If we get a signal in the delay slot, we must roll-back the PC to the
jump instruction. This was already fixed by the commit 3b894b699c9a
("linux-user/sh4: Fix crashes on signal delivery"), however this fix
omits a test for TB_FLAG_DELAY_SLOT_COND. TB_FLAG_DELAY_SLOT_COND is set
by the conditional delayed branches bf/s and bt/s. Qemu did not roll-back
the PC in this case, resulting in incorrect program execution.

This patch fixes it.

Cc: qemu-stable@nongnu.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

---
 linux-user/sh4/signal.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: qemu/linux-user/sh4/signal.c
===================================================================
--- qemu.orig/linux-user/sh4/signal.c	2026-08-02 18:02:30.000000000 +0200
+++ qemu/linux-user/sh4/signal.c	2026-08-02 18:03:09.000000000 +0200
@@ -109,7 +109,7 @@ static void unwind_gusa(CPUSH4State *reg
            the SP, otherwise we would be pushing the signal context to
            invalid memory.  */
         regs->gregs[15] = regs->gregs[1];
-    } else if (regs->flags & TB_FLAG_DELAY_SLOT) {
+    } else if (regs->flags & (TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND)) {
         /* If we are in a delay slot, push the previous instruction.  */
         regs->pc -= 2;
     }

On Tue, 04 Aug 2026 04:38:32 +0900,
Mikulas Patocka wrote:
> 
> If we get a signal in the delay slot, we must roll-back the PC to the
> jump instruction. This was already fixed by the commit 3b894b699c9a
> ("linux-user/sh4: Fix crashes on signal delivery"), however this fix
> omits a test for TB_FLAG_DELAY_SLOT_COND. TB_FLAG_DELAY_SLOT_COND is set
> by the conditional delayed branches bf/s and bt/s. Qemu did not roll-back
> the PC in this case, resulting in incorrect program execution.
> 
> This patch fixes it.
> 
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> 
> ---
>  linux-user/sh4/signal.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: qemu/linux-user/sh4/signal.c
> ===================================================================
> --- qemu.orig/linux-user/sh4/signal.c	2026-08-02 18:02:30.000000000 +0200
> +++ qemu/linux-user/sh4/signal.c	2026-08-02 18:03:09.000000000 +0200
> @@ -109,7 +109,7 @@ static void unwind_gusa(CPUSH4State *reg
>             the SP, otherwise we would be pushing the signal context to
>             invalid memory.  */
>          regs->gregs[15] = regs->gregs[1];
> -    } else if (regs->flags & TB_FLAG_DELAY_SLOT) {
> +    } else if (regs->flags & (TB_FLAG_DELAY_SLOT | TB_FLAG_DELAY_SLOT_COND)) {
>          /* If we are in a delay slot, push the previous instruction.  */
>          regs->pc -= 2;
>      }
> 

Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com>

-- 
Yosinori Sato