A comment in the implementation of blr says:
/* The pseudo code in the spec says we update LR before fetching.
the value from the rn. */
With 'rn' being the register holding the destination address.
This may have been true at one point, but the ISA manual now clearly
shows the destination register being read before the link register is
written.
This commit updates the implementation of blr to match.
sim/aarch64/ChangeLog:
PR sim/25318
* simulator.c (blr): Read destination register before calling
aarch64_save_LR.
Change-Id: Icb1c556064e3d9c807ac28440475caa205ab1064
69b1ffdb01