From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36449) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ctETZ-0001CC-8Q for qemu-devel@nongnu.org; Wed, 29 Mar 2017 10:21:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ctETU-0006PT-JV for qemu-devel@nongnu.org; Wed, 29 Mar 2017 10:21:29 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49510) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ctETU-0006N9-Dd for qemu-devel@nongnu.org; Wed, 29 Mar 2017 10:21:24 -0400 References: <1490347615-19222-1-git-send-email-thuth@redhat.com> From: Thomas Huth Message-ID: Date: Wed, 29 Mar 2017 16:21:21 +0200 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] target/s390x/kvm: Fix problem when running with SELinux under z/VM List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Christian Borntraeger , qemu-devel@nongnu.org, Cornelia Huck On 24.03.2017 10:39, Christian Borntraeger wrote: > On 03/24/2017 10:26 AM, Thomas Huth wrote: >> When running QEMU with KVM under z/VM, the memory for the guest >> is allocated via legacy_s390_alloc() since the KVM_CAP_S390_COW >> extension is not supported on z/VM. legacy_s390_alloc() then uses >> mmap(... PROT_EXEC ...) for the guest memory - but this does not >> work when running with SELinux enabled, mmap() fails and QEMU aborts >> with the following error message: >> >> cannot set up guest memory 's390.ram': Permission denied >> >> Looking at the other allocator function qemu_anon_ram_alloc(), it >> seems like PROT_EXEC is normally not needed for allocating the >> guest RAM, and indeed, the guest also starts successfully under >> z/VM when we remove the PROT_EXEC from the legacy_s390_alloc() >> function. So let's get rid of that flag here to be able to run >> with SELinux under z/VM, too. > > Older z/VM versions do not provide the enhanced suppression on protection > facility, which would result in guest failures as soon as the kernel > starts dirty pages tracking by write protecting the pages via the page > table. Some kernel release back (last time I checked) the PROT_EXEC was > necessary to prevent the dirty pages tracking from taking place. So this > patch would break KVM in that case. > > Newer z/VMs (e.g. 6.3) do provide ESOP. SO the question is, > why is KVM_CAP_S390_COW not set? I now had another look at this, and seems like the ESOP bit is indeed not set in S390_lowcore.machine_flags here. According to /proc/sysinfo, z/VM is version 6.1.0 here, so I guess that's just too old for ESOP? Thomas