From: Andrew Jones <drjones@redhat.com>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: "Marcus Meissner" <meissner@suse.de>,
"Karl-Philipp Richter" <krichter722@aol.de>,
"Patch Tracking" <patches@linaro.org>,
"Riku Voipio" <riku.voipio@iki.fi>,
"QEMU Developers" <qemu-devel@nongnu.org>,
"Alexander Graf" <agraf@suse.de>,
"Paul Moore" <pmoore@redhat.com>,
"Eduardo Otubo" <eduardo.otubo@profitbricks.com>,
"Andreas Färber" <afaerber@suse.de>
Subject: Re: [Qemu-devel] [PATCH for-2.3] Revert seccomp tests that allow it to be used on non-x86 architectures
Date: Fri, 26 Jun 2015 18:03:18 +0200 [thread overview]
Message-ID: <20150626160318.GC3215@hawk.localdomain> (raw)
In-Reply-To: <CAFEAcA_AtVveNmHMGLDFmoTC0G0KGRXn=LeNojK3=jXh79fAug@mail.gmail.com>
On Tue, Jun 16, 2015 at 02:16:03PM +0100, Peter Maydell wrote:
> On 16 June 2015 at 14:12, Andrew Jones <drjones@redhat.com> wrote:
> > Can we now revert this revert, along with bumping the non-x86 arch
> > atleast-version to v2.2.1
>
> Probably. I suggest you submit a patch and test it on the
> relevant architectures and seccomp versions.
>
I don't see any problems with the light testing (booting a guest)
I've done on my mustang, but AArch64 worked with libseccomp 2.2.0
too. So I dusted off my Midway (updated to Fedora 21 that has
libseccomp 2.2.1 packaged), and gave it a try, but unfortunately
it still doesn't work...
I found that we needed to add another syscall to the whitelist;
the arm-private 'cacheflush', as it's used by __builtin___clear_cache.
And, from libseccomp's git history it appears that syscall is known
commit a710a2d246bdc73ba77e3ff5624e790688cc51fd
Author: Paul Moore <pmoore@redhat.com>
Date: Wed May 6 12:05:45 2015 -0400
arm: add some missing syscalls
Add the following syscalls to the ARM arch/ABI and update the syscall
validation script.
* breakpoint()
* cacheflush()
* usr26()
* usr32()
* set_tls()
Reported-by: Purcareata Bogdan <b43198@freescale.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
And also appears to be in 2.2.1
$ git describe a710a2d246bdc73ba77e3ff5624e790688cc51fd
v2.2.0-10-ga710a2d246bdc
However the qemu thread that makes that syscall still dies, even
with this patch
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index f9de0d3390feb..33644a4e3c3d3 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -237,7 +237,8 @@ static const struct QemuSeccompSyscall
seccomp_whitelist[] = {
{ SCMP_SYS(fadvise64), 240 },
{ SCMP_SYS(inotify_init1), 240 },
{ SCMP_SYS(inotify_add_watch), 240 },
- { SCMP_SYS(mbind), 240 }
+ { SCMP_SYS(mbind), 240 },
+ { SCMP_SYS(cacheflush), 240 },
};
int seccomp_start(void)
Paul, can you help me figure out what I'm missing?
Thanks,
drew
next prev parent reply other threads:[~2015-06-26 16:03 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-10 12:58 [Qemu-devel] [PATCH for-2.3] Revert seccomp tests that allow it to be used on non-x86 architectures Peter Maydell
2015-06-16 13:12 ` Andrew Jones
2015-06-16 13:16 ` Peter Maydell
2015-06-26 16:03 ` Andrew Jones [this message]
2015-06-26 20:26 ` Paul Moore
2015-06-29 7:50 ` Andrew Jones
2015-06-29 14:53 ` Paul Moore
2015-06-29 17:47 ` Andrew Jones
2015-06-29 20:24 ` Paul Moore
2015-06-30 8:39 ` Andrew Jones
2015-06-30 17:01 ` Paul Moore
2015-06-30 17:07 ` Peter Maydell
2015-06-30 17:18 ` Paul Moore
2015-07-01 12:07 ` Andrew Jones
2015-07-01 17:08 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150626160318.GC3215@hawk.localdomain \
--to=drjones@redhat.com \
--cc=afaerber@suse.de \
--cc=agraf@suse.de \
--cc=eduardo.otubo@profitbricks.com \
--cc=krichter722@aol.de \
--cc=meissner@suse.de \
--cc=patches@linaro.org \
--cc=peter.maydell@linaro.org \
--cc=pmoore@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=riku.voipio@iki.fi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.