linux-user: make syscall emulation interruptible
The syscall emulation code previously wasn't interruptible via cpu_loop_exit(), as this construct relies on a longjmp target that is not live anymore in the syscall handling code. Consequently, longjmp() would operate on a (potentially overwritten) stale jump buffer. This patch adds an additional setjmp and the necessary handling around it to make longjmp() (and by proxy cpu_loop_exit() safe to call even within a syscall context. Reviewed-by: Warner Losh <imp@bsdimp.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Florian Hofhammer <florian.hofhammer@epfl.ch> Link: https://lore.kernel.org/qemu-devel/20260305-setpc-v5-v7-3-4c3adba52403@epfl.ch Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Florian Hofhammer committed
Mar 5, 2026 at 11:06 UTC
9097087147cfc6b3f6412a67e07fd1f63a1ee325
19 files changed
+60
-22
linux-user/aarch64/cpu_loop.c
+1
-1
@@ -181,7 +181,7 @@ void cpu_loop(CPUARMState *env)
181
0, 0);
182
if (ret == -QEMU_ERESTARTSYS) {
183
env->pc -= 4;
184
- } else if (ret != -QEMU_ESIGRETURN) {
184
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
185
env->xregs[0] = ret;
186
}
187
break;
linux-user/alpha/cpu_loop.c
+1
-1
@@ -82,7 +82,7 @@ void cpu_loop(CPUAlphaState *env)
82
env->pc -= 4;
83
break;
84
}
85
- if (sysret == -QEMU_ESIGRETURN) {
85
+ if (sysret == -QEMU_ESIGRETURN || sysret == -QEMU_ESETPC) {
86
break;
87
}
88
/* Syscall writes 0 to V0 to bypass error check, similar
linux-user/arm/cpu_loop.c
+1
-1
@@ -399,7 +399,7 @@ void cpu_loop(CPUARMState *env)
399
0, 0);
400
if (ret == -QEMU_ERESTARTSYS) {
401
env->regs[15] -= env->thumb ? 2 : 4;
402
- } else if (ret != -QEMU_ESIGRETURN) {
402
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
403
env->regs[0] = ret;
404
}
405
}
linux-user/hexagon/cpu_loop.c
+1
-1
@@ -56,7 +56,7 @@ void cpu_loop(CPUHexagonState *env)
56
0, 0);
57
if (ret == -QEMU_ERESTARTSYS) {
58
env->gpr[HEX_REG_PC] -= 4;
59
- } else if (ret != -QEMU_ESIGRETURN) {
59
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
60
env->gpr[0] = ret;
61
}
62
break;
linux-user/hppa/cpu_loop.c
+1
@@ -124,6 +124,7 @@ void cpu_loop(CPUHPPAState *env)
124
break;
125
case -QEMU_ERESTARTSYS:
126
case -QEMU_ESIGRETURN:
127
+ case -QEMU_ESETPC:
128
break;
129
}
130
break;
linux-user/i386/cpu_loop.c
+5
-3
@@ -181,7 +181,9 @@ static void emulate_vsyscall(CPUX86State *env)
181
if (ret == -TARGET_EFAULT) {
182
goto sigsegv;
183
}
184
- env->regs[R_EAX] = ret;
184
+ if (ret != -QEMU_ESETPC) {
185
+ env->regs[R_EAX] = ret;
186
+ }
187
188
/* Emulate a ret instruction to leave the vsyscall page. */
189
env->eip = caller;
@@ -234,7 +236,7 @@ void cpu_loop(CPUX86State *env)
236
0, 0);
237
if (ret == -QEMU_ERESTARTSYS) {
238
env->eip -= 2;
237
- } else if (ret != -QEMU_ESIGRETURN) {
239
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
240
env->regs[R_EAX] = ret;
241
}
242
break;
@@ -253,7 +255,7 @@ void cpu_loop(CPUX86State *env)
255
0, 0);
256
if (ret == -QEMU_ERESTARTSYS) {
257
env->eip -= 2;
256
- } else if (ret != -QEMU_ESIGRETURN) {
258
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
259
env->regs[R_EAX] = ret;
260
}
261
break;
linux-user/include/special-errno.h
+8
@@ -29,4 +29,12 @@
29
*/
30
#define QEMU_ESIGRETURN 513
31
32
+/*
33
+ * This is returned after a plugin has used the qemu_plugin_set_pc API, to
34
+ * indicate that the plugin deliberately changed the PC and potentially
35
+ * modified the register values. The main loop should not touch the guest
36
+ * registers for this reason.
37
+ */
38
+#define QEMU_ESETPC 514
39
+
40
#endif /* SPECIAL_ERRNO_H */
linux-user/loongarch64/cpu_loop.c
+3
-2
@@ -44,9 +44,10 @@ void cpu_loop(CPULoongArchState *env)
44
env->pc -= 4;
45
break;
46
}
47
- if (ret == -QEMU_ESIGRETURN) {
47
+ if (ret == -QEMU_ESIGRETURN || ret == -QEMU_ESETPC) {
48
/*
49
- * Returning from a successful sigreturn syscall.
49
+ * Returning from a successful sigreturn syscall or from
50
+ * control flow diversion in a plugin callback.
51
* Avoid clobbering register state.
52
*/
53
break;
linux-user/m68k/cpu_loop.c
+1
-1
@@ -66,7 +66,7 @@ void cpu_loop(CPUM68KState *env)
66
0, 0);
67
if (ret == -QEMU_ERESTARTSYS) {
68
env->pc -= 2;
69
- } else if (ret != -QEMU_ESIGRETURN) {
69
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
70
env->dregs[0] = ret;
71
}
72
}
linux-user/microblaze/cpu_loop.c
+1
-1
@@ -54,7 +54,7 @@ void cpu_loop(CPUMBState *env)
54
if (ret == -QEMU_ERESTARTSYS) {
55
/* Wind back to before the syscall. */
56
env->pc -= 4;
57
- } else if (ret != -QEMU_ESIGRETURN) {
57
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
58
env->regs[3] = ret;
59
}
60
/* All syscall exits result in guest r14 being equal to the
linux-user/mips/cpu_loop.c
+6
-3
@@ -140,9 +140,12 @@ done_syscall:
140
env->active_tc.PC -= 4;
141
break;
142
}
143
- if (ret == -QEMU_ESIGRETURN) {
144
- /* Returning from a successful sigreturn syscall.
145
- Avoid clobbering register state. */
143
+ if (ret == -QEMU_ESIGRETURN || ret == -QEMU_ESETPC) {
144
+ /*
145
+ * Returning from a successful sigreturn syscall or from
146
+ * control flow diversion in a plugin callback.
147
+ * Avoid clobbering register state.
148
+ */
149
break;
150
}
151
if ((abi_ulong)ret >= (abi_ulong)-1133) {
linux-user/or1k/cpu_loop.c
+1
-1
@@ -48,7 +48,7 @@ void cpu_loop(CPUOpenRISCState *env)
48
cpu_get_gpr(env, 8), 0, 0);
49
if (ret == -QEMU_ERESTARTSYS) {
50
env->pc -= 4;
51
- } else if (ret != -QEMU_ESIGRETURN) {
51
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
52
cpu_set_gpr(env, 11, ret);
53
}
54
break;
linux-user/ppc/cpu_loop.c
+7
-3
@@ -340,9 +340,13 @@ void cpu_loop(CPUPPCState *env)
340
env->nip -= 4;
341
break;
342
}
343
- if (ret == (target_ulong)(-QEMU_ESIGRETURN)) {
344
- /* Returning from a successful sigreturn syscall.
345
- Avoid corrupting register state. */
343
+ if (ret == (target_ulong)(-QEMU_ESIGRETURN) ||
344
+ ret == (target_ulong)(-QEMU_ESETPC)) {
345
+ /*
346
+ * Returning from a successful sigreturn syscall or from
347
+ * control flow diversion in a plugin callback.
348
+ * Avoid corrupting register state.
349
+ */
350
break;
351
}
352
if (ret > (target_ulong)(-515)) {
linux-user/riscv/cpu_loop.c
+1
-1
@@ -65,7 +65,7 @@ void cpu_loop(CPURISCVState *env)
65
}
66
if (ret == -QEMU_ERESTARTSYS) {
67
env->pc -= 4;
68
- } else if (ret != -QEMU_ESIGRETURN) {
68
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
69
env->gpr[xA0] = ret;
70
}
71
if (cs->singlestep_enabled) {
linux-user/s390x/cpu_loop.c
+1
-1
@@ -83,7 +83,7 @@ void cpu_loop(CPUS390XState *env)
83
env->regs[6], env->regs[7], 0, 0);
84
if (ret == -QEMU_ERESTARTSYS) {
85
env->psw.addr -= env->int_svc_ilen;
86
- } else if (ret != -QEMU_ESIGRETURN) {
86
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
87
env->regs[2] = ret;
88
}
89
linux-user/sh4/cpu_loop.c
+1
-1
@@ -50,7 +50,7 @@ void cpu_loop(CPUSH4State *env)
50
0, 0);
51
if (ret == -QEMU_ERESTARTSYS) {
52
env->pc -= 2;
53
- } else if (ret != -QEMU_ESIGRETURN) {
53
+ } else if (ret != -QEMU_ESIGRETURN && ret != -QEMU_ESETPC) {
54
env->gregs[0] = ret;
55
}
56
break;
linux-user/sparc/cpu_loop.c
+3
-1
@@ -229,7 +229,9 @@ void cpu_loop (CPUSPARCState *env)
229
env->regwptr[2], env->regwptr[3],
230
env->regwptr[4], env->regwptr[5],
231
0, 0);
232
- if (ret == -QEMU_ERESTARTSYS || ret == -QEMU_ESIGRETURN) {
232
+ if (ret == -QEMU_ERESTARTSYS ||
233
+ ret == -QEMU_ESIGRETURN ||
234
+ ret == -QEMU_ESETPC) {
235
break;
236
}
237
if ((abi_ulong)ret >= (abi_ulong)(-515)) {
linux-user/syscall.c
+16
@@ -43,6 +43,7 @@
43
#include <linux/capability.h>
44
#include <sched.h>
45
#include <sys/timex.h>
46
+#include <setjmp.h>
47
#include <sys/socket.h>
48
#include <linux/sockios.h>
49
#include <sys/un.h>
@@ -600,6 +601,9 @@ const char *target_strerror(int err)
601
if (err == QEMU_ESIGRETURN) {
602
return "Successful exit from sigreturn";
603
}
604
+ if (err == QEMU_ESETPC) {
605
+ return "Successfully redirected control flow";
606
+ }
607
608
return strerror(target_to_host_errno(err));
609
}
@@ -14410,6 +14414,18 @@ abi_long do_syscall(CPUArchState *cpu_env, int num, abi_long arg1,
14414
return -QEMU_ESIGRETURN;
14415
}
14416
14417
+ /*
14418
+ * Set up a longjmp target here so that we can call cpu_loop_exit to
14419
+ * redirect control flow back to the main loop even from within
14420
+ * syscall-related plugin callbacks.
14421
+ * For other types of callbacks or longjmp call sites, the longjmp target
14422
+ * is set up in the cpu loop itself but in syscalls the target is not live
14423
+ * anymore.
14424
+ */
14425
+ if (unlikely(sigsetjmp(cpu->jmp_env, 0) != 0)) {
14426
+ return -QEMU_ESETPC;
14427
+ }
14428
+
14429
record_syscall_start(cpu, num, arg1,
14430
arg2, arg3, arg4, arg5, arg6, arg7, arg8);
14431
linux-user/xtensa/cpu_loop.c
+1
@@ -186,6 +186,7 @@ void cpu_loop(CPUXtensaState *env)
186
break;
187
188
case -QEMU_ESIGRETURN:
189
+ case -QEMU_ESETPC:
190
break;
191
}
192
break;