linux-kernel - Re: [PATCH 02/10] x86: jailhouse: Add infrastructure for running in non-root cell

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 18 Nov 2017 20:21:45 +0100
From:   Jan Kiszka <jan.kiszka@....de>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Ingo Molnar <mingo@...hat.com>, "H . Peter Anvin" <hpa@...or.com>,
        x86@...nel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        jailhouse-dev@...glegroups.com
Subject: Re: [PATCH 02/10] x86: jailhouse: Add infrastructure for running in
 non-root cell

On 2017-11-17 22:54, Thomas Gleixner wrote:
> On Thu, 16 Nov 2017, Jan Kiszka wrote:
>   
>> +config JAILHOUSE_GUEST
>> +	bool "Jailhouse non-root cell support"
>> +	depends on PARAVIRT && X86_64
>> +	---help---
>> +	  This option allows to run Linux as guest in a Jailhouse non-root
>> +	  cell. You can leave this option disabled if you only want to start
>> +	  Jailhouse and run Linux afterwards in the root cell.
>> +
>> +	  You likely also want to disable CONFIG_SUSPEND and CONFIG_SERIO to
>> +	  avoid access to I/O resources that are usually not assigned to the
>> +	  non-root cell.
> 
> That should be prevented programatically.

Theoretically, serio access could also be assigned to a non-root cell.
But excluding SUSPEND may make sense unconditionally, will check again.

> 
>> +#include <linux/kernel.h>
>> +#include <asm/cpu.h>
>> +#include <asm/hypervisor.h>
>> +#include <asm/setup.h>
>> +
>> +#define SETUP_JAILHOUSE		0x53484c4a /* "JLHS" */
>> +
>> +#define SETUP_REQUIRED_VERSION	1
>> +
>> +/*
>> + * The boot loader is passing platform information via this Jailhouse-specific
>> + * setup data structure.
>> + */
>> +struct jailhouse_setup_data {
>> +	struct setup_data header;
>> +	u16 version;
>> +	u16 compatible_version;
>> +	u16 pm_timer_address;
>> +	u16 num_cpus;
>> +	u64 pci_mmconfig_base;
>> +	u8 standard_ioapic;
>> +	u8 cpu_ids[255];
> 
> Shouldn't this structure and SETUP_JAILHOUSE be defined in a header file
> which can be exported to boot loaders?

Something like arch/x86/include/uapi/asm/jailhouse_setup.h?

Jan