* [PULL 1/4] linux-user: Fix AT_EXECFN in AUXV for symlinked programs
2026-05-19 14:05 [PULL 0/4] Linux user next patches Helge Deller
@ 2026-05-19 14:05 ` Helge Deller
2026-05-19 14:05 ` [PULL 2/4] linux-user/sh4: Fix target_ucontext tuc_link field type Helge Deller
` (3 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Helge Deller @ 2026-05-19 14:05 UTC (permalink / raw)
To: qemu-devel; +Cc: deller, Laurent Vivier, Pierrick Bouvier
From: Helge Deller <deller@gmx.de>
The AT_EXECFN entry in AUXV needs to keep the value which was used when
the program was started. Especially for symlinked programs qemu should
not try to resolve the realpath.
Here is a reproducer:
(arm64-chroot)root@p100:/# cd /usr/bin
(arm64-chroot)root@p100:/usr/bin# ln -s echo testprog
(arm64-chroot)root@p100:/usr/bin# LD_SHOW_AUXV=1 ./testprog | grep AT_EXECFN
AT_EXECFN: ./testprog
In this example, "./testprog" is the correct output, and not "/usr/bin/echo".
This patch fixes parts of commit 258bec39 ("linux-user: Fix access to
/proc/self/exe").
Fixes: 258bec39 ("linux-user: Fix access to /proc/self/exe")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3379
Signed-off-by: Helge Deller <deller@gmx.de>
---
linux-user/main.c | 6 ++++--
linux-user/syscall.c | 14 +++++++-------
linux-user/user-internals.h | 1 +
3 files changed, 12 insertions(+), 9 deletions(-)
diff --git a/linux-user/main.c b/linux-user/main.c
index 86d04cca3c..c08c73fd80 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -772,8 +772,10 @@ int main(int argc, char **argv, char **envp)
}
/* Resolve executable file name to full path name */
- if (realpath(exec_path, real_exec_path)) {
- exec_path = real_exec_path;
+ /* Keep how we started the program in exec_path, e.g. "./my_program" */
+ /* Store real path in real_exec_path, e.g. "/usr/local/bin/my_program" */
+ if (!realpath(exec_path, real_exec_path)) {
+ printf("Could not resolve %s\n", exec_path);
}
/*
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index d3d9fffb54..65bbeb8551 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8790,9 +8790,9 @@ static int maybe_do_fake_open(CPUArchState *cpu_env, int dirfd,
return -1;
}
if (safe) {
- return safe_openat(dirfd, exec_path, flags, mode);
+ return safe_openat(dirfd, real_exec_path, flags, mode);
} else {
- return openat(dirfd, exec_path, flags, mode);
+ return openat(dirfd, real_exec_path, flags, mode);
}
}
@@ -8929,9 +8929,9 @@ ssize_t do_guest_readlink(const char *pathname, char *buf, size_t bufsiz)
* Don't worry about sign mismatch as earlier mapping
* logic would have thrown a bad address error.
*/
- ret = MIN(strlen(exec_path), bufsiz);
+ ret = MIN(strlen(real_exec_path), bufsiz);
/* We cannot NUL terminate the string. */
- memcpy(buf, exec_path, ret);
+ memcpy(buf, real_exec_path, ret);
} else {
ret = readlink(path(pathname), buf, bufsiz);
}
@@ -9022,7 +9022,7 @@ static int do_execv(CPUArchState *cpu_env, int dirfd,
const char *exe = p;
if (is_proc_myself(p, "exe")) {
- exe = exec_path;
+ exe = real_exec_path;
}
ret = is_execveat
? safe_execveat(dirfd, exe, argp, envp, flags)
@@ -11033,9 +11033,9 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
* Don't worry about sign mismatch as earlier mapping
* logic would have thrown a bad address error.
*/
- ret = MIN(strlen(exec_path), arg4);
+ ret = MIN(strlen(real_exec_path), arg4);
/* We cannot NUL terminate the string. */
- memcpy(p2, exec_path, ret);
+ memcpy(p2, real_exec_path, ret);
} else {
ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
}
diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h
index e65373b204..21daf422b7 100644
--- a/linux-user/user-internals.h
+++ b/linux-user/user-internals.h
@@ -24,6 +24,7 @@
#include "exec/translation-block.h"
extern char *exec_path;
+extern char real_exec_path[PATH_MAX];
void init_task_state(TaskState *ts);
void task_settid(TaskState *);
void stop_all_tasks(void);
--
2.54.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PULL 2/4] linux-user/sh4: Fix target_ucontext tuc_link field type
2026-05-19 14:05 [PULL 0/4] Linux user next patches Helge Deller
2026-05-19 14:05 ` [PULL 1/4] linux-user: Fix AT_EXECFN in AUXV for symlinked programs Helge Deller
@ 2026-05-19 14:05 ` Helge Deller
2026-05-19 14:05 ` [PULL 3/4] linux-user/sh4: Fix setup_sigtramp to match Linux kernel trampoline pattern Helge Deller
` (2 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Helge Deller @ 2026-05-19 14:05 UTC (permalink / raw)
To: qemu-devel; +Cc: deller, Laurent Vivier, Pierrick Bouvier
From: Matt Turner <mattst88@gmail.com>
tuc_link is declared as 'struct target_ucontext *', which is a HOST
pointer. On a 64-bit host running a 32-bit SH4 target, this is 8 bytes
instead of the 4 bytes the target expects, padding pushes tuc_mcontext
8 bytes past its correct offset.
When a signal handler receives ucontext_t *, every field accessed through
uc_mcontext (gregs[], pc, pr, ...) is read from the wrong address. In
particular the saved PC comes back as a garbage stack value, which breaks
any code that initialises a libunwind cursor from the signal context.
Fix it by using abi_ulong, which is always sized to the target ABI (4
bytes for SH4), matching the layout the kernel and glibc agree on. This
is the same pattern used by arm/signal.c.
Also remove the (unsigned long *) cast from the __put_user that zeros
tuc_link. The cast was harmless when tuc_link was pointer-sized (8
bytes matching unsigned long on a 64-bit host), but after the type
change __put_user's sizeof dispatch would select stq_le_p (8-byte write)
for a now-4-byte field, silently overwriting the start of tuc_stack.
Neither this fix nor the companion setup_sigtramp fix is independently
sufficient: this fix corrects register values read from the signal context
but libunwind still cannot detect the frame without the correct trampoline
pattern; that fix makes the frame detectable but register reads remain
garbage without the correct ucontext layout. Together they fix the
following libunwind tests on a 64-bit host:
Gtest-sig-context, Gtest-trace, Ltest-init-local-signal,
Ltest-sig-context, Ltest-trace
Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
---
linux-user/sh4/signal.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c
index 9ecc026fae..20d2bc8b2c 100644
--- a/linux-user/sh4/signal.c
+++ b/linux-user/sh4/signal.c
@@ -57,7 +57,7 @@ struct target_sigframe
struct target_ucontext {
target_ulong tuc_flags;
- struct target_ucontext *tuc_link;
+ abi_ulong tuc_link;
target_stack_t tuc_stack;
struct target_sigcontext tuc_mcontext;
target_sigset_t tuc_sigmask; /* mask last for extensibility */
@@ -237,7 +237,7 @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
/* Create the ucontext. */
__put_user(0, &frame->uc.tuc_flags);
- __put_user(0, (unsigned long *)&frame->uc.tuc_link);
+ __put_user(0, &frame->uc.tuc_link);
target_save_altstack(&frame->uc.tuc_stack, regs);
setup_sigcontext(&frame->uc.tuc_mcontext,
regs, set->sig[0]);
--
2.54.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PULL 3/4] linux-user/sh4: Fix setup_sigtramp to match Linux kernel trampoline pattern
2026-05-19 14:05 [PULL 0/4] Linux user next patches Helge Deller
2026-05-19 14:05 ` [PULL 1/4] linux-user: Fix AT_EXECFN in AUXV for symlinked programs Helge Deller
2026-05-19 14:05 ` [PULL 2/4] linux-user/sh4: Fix target_ucontext tuc_link field type Helge Deller
@ 2026-05-19 14:05 ` Helge Deller
2026-05-19 14:05 ` [PULL 4/4] linux-user: Fix a memory leak when pthread_create fails Helge Deller
2026-05-19 20:51 ` [PULL 0/4] Linux user next patches Stefan Hajnoczi
4 siblings, 0 replies; 8+ messages in thread
From: Helge Deller @ 2026-05-19 14:05 UTC (permalink / raw)
To: qemu-devel; +Cc: deller, Laurent Vivier, Pierrick Bouvier
From: Matt Turner <mattst88@gmail.com>
QEMU used MOVW(2) (0x9300), which loads the syscall number from PC+4,
instead of the kernel's MOVW(7) (0x9305), which loads from PC+14. The
kernel uses five "or r0,r0" nop pads between TRAP_NOARG and the syscall
number word to reach that offset. libunwind's unw_is_signal_frame checks
for the exact kernel byte pattern 0xc3109305 at the frame PC, so QEMU's
compact layout was not detected, breaking unwinding through signal frames.
Expand each trampoline from 6 to 16 bytes matching the kernel layout
defined in arch/sh/kernel/signal_32.c:
#define MOVW(n) (0x9300|((n)-2)) /* Move mem word at PC+n to R3 */
#define TRAP_NOARG 0xc310 /* Syscall w/no args (NR in R3) */
#define OR_R0_R0 0x200b /* or r0,r0 (insert to avoid hardware bug) */
__put_user(MOVW(7), &frame->retcode[0]); /* 0x9305 */
__put_user(TRAP_NOARG, &frame->retcode[1]); /* 0xc310 */
__put_user(OR_R0_R0, &frame->retcode[2]); /* 0x200b */
__put_user(OR_R0_R0, &frame->retcode[3]); /* 0x200b */
__put_user(OR_R0_R0, &frame->retcode[4]); /* 0x200b */
__put_user(OR_R0_R0, &frame->retcode[5]); /* 0x200b */
__put_user(OR_R0_R0, &frame->retcode[6]); /* 0x200b */
__put_user((__NR_sigreturn), &frame->retcode[7]);
The first two halfwords (MOVW(7) || TRAP_NOARG = 0xc3109305) form the
32-bit value libunwind checks at the frame PC, followed by two
OR_R0_R0 halfwords (0x200b200b) at PC+4. The same layout applies to
the rt_sigreturn trampoline (lines 366-373 of signal_32.c).
Neither this fix nor the companion tuc_link fix is independently
sufficient: this fix makes signal frames detectable but register reads
remain garbage without the correct ucontext layout; that fix corrects the
ucontext layout but libunwind still cannot detect the frame without the
correct trampoline pattern. Together they fix the following libunwind
tests on a 64-bit host:
Gtest-sig-context, Gtest-trace, Ltest-init-local-signal,
Ltest-sig-context, Ltest-trace
Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
---
linux-user/sh4/signal.c | 42 +++++++++++++++++++++++++++++++----------
1 file changed, 32 insertions(+), 10 deletions(-)
diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c
index 20d2bc8b2c..d70be24c38 100644
--- a/linux-user/sh4/signal.c
+++ b/linux-user/sh4/signal.c
@@ -329,20 +329,42 @@ badframe:
return -QEMU_ESIGRETURN;
}
+/*
+ * "or r0,r0" nop used by the Linux kernel inline sigreturn trampolines to
+ * avoid a hardware bug (OR_R0_R0 in arch/sh/kernel/signal_32.c). Five of
+ * these nops follow TRAP_NOARG, placing the syscall number word 14 bytes
+ * past the MOVW(7) instruction (at MOVW(7)'s load offset). This yields the
+ * fixed 16-byte layout that libunwind's unw_is_signal_frame detects:
+ * [MOVW(7), TRAP_NOARG, 5x NOP_OR, .word syscall_nr]
+ */
+#define NOP_OR 0x200b
+
void setup_sigtramp(abi_ulong sigtramp_page)
{
- uint16_t *tramp = lock_user(VERIFY_WRITE, sigtramp_page, 2 * 6, 0);
+ uint16_t *tramp = lock_user(VERIFY_WRITE, sigtramp_page, 2 * 16, 0);
assert(tramp != NULL);
+ /* sigreturn trampoline (non-RT) at offset 0 */
default_sigreturn = sigtramp_page;
- __put_user(MOVW(2), &tramp[0]);
+ __put_user(MOVW(7), &tramp[0]);
__put_user(TRAP_NOARG, &tramp[1]);
- __put_user(TARGET_NR_sigreturn, &tramp[2]);
-
- default_rt_sigreturn = sigtramp_page + 6;
- __put_user(MOVW(2), &tramp[3]);
- __put_user(TRAP_NOARG, &tramp[4]);
- __put_user(TARGET_NR_rt_sigreturn, &tramp[5]);
-
- unlock_user(tramp, sigtramp_page, 2 * 6);
+ __put_user(NOP_OR, &tramp[2]);
+ __put_user(NOP_OR, &tramp[3]);
+ __put_user(NOP_OR, &tramp[4]);
+ __put_user(NOP_OR, &tramp[5]);
+ __put_user(NOP_OR, &tramp[6]);
+ __put_user(TARGET_NR_sigreturn, &tramp[7]);
+
+ /* rt_sigreturn trampoline at offset 16 */
+ default_rt_sigreturn = sigtramp_page + 16;
+ __put_user(MOVW(7), &tramp[8]);
+ __put_user(TRAP_NOARG, &tramp[9]);
+ __put_user(NOP_OR, &tramp[10]);
+ __put_user(NOP_OR, &tramp[11]);
+ __put_user(NOP_OR, &tramp[12]);
+ __put_user(NOP_OR, &tramp[13]);
+ __put_user(NOP_OR, &tramp[14]);
+ __put_user(TARGET_NR_rt_sigreturn, &tramp[15]);
+
+ unlock_user(tramp, sigtramp_page, 2 * 16);
}
--
2.54.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PULL 4/4] linux-user: Fix a memory leak when pthread_create fails
2026-05-19 14:05 [PULL 0/4] Linux user next patches Helge Deller
` (2 preceding siblings ...)
2026-05-19 14:05 ` [PULL 3/4] linux-user/sh4: Fix setup_sigtramp to match Linux kernel trampoline pattern Helge Deller
@ 2026-05-19 14:05 ` Helge Deller
2026-05-19 20:51 ` [PULL 0/4] Linux user next patches Stefan Hajnoczi
4 siblings, 0 replies; 8+ messages in thread
From: Helge Deller @ 2026-05-19 14:05 UTC (permalink / raw)
To: qemu-devel; +Cc: deller, Laurent Vivier, Pierrick Bouvier
From: Warner Losh <imp@bsdimp.com>
Fix one of the TODO items when creating a new thread: release the copied
cpu and free the task state.
Signed-off-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
linux-user/syscall.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 65bbeb8551..2d4a8aa182 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -7005,7 +7005,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
cpu->random_seed = qemu_guest_random_seed_thread_part1();
ret = pthread_create(&info.thread, &attr, clone_func, &info);
- /* TODO: Free new CPU state if thread creation failed. */
sigprocmask(SIG_SETMASK, &info.sigmask, NULL);
pthread_attr_destroy(&attr);
@@ -7014,7 +7013,16 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
pthread_cond_wait(&info.cond, &info.mutex);
ret = info.tid;
} else {
+ errno = ret;
ret = -1;
+ object_unparent(OBJECT(new_cpu));
+ object_unref(OBJECT(new_cpu));
+#ifdef TARGET_AARCH64
+ if (ts->gcs_base) {
+ target_munmap(ts->gcs_base, ts->gcs_size);
+ }
+#endif
+ g_free(ts);
}
pthread_mutex_unlock(&info.mutex);
pthread_cond_destroy(&info.cond);
--
2.54.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PULL 0/4] Linux user next patches
2026-05-19 14:05 [PULL 0/4] Linux user next patches Helge Deller
` (3 preceding siblings ...)
2026-05-19 14:05 ` [PULL 4/4] linux-user: Fix a memory leak when pthread_create fails Helge Deller
@ 2026-05-19 20:51 ` Stefan Hajnoczi
4 siblings, 0 replies; 8+ messages in thread
From: Stefan Hajnoczi @ 2026-05-19 20:51 UTC (permalink / raw)
To: Helge Deller; +Cc: qemu-devel, deller, Laurent Vivier, Pierrick Bouvier
[-- Attachment #1: Type: text/plain, Size: 116 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread