device: 0.469 graphic: 0.426 mistranslation: 0.352 network: 0.329 socket: 0.283 other: 0.253 semantic: 0.239 vnc: 0.205 boot: 0.184 instruction: 0.163 KVM: 0.034 assembly: 0.008 linux-user does not check PROT_EXEC At no point do we actually verify that a page is PROT_EXEC before translating. All we end up verifying is that the page is readable. Not the same thing, obviously. The following test case should work for any architecture, though I've only validated it for x86_64 and aarch64. It turns out we can't fix this without also fixing our implementation of signal trampolines. This is an automated cleanup. This bug report has been moved to QEMU's new bug tracker on gitlab.com and thus gets marked as 'expired' now. Please continue with the discussion here: https://gitlab.com/qemu-project/qemu/-/issues/122