Ak-AP; Wed, 03 Dec 2025 04:37:27 -0500 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 809DE1708BD; Wed, 03 Dec 2025 12:35:55 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6BCE532B5B4; Wed, 03 Dec 2025 12:36:13 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Harald van Dijk , Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-10.1.3 94/96] target/arm: Fix assert on BRA. Date: Wed, 3 Dec 2025 12:35:27 +0300 Message-ID: <20251203093612.2370716-18-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1764754698234019200 Content-Type: text/plain; charset="utf-8" From: Harald van Dijk trans_BRA does gen_a64_set_pc(s, dst); set_btype_for_br(s, a->rn); gen_a64_set_pc does s->pc_save =3D -1; set_btype_for_br (if aa64_bti is enabled and the register is not x16 or x17) does gen_pc_plus_diff(s, pc, 0); gen_pc_plus_diff does assert(s->pc_save !=3D -1); Hence, this assert is getting hit. We need to call set_btype_for_br before gen_a64_set_pc, and there is nothing in set_btype_for_br that depends on gen_a64_set_pc having already been called, so this commit simply swaps the calls. (The commit message for 64678fc45d8f6 says that set_brtype_for_br() must be "moved after" get_a64_set_pc(), but this is a mistake in the commit message -- the actual changes in that commit move set_brtype_for_br() *before* get_a64_set_pc() and this is necessary to avoid the assert.) Cc: qemu-stable@nongnu.org Fixes: 64678fc45d8f6 ("target/arm: Fix BTI versus CF_PCREL") Signed-off-by: Harald van Dijk Reviewed-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: d2265ebb-84bc-41b7-a2d7-05dc9a5a2055@accesssoftek.com [PMM: added note about 64678fc45d8f6 to commit message] Signed-off-by: Peter Maydell (cherry picked from commit 7248dab3c9d73fcefe609f7a3414f9d048fefcc1) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c index dbf47595db..9c439711fb 100644 --- a/target/arm/tcg/translate-a64.c +++ b/target/arm/tcg/translate-a64.c @@ -1841,8 +1841,8 @@ static bool trans_BRA(DisasContext *s, arg_bra *a) return false; } dst =3D auth_branch_target(s, cpu_reg(s,a->rn), cpu_reg_sp(s, a->rm), = !a->m); - gen_a64_set_pc(s, dst); set_btype_for_br(s, a->rn); + gen_a64_set_pc(s, dst); s->base.is_jmp =3D DISAS_JUMP; return true; } --=20 2.47.3