other: 0.213 semantic: 0.148 device: 0.114 graphic: 0.086 network: 0.059 PID: 0.055 vnc: 0.054 files: 0.053 socket: 0.050 debug: 0.043 permissions: 0.040 boot: 0.039 performance: 0.029 KVM: 0.018 debug: 0.277 other: 0.165 semantic: 0.112 files: 0.103 PID: 0.074 boot: 0.049 performance: 0.043 network: 0.039 device: 0.035 socket: 0.031 permissions: 0.024 graphic: 0.021 vnc: 0.017 KVM: 0.012 linux-user does not check PROT_EXEC At no point do we actually verify that a page is PROT_EXEC before translating. All we end up verifying is that the page is readable. Not the same thing, obviously. The following test case should work for any architecture, though I've only validated it for x86_64 and aarch64. It turns out we can't fix this without also fixing our implementation of signal trampolines. This is an automated cleanup. This bug report has been moved to QEMU's new bug tracker on gitlab.com and thus gets marked as 'expired' now. Please continue with the discussion here: https://gitlab.com/qemu-project/qemu/-/issues/122