linux-kernel - Re: [PATCH 02/10] x86: jailhouse: Add infrastructure for running in non-root cell

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1711172248110.2186@nanos>
Date:   Fri, 17 Nov 2017 22:54:45 +0100 (CET)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Jan Kiszka <jan.kiszka@...mens.com>
cc:     Ingo Molnar <mingo@...hat.com>, "H . Peter Anvin" <hpa@...or.com>,
        x86@...nel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        jailhouse-dev@...glegroups.com
Subject: Re: [PATCH 02/10] x86: jailhouse: Add infrastructure for running in
 non-root cell

On Thu, 16 Nov 2017, Jan Kiszka wrote:
  
> +config JAILHOUSE_GUEST
> +	bool "Jailhouse non-root cell support"
> +	depends on PARAVIRT && X86_64
> +	---help---
> +	  This option allows to run Linux as guest in a Jailhouse non-root
> +	  cell. You can leave this option disabled if you only want to start
> +	  Jailhouse and run Linux afterwards in the root cell.
> +
> +	  You likely also want to disable CONFIG_SUSPEND and CONFIG_SERIO to
> +	  avoid access to I/O resources that are usually not assigned to the
> +	  non-root cell.

That should be prevented programatically.

> +#include <linux/kernel.h>
> +#include <asm/cpu.h>
> +#include <asm/hypervisor.h>
> +#include <asm/setup.h>
> +
> +#define SETUP_JAILHOUSE		0x53484c4a /* "JLHS" */
> +
> +#define SETUP_REQUIRED_VERSION	1
> +
> +/*
> + * The boot loader is passing platform information via this Jailhouse-specific
> + * setup data structure.
> + */
> +struct jailhouse_setup_data {
> +	struct setup_data header;
> +	u16 version;
> +	u16 compatible_version;
> +	u16 pm_timer_address;
> +	u16 num_cpus;
> +	u64 pci_mmconfig_base;
> +	u8 standard_ioapic;
> +	u8 cpu_ids[255];

Shouldn't this structure and SETUP_JAILHOUSE be defined in a header file
which can be exported to boot loaders?

Aside of that please write the struct in tabular fashion:

struct jailhouse_setup_data {
	struct setup_data	header;
	u16			version;
	....

> +};
> +
> +bool jailhouse_paravirt(void)
> +{
> +	return jailhouse_cpuid_base() != 0;
> +}
> +
> +const struct hypervisor_x86 x86_hyper_jailhouse __refconst = {
> +	.name = "Jailhouse",
> +	.detect = jailhouse_detect,
> +	.init = {
> +		.init_platform = jailhouse_init_platform,

See above.

Thanks,

	tglx