From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1Fafyi-0006od-D2
	for qemu-devel@nongnu.org; Mon, 01 May 2006 17:30:48 -0400
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1Fafyh-0006nM-I9
	for qemu-devel@nongnu.org; Mon, 01 May 2006 17:30:47 -0400
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1Fafyh-0006nA-CN
	for qemu-devel@nongnu.org; Mon, 01 May 2006 17:30:47 -0400
Received: from [84.96.92.61] (helo=sMtp.neuf.fr)
	by monty-python.gnu.org with esmtp (Exim 4.52) id 1Fafyi-0005sz-12
	for qemu-devel@nongnu.org; Mon, 01 May 2006 17:30:48 -0400
Received: from [84.102.211.147] by sp604002mt.gpm.neuf.ld
	(Sun Java System Messaging Server 6.2-5.05 (built Feb 16 2006))
	with ESMTP id <0IYL000I2VR199P0@sp604002mt.gpm.neuf.ld> for
	qemu-devel@nongnu.org; Mon, 01 May 2006 23:30:37 +0200 (CEST)
Date: Mon, 01 May 2006 23:29:54 +0200
From: Fabrice Bellard <fabrice@bellard.org>
Subject: Re: [Qemu-devel] bug report : kqemu and self-writing code
In-reply-to: <200605012153.51699.even.rouault@mines-paris.org>
Message-id: <44567DD2.8040708@bellard.org>
MIME-version: 1.0
Content-type: text/plain; charset=us-ascii; format=flowed
Content-transfer-encoding: 7BIT
References: <200605012153.51699.even.rouault@mines-paris.org>
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

Are you sure that the bug is really in kqemu ? It is possible that your 
guest kernel implements a security system which prevents self modifying 
code using segment limits which QEMU does not check (but kqemu checks 
them !).

Regards,

Fabrice.

Even Rouault wrote:
> Guest OS : Linux 2.6.15-1.2054_FC5 i686 (Fedora Core 5 i386)
> Host OS: Linux 2.6.12-10-amd64-k8 #1 x86_64 (Ubuntu 5.10 amd64)
> QEMU Version : today CVS compiled with kqemu support
> KQEMU : 1.3.0pre6
> Binary used : qemu-system-x86-64 (so kqemu user-mode is used)
> 
> I'm running the simple C code attached. With kqemu user-mode, this fails 
> (sigsegv) with the following warning in dmesg :
> 
> audit(1146505373.813:12): avc:  denied { execheap } for pid=1860 
> comm="selfmodifying scontext=user_u:system_r:unconfined_t:s0 
> tcontext=user_u:system_r:unconfined_t:s0 tclass=process
> Erreur de segmentation
> 
> Without kqemu enabled, it runs fine.
> 
> 
> 
> ------------------------------------------------------------------------
> 
> #define _XOPEN_SOURCE 600
> #include <sys/mman.h>
> #include <unistd.h>
> #include <stdlib.h>
> #include <stdio.h>
> 
> int main(int argc, char** argv)
> {
>   int pagesize = getpagesize();
>   unsigned char* addr = NULL;
>   posix_memalign((void**)&addr, pagesize, pagesize);
>   mprotect(addr, pagesize, PROT_WRITE | PROT_READ | PROT_EXEC);
>   addr[0] = 0x8b; addr[1] = 0x44; addr[2] = 0x24; addr[3] = 0x04; /* mov    0x4(%esp),%eax */
>   addr[4] = 0x83; addr[5] = 0xc0; addr[6] = 0x01; /* add    $0x1,%eax */
>   addr[7] = 0xc3; /* ret */
>   
>   printf("10+1=%d\n", ((int (*)(int))addr)(10));
>   free(addr);
>   return 0;
> }
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Qemu-devel mailing list
> Qemu-devel@nongnu.org
> http://lists.nongnu.org/mailman/listinfo/qemu-devel