The return address comes from IA*Q_Next, and IASQ_Next is always equal to IASQ_Back, not IASQ_Front.
Signed-off-by: Richard Henderson <richard.hender...@linaro.org> --- target/hppa/translate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/hppa/translate.c b/target/hppa/translate.c index 19594f917e..1766a63001 100644 --- a/target/hppa/translate.c +++ b/target/hppa/translate.c @@ -3817,7 +3817,7 @@ static bool trans_be(DisasContext *ctx, arg_be *a) load_spr(ctx, new_spc, a->sp); if (a->l) { copy_iaoq_entry(ctx, cpu_gr[31], ctx->iaoq_n, ctx->iaoq_n_var); - tcg_gen_mov_i64(cpu_sr[0], cpu_iasq_f); + tcg_gen_mov_i64(cpu_sr[0], cpu_iasq_b); } if (a->n && use_nullify_skip(ctx)) { copy_iaoq_entry(ctx, cpu_iaoq_f, -1, tmp); -- 2.34.1