Re: [Qemu-devel] [PATCH] target/s390x/kvm: Fix problem when running with SELinux under z/VM

[Christian Borntraeger <borntraeger@de.ibm.com>]

On 03/29/2017 04:21 PM, Thomas Huth wrote:
> On 24.03.2017 10:39, Christian Borntraeger wrote:
>> On 03/24/2017 10:26 AM, Thomas Huth wrote:
>>> When running QEMU with KVM under z/VM, the memory for the guest
>>> is allocated via legacy_s390_alloc() since the KVM_CAP_S390_COW
>>> extension is not supported on z/VM. legacy_s390_alloc() then uses
>>> mmap(... PROT_EXEC ...) for the guest memory - but this does not
>>> work when running with SELinux enabled, mmap() fails and QEMU aborts
>>> with the following error message:
>>>
>>>  cannot set up guest memory 's390.ram': Permission denied
>>>
>>> Looking at the other allocator function qemu_anon_ram_alloc(), it
>>> seems like PROT_EXEC is normally not needed for allocating the
>>> guest RAM, and indeed, the guest also starts successfully under
>>> z/VM when we remove the PROT_EXEC from the legacy_s390_alloc()
>>> function. So let's get rid of that flag here to be able to run
>>> with SELinux under z/VM, too.
>>
>> Older z/VM versions do not provide the enhanced suppression on protection
>> facility, which would result in guest failures as soon as the kernel
>> starts dirty pages tracking by write protecting the pages via the page
>> table. Some kernel release back (last time I checked) the PROT_EXEC was 
>> necessary to prevent the dirty pages tracking from taking place. So this
>> patch would break KVM in that case.
>>
>> Newer z/VMs (e.g. 6.3) do provide ESOP. SO the question is,
>> why is KVM_CAP_S390_COW not set?
> 
> I now had another look at this, and seems like the ESOP bit is indeed
> not set in S390_lowcore.machine_flags here. According to /proc/sysinfo,
> z/VM is version 6.1.0 here, so I guess that's just too old for ESOP?

Yes, this was introduced with z/VM 6.3