linux-user/sh4: Fix crashes on signal delivery in conditional delay slot
If we get a signal in the delay slot, we must roll-back the PC to the jump instruction. This was already fixed by the commit 3b894b699c9a ("linux-user/sh4: Fix crashes on signal delivery"), however this fix omits a test for TB_FLAG_DELAY_SLOT_COND. TB_FLAG_DELAY_SLOT_COND is set by the conditional delayed branches bf/s and bt/s. Qemu did not roll-back the PC in this case, resulting in incorrect program execution. This patch fixes it. Cc: qemu-stable@nongnu.org Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com> Signed-off-by: Helge Deller <deller@gmx.de>
Mikulas Patocka committed
Aug 3, 2026 at 21:38 UTC
f7ad7b1f8c8148f39bc1f2c984bfc7b7c9c59041
1 file changed
+1
-1
linux-user/sh4/signal.c
+1
-1
@@ -109,7 +109,7 @@ static void unwind_gusa(CPUSH4State *regs)
109
the SP, otherwise we would be pushing the signal context to
110
invalid memory. */
111
regs->gregs[15] = regs->gregs[1];
112
- } else if (regs->flags & TB_FLAG_DELAY_SLOT) {
112
+ } else if (regs->flags & (TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND)) {
113
/* If we are in a delay slot, push the previous instruction. */
114
regs->pc -= 2;
115
}