[Deepin-Kernel-SIG] [linux 6.6.y] [HAOC] some HAOC fixes

arch/arm64/include/asm/haoc/iee.h

@@ -66,7 +66,7 @@ extern bool haoc_enabled;
 
 #define TCR_HPD1		(UL(1) << 42)
 
-void iee_init_mappings(pgd_t *pgdp);
+void __init iee_init_mappings(pgd_t *pgdp);
 void iee_init_post(void);
 void iee_stack_init(void);
 void iee_init_tcr(void);

arch/arm64/kernel/haoc/Kconfig

@@ -34,6 +34,7 @@ config IEE_SIP
 config CREDP
 	bool "Struct cred protection(CREDP)"
 	depends on IEE
+	select IEE_PTRP
 	help
 		Protects kernel struct cred. All modifications of cred must be made and
 		verified by IEE APIs, and critical dereferences of cred would be monitored

arch/arm64/kernel/haoc/iee/iee-mmu.c

@@ -487,7 +487,7 @@ static void __init __create_pgd_mapping_for_iee_locked(pgd_t *pgdir, phys_addr_t
 	} while (pgdp++, addr = next, addr != end);
 }
 
-static void __create_pgd_mapping_for_iee(pgd_t *pgdir, phys_addr_t phys,
+static void __init __create_pgd_mapping_for_iee(pgd_t *pgdir, phys_addr_t phys,
 				 unsigned long virt, phys_addr_t size,
 				 pgprot_t prot,
 				 phys_addr_t (*pgtable_alloc)(int),

arch/x86/Kconfig

@@ -1576,6 +1576,7 @@ config IEE_SIP
 config CREDP
 	bool "Struct cred protection(CREDP)"
 	depends on IEE
+	select IEE_PTRP
 	help
 		Protects kernel struct cred. All modifications of cred must be made and
 		verified by IEE APIs, and critical dereferences of cred would be monitored

arch/x86/boot/compressed/ident_map_64.c

@@ -180,14 +180,7 @@ void initialize_identity_maps(void *rmode)
 	sev_prep_identity_maps(top_level_pgt);
 
 	/* Load the new page-table. */
-	#ifdef CONFIG_IEE_SIP
-	if(haoc_enabled)
-		iee_write_cr3_early(top_level_pgt);
-	else
-		write_cr3(top_level_pgt);
-	#else
 	write_cr3(top_level_pgt);
-	#endif
 
 	/*
 	 * Now that the required page table mappings are established and a
@@ -231,14 +224,7 @@ static pte_t *split_large_pmd(struct x86_mapping_info *info,
 	pmd = __pmd((unsigned long)pte | info->kernpg_flag);
 	set_pmd(pmdp, pmd);
 	/* Flush TLB to establish the new PMD */
-	#ifdef CONFIG_IEE_SIP
-	if(haoc_enabled)
-		iee_write_cr3_early(top_level_pgt);
-	else
-		write_cr3(top_level_pgt);
-	#else
 	write_cr3(top_level_pgt);
-	#endif
 
 	return pte + pte_index(__address);
 }
@@ -339,14 +325,7 @@ static int set_clr_page_flags(struct x86_mapping_info *info,
 		snp_set_page_private(__pa(address & PAGE_MASK));
 
 	/* Flush TLB after changing encryption attribute */
-	#ifdef CONFIG_IEE_SIP
-	if(haoc_enabled)
-		iee_write_cr3_early(top_level_pgt);
-	else
-		write_cr3(top_level_pgt);
-	#else
 	write_cr3(top_level_pgt);
-	#endif
 
 	return 0;
 }

arch/x86/boot/compressed/pgtable_64.c

@@ -200,14 +200,7 @@ asmlinkage void configure_5level_paging(struct boot_params *bp, void *pgtable)
 	 * Move the top level page table out of trampoline memory.
 	 */
 	memcpy(pgtable, trampoline_32bit, PAGE_SIZE);
-	#ifdef CONFIG_IEE_SIP
-	if(haoc_enabled)
-		iee_write_cr3_early((unsigned long)pgtable);
-	else
-		native_write_cr3((unsigned long)pgtable);
-	#else
 	native_write_cr3((unsigned long)pgtable);
-	#endif
 
 	/* Restore trampoline memory */
 	memcpy(trampoline_32bit, trampoline_save, TRAMPOLINE_32BIT_SIZE);

arch/x86/include/asm/desc.h

@@ -13,7 +13,7 @@
 #include <linux/smp.h>
 #include <linux/percpu.h>
 
-#ifdef CONFIG_IEE_SIP
+#if defined(CONFIG_IEE_SIP) && !defined(__DISABLE_EXPORTS)
 #include <asm/haoc/iee-si.h>
 extern bool haoc_enabled;
 #endif
@@ -215,7 +215,7 @@ static inline void native_load_gdt(const struct desc_ptr *dtr)
 	asm volatile("lgdt %0"::"m" (*dtr));
 }
 
-#ifdef CONFIG_IEE_SIP
+#if defined(CONFIG_IEE_SIP) && !defined(__DISABLE_EXPORTS)
 static __always_inline void iee_load_idt_early(const struct desc_ptr *dtr)
 {
 	asm volatile("lidt %0"::"m" (*dtr));
@@ -224,7 +224,7 @@ static __always_inline void iee_load_idt_early(const struct desc_ptr *dtr)
 
 static __always_inline void native_load_idt(const struct desc_ptr *dtr)
 {
-	#ifdef CONFIG_IEE_SIP
+	#if defined(CONFIG_IEE_SIP) && !defined(__DISABLE_EXPORTS)
 	if(haoc_enabled)
 		iee_load_idt((void *)dtr);
 	else
@@ -261,7 +261,7 @@ static inline void native_idt_invalidate(void)
 		.size = 0
 	};
 
-#ifdef CONFIG_IEE_SIP
+#if defined(CONFIG_IEE_SIP) && !defined(__DISABLE_EXPORTS)
 	// The native_idt_invalidate() is only called by machine_kexec(). 
 	// In the kdump path, IEE_SIP should not be used, so we directly
 	// call iee_load_idt_early(), which is the original version of

arch/x86/include/asm/haoc/haoc.h

@@ -75,4 +75,8 @@ void _iee_set_cred_security(unsigned long __unused, struct cred *cred,void *secu
 void _iee_set_cred_rcu(unsigned long __unused, struct cred *cred, struct rcu_head *rcu);
 void _iee_set_cred_ucounts(unsigned long __unused, struct cred *cred, struct ucounts *ucounts);
 #endif
+
+/* Called from iee_rw_gate (asm) to dispatch IEE ops to the _iee_*() functions. */
+unsigned long iee_dispatch(int flag, unsigned long arg1,
+			   unsigned long arg2, unsigned long arg3);
 #endif

arch/x86/include/asm/haoc/iee-si.h

@@ -7,9 +7,10 @@
 #define __iee_si_code   __section(".iee.si_text")
 #define __iee_si_data   __section(".iee.si_data")
 
-extern unsigned long cr4_pinned_mask;
+extern const unsigned long cr4_pinned_mask;
 extern struct static_key_false cr_pinning;
 extern unsigned long cr4_pinned_bits;
+extern unsigned long iee_cr4_set_mask;
 
 extern unsigned long __iee_si_text_start[];
 extern unsigned long __iee_si_text_end[];

arch/x86/include/asm/haoc/iee-token.h

@@ -10,6 +10,7 @@ extern unsigned long long iee_rw_gate(int flag, ...);
 
 extern struct kmem_cache *task_struct_cachep;
 
+extern void iee_prepare_init_task_token(void);
 extern void iee_set_token_page_valid(unsigned long token, unsigned long new,
 				     unsigned int order);
 extern void iee_set_token_page_invalid(unsigned long token_addr,

arch/x86/include/asm/special_insns.h

@@ -9,7 +9,7 @@
 #include <asm/processor-flags.h>
 #include <linux/irqflags.h>
 #include <linux/jump_label.h>
-#ifdef CONFIG_IEE_SIP
+#if defined(CONFIG_IEE_SIP) && !defined(__DISABLE_EXPORTS)
 #include <asm/haoc/iee-si.h>
 extern bool haoc_enabled;
 #endif
@@ -53,7 +53,7 @@ static inline unsigned long __native_read_cr3(void)
 	return val;
 }
 
-#ifdef CONFIG_IEE_SIP
+#if defined(CONFIG_IEE_SIP) && !defined(__DISABLE_EXPORTS)
 static inline void iee_write_cr3_early(unsigned long val)
 {
 	asm volatile("mov %0,%%cr3" : : "r" (val) : "memory");
@@ -62,7 +62,7 @@ static inline void iee_write_cr3_early(unsigned long val)
 
 static inline void native_write_cr3(unsigned long val)
 {
-	#ifdef CONFIG_IEE_SIP
+	#if defined(CONFIG_IEE_SIP) && !defined(__DISABLE_EXPORTS)
 	if(haoc_enabled)
 		iee_write_cr3(val);
 	else

arch/x86/kernel/cpu/common.c

@@ -406,7 +406,7 @@ static __always_inline void setup_umip(struct cpuinfo_x86 *c)
 
 /* These bits should not change their value after CPU init is finished. */
 #ifdef CONFIG_IEE_SIP
-unsigned long cr4_pinned_mask =
+const unsigned long cr4_pinned_mask =
 	X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP |
 	X86_CR4_FSGSBASE | X86_CR4_CET;
 DEFINE_STATIC_KEY_FALSE_RO(cr_pinning);
@@ -2088,6 +2088,15 @@ static void identify_cpu(struct cpuinfo_x86 *c)
 	/* Disable the PN if appropriate */
 	squash_the_stupid_serial_number(c);
 
+#ifdef CONFIG_IEE_SIP
+	/*
+	 * The IEE rwx gate re-enables SMEP/SMAP from this mask; keep it in
+	 * sync with what setup_smep()/setup_smap() are about to enable.
+	 */
+	iee_cr4_set_mask = (cpu_has(c, X86_FEATURE_SMEP) ? X86_CR4_SMEP : 0) |
+			   (cpu_has(c, X86_FEATURE_SMAP) ? X86_CR4_SMAP : 0);
+#endif /* CONFIG_IEE_SIP */
+
 	/* Set up SMEP/SMAP/UMIP */
 	setup_smep(c);
 	setup_smap(c);