Update HAOC 3.0 to HAOC 4.0 for Deepin

arch/arm64/configs/deepin_arm64_desktop_defconfig

@@ -162,9 +162,16 @@ CONFIG_PMIC_OPREGION=y
 CONFIG_VIRTUALIZATION=y
 CONFIG_KVM=y
 CONFIG_IEE=y
+CONFIG_PTP=y
+CONFIG_PTP_RESERVE_ORDER=12
 CONFIG_IEE_PTRP=y
+CONFIG_IEE_PTRP_W=y
 CONFIG_IEE_SIP=y
 CONFIG_CREDP=y
+CONFIG_KEYP=y
+CONFIG_IEE_SELINUX_P=y
+CONFIG_PTP_S=y
+CONFIG_VARP=y
 CONFIG_KPROBES=y
 CONFIG_SHADOW_CALL_STACK=y
 CONFIG_MODULES=y

arch/arm64/include/asm/fixmap.h

@@ -109,6 +109,10 @@ void __init fixmap_copy(pgd_t *pgdir);
 
 extern void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot);
 
+#ifdef CONFIG_PTP
+#include <asm/haoc/iee-ptp-init.h>
+#endif
+
 #include <asm-generic/fixmap.h>
 
 #endif /* !__ASSEMBLY__ */

arch/arm64/include/asm/haoc/haoc-bitmap.h

@@ -0,0 +1,91 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_HAOC_BITMAP_H
+#define _LINUX_HAOC_BITMAP_H
+
+#include <asm/haoc/haoc-def.h>
+#include <linux/types.h>
+
+/* HAOC_NORMAL means */
+enum HAOC_BITMAP_TYPE {
+	IEE_NORMAL = 0,		/* Non-IEE pages */
+	IEE_DATA,
+	IEE_TOKEN,
+	IEE_PGTABLE,
+	IEE_USER_PGTABLE,  /* for PTP_S */
+	IEE_KEY,
+	IEE_SELINUX,
+	IEE_VARP,
+	IEE_CRED,
+};
+
+#include <linux/mm.h>
+
+#define HAOC_BITMAP_START	VMEMMAP_END
+#define haoc_bitmap_base	((uint8_t *)HAOC_BITMAP_START - \
+				 (memstart_addr >> PAGE_SHIFT))
+
+#define __pfn_to_haoc_bitmap(pfn)	(haoc_bitmap_base + (pfn))
+
+#define __va_to_haoc_bitmap(va)	({	\
+	uint8_t *__ret;					\
+	if (__is_lm_address((u64)va))	\
+		__ret = __pfn_to_haoc_bitmap(PHYS_PFN(__pa(va)));		\
+	else						\
+		__ret = __pfn_to_haoc_bitmap(PHYS_PFN(__pa_symbol(va)));	\
+	__ret;						\
+})
+
+extern bool haoc_enabled;
+extern bool haoc_bitmap_ready;
+
+extern int haoc_bitmap_sparse_init(void);
+extern void haoc_bitmap_setup(void);
+extern void setup_iee_early_data_bitmap(void);
+
+static inline enum HAOC_BITMAP_TYPE iee_get_bitmap_type(unsigned long va)
+{
+	return *__va_to_haoc_bitmap(va);
+}
+
+void _iee_set_bitmap_type(unsigned long __unused,
+				u64 va, enum HAOC_BITMAP_TYPE type, int num_pages);
+
+static inline void iee_set_bitmap_type(unsigned long va,
+					int num_pages, enum HAOC_BITMAP_TYPE type)
+{
+	iee_rw_gate(IEE_OP_SET_BITMAP_TYPE, va, type, num_pages);
+}
+
+static inline void iee_verify_type(unsigned long va, enum HAOC_BITMAP_TYPE type,
+					const char *name)
+{
+	if (haoc_enabled) {
+		uint8_t bit_type = iee_get_bitmap_type(va);
+
+		if (unlikely(bit_type != type))
+			panic("IEE detected type: %d, fake %s: va(0x%lx)", bit_type, name, va);
+	}
+}
+
+static inline unsigned long iee_test_not_normal(void *start, void *end)
+{
+	unsigned long addr;
+
+	if (!haoc_enabled)
+		return 0;
+	addr = (unsigned long)start;
+	while (addr < (unsigned long)end) {
+		if (unlikely(iee_get_bitmap_type(addr) == IEE_NORMAL))
+			return addr;
+		addr += PAGE_SIZE;
+	}
+	return 0;
+}
+
+#define iee_verify_not_normal(start, end) ({	\
+	unsigned long __addr = iee_test_not_normal(start, end);	\
+	if (__addr)		\
+		panic("HAOC: (%s)operate on IEE bitmap type normal 0x%lx.", __func__, __addr);	\
+})
+
+#endif

arch/arm64/include/asm/haoc/haoc-def.h

@@ -21,12 +21,16 @@ enum {
 	IEE_OP_INVALIDATE_TOKEN,
 	IEE_OP_VALIDATE_TOKEN,
 #endif
+	IEE_OP_SET_BITMAP_TYPE,
 #ifdef CONFIG_CREDP
 	IEE_OP_COPY_CRED,
 	IEE_OP_COPY_KERNEL_CRED,
 	IEE_OP_INIT_COPIED_CRED,
 	IEE_OP_COMMIT_CRED,
 	IEE_OP_ABORT_CRED,
+	IEE_OP_FILL_SESSION_KEYRING_CRED,
+	IEE_OP_OVERRIDE_CRED,
+	IEE_OP_REVERT_CRED,
 	IEE_OP_SET_CRED_UID,
 	IEE_OP_SET_CRED_GID,
 	IEE_OP_SET_CRED_SUID,
@@ -55,6 +59,60 @@ enum {
 	IEE_OP_SET_CRED_SECURITY,
 	IEE_OP_SET_CRED_RCU,
 	IEE_OP_SET_CRED_UCOUNTS,
+#endif
+#ifdef CONFIG_PTP
+	IEE_OP_SET_TRAMP_PGD,
+	IEE_OP_SET_BM_PTE,
+	IEE_OP_SET_PTE,
+	IEE_OP_SET_PMD,
+	IEE_OP_SET_PUD,
+	IEE_OP_SET_P4D,
+	IEE_OP_SET_SWAPPER_PGD,
+	IEE_OP_SET_XCHG,
+	IEE_OP_SET_PMD_XCHG,
+	IEE_OP_SET_CMPXCHG,
+	IEE_OP_SET_PMD_CMPXCHG,
+	IEE_OP_SET_SENSITIVE_PTE,
+	IEE_OP_UNSET_SENSITIVE_PTE,
+#endif
+#ifdef CONFIG_KEYP
+	IEE_OP_SET_KEY_UNION,
+	IEE_OP_SET_KEY_STRUCT,
+	IEE_OP_SET_KEY_PAYLOAD,
+	IEE_OP_SET_KEY_USAGE,
+	IEE_OP_SET_KEY_SERIAL,
+	IEE_OP_SET_KEY_WATCHERS,
+	IEE_OP_SET_KEY_USERS,
+	IEE_OP_SET_KEY_SECURITY,
+	IEE_OP_SET_KEY_EXPIRY,
+	IEE_OP_SET_KEY_REVOKED_AT,
+	IEE_OP_SET_KEY_LAST_USED_AT,
+	IEE_OP_SET_KEY_UID,
+	IEE_OP_SET_KEY_GID,
+	IEE_OP_SET_KEY_PERM,
+	IEE_OP_SET_KEY_QUOTALEN,
+	IEE_OP_SET_KEY_DATALEN,
+	IEE_OP_SET_KEY_STATE,
+	IEE_OP_SET_KEY_MAGIC,
+	IEE_OP_SET_KEY_FLAGS,
+	IEE_OP_SET_KEY_INDEX_KEY,
+	IEE_OP_SET_KEY_HASH,
+	IEE_OP_SET_KEY_LEN_DESC,
+	IEE_OP_SET_KEY_TYPE,
+	IEE_OP_SET_KEY_TAG,
+	IEE_OP_SET_KEY_DESCRIPTION,
+	IEE_OP_SET_KEY_RESTRICT_LINK,
+	IEE_OP_SET_KEY_FLAG_BIT,
+#endif
+#ifdef CONFIG_IEE_SELINUX_P
+	IEE_SEL_SET_STATUS_PG,
+	IEE_SEL_SET_ENFORCING,
+	IEE_SEL_SET_INITIALIZED,
+	IEE_SEL_SET_POLICY_CAP,
+	IEE_SEL_RCU_ASSIGN_POLICY,
+#endif
+#ifdef CONFIG_VARP
+	IEE_OP_SET_VARP_MODPROBE_PATH,
 #endif
 	IEE_FLAG_END
 };
@@ -65,6 +123,17 @@ enum {
 #define AT_SUB_AND_TEST 3
 #endif
 
+#ifdef CONFIG_KEYP
+#define REFCOUNT_INC 1
+#define REFCOUNT_SET 2
+#define REFCOUNT_DEC_AND_TEST 3
+#define REFCOUNT_INC_NOT_ZERO 4
+
+#define SET_BIT_OP 1
+#define TEST_AND_CLEAR_BIT 2
+#define TEST_AND_SET_BIT 3
+#endif
+
 /* The entry gate of all IEE APIs. The first parameter must be a valid
  * IEE function index.
  */

arch/arm64/include/asm/haoc/haoc.h

@@ -10,6 +10,7 @@
 #ifndef _LINUX_HAOC_H
 #define _LINUX_HAOC_H
 
+#include <asm/haoc/haoc-bitmap.h>
 #include <linux/types.h>
 #include <linux/mm.h>
 
@@ -26,16 +27,25 @@ void _iee_init_token(unsigned long __unused, struct task_struct *tsk);
 void _iee_invalidate_token(unsigned long __unused, struct task_struct *tsk);
 void _iee_validate_token(unsigned long __unused, struct task_struct *tsk);
 #endif
+void _iee_set_bitmap_type(unsigned long __unused, u64 va,
+		enum HAOC_BITMAP_TYPE type, int num_pages);
 
 #ifdef CONFIG_CREDP
 #include <linux/cred.h>
 
 void _iee_copy_cred(unsigned long __unused, struct cred *new);
 void _iee_copy_kernel_cred(unsigned long iee_offset, const struct cred *old, struct cred *new);
 void _iee_abort_cred(unsigned long iee_offset, const struct cred *cred);
+void _iee_fill_cred_for_session_keyring(unsigned long __unused,
+					struct cred *new,
+					const struct cred *old);
 void _iee_init_copied_cred(unsigned long iee_offset, struct task_struct *new_task,
 		struct cred *new);
 void _iee_commit_creds(unsigned long iee_offset, const struct cred *new);
+void _iee_override_creds(unsigned long iee_offset, const struct cred *new);
+void _iee_fill_cred_for_session_keyring(unsigned long __unused, struct cred *new,
+		const struct cred *old);
+void _iee_revert_creds(unsigned long iee_offset, const struct cred *old);
 void _iee_set_cred_uid(unsigned long __unused, struct cred *cred, kuid_t uid);
 void _iee_set_cred_gid(unsigned long __unused, struct cred *cred, kgid_t gid);
 void _iee_set_cred_suid(unsigned long __unused, struct cred *cred, kuid_t suid);
@@ -81,4 +91,81 @@ void _iee_set_cred_rcu(unsigned long __unused, struct cred *cred, struct rcu_hea
 void _iee_set_cred_ucounts(unsigned long __unused, struct cred *cred,
 			struct ucounts *ucounts);
 #endif
+
+#ifdef CONFIG_PTP
+#include <linux/hugetlb.h>
+
+void __iee_code _iee_set_static_pgd(int flag, pgd_t *pgdp, pgd_t pgd);
+void __iee_code _iee_set_bm_pte(int flag, pte_t *ptep, pte_t pte);
+void __iee_code _iee_set_pte(int flag, pte_t *ptep, pte_t pte);
+void __iee_code _iee_set_pmd(int flag, pmd_t *pmdp, pmd_t pmd);
+void __iee_code _iee_set_pud(int flag, pud_t *pudp, pud_t pud);
+void __iee_code _iee_set_p4d(int flag, p4d_t *p4dp, p4d_t p4d);
+void __iee_code _iee_set_swapper_pgd(int flag, pgd_t *pgdp, pgd_t pgd);
+pteval_t __iee_code _iee_set_xchg_relaxed(int flag, pte_t *ptep,
+			pteval_t pteval);
+pmdval_t __iee_code _iee_set_pmd_xchg_relaxed(int flag, pmd_t *pmdp,
+			pmdval_t pmdval);
+pteval_t __iee_code _iee_set_cmpxchg_relaxed(int flag, pte_t *ptep,
+			pteval_t old_pteval, pteval_t new_pteval);
+pmdval_t __iee_code _iee_set_pmd_cmpxchg_relaxed(int flag, pmd_t *pmdp,
+			pmdval_t old_pmdval, pmdval_t new_pmdval);
+void __iee_code _iee_set_sensitive_pte(int flag, pte_t *lm_ptep,
+			pte_t *iee_ptep, int order, int use_block_pmd, bool writable);
+void __iee_code _iee_unset_sensitive_pte(int flag, pte_t *lm_ptep,
+			pte_t *iee_ptep, int order, int use_block_pmd);
+#endif
+
+#ifdef CONFIG_KEYP
+#include <linux/key.h>
+struct watch_list;
+
+void _iee_set_key_union(unsigned long __unused, struct key *key, struct key_union *key_union);
+void _iee_set_key_struct(unsigned long __unused, struct key *key, struct key_struct *key_struct);
+void _iee_set_key_payload(unsigned long __unused, struct key *key, union key_payload *key_payload);
+unsigned long _iee_set_key_usage(unsigned long __unused, struct key *key, int n, int flag);
+void _iee_set_key_serial(unsigned long __unused, struct key *key, key_serial_t serial);
+void _iee_set_key_watchers(unsigned long __unused, struct key *key, struct watch_list *watchers);
+void _iee_set_key_user(unsigned long __unused, struct key *key, struct key_user *user);
+void _iee_set_key_security(unsigned long __unused, struct key *key, void *security);
+void _iee_set_key_expiry(unsigned long __unused, struct key *key, time64_t expiry);
+void _iee_set_key_revoked_at(unsigned long __unused, struct key *key, time64_t revoked_at);
+void _iee_set_key_last_used_at(unsigned long __unused, struct key *key, time64_t last_used_at);
+void _iee_set_key_uid(unsigned long __unused, struct key *key, kuid_t uid);
+void _iee_set_key_gid(unsigned long __unused, struct key *key, kgid_t gid);
+void _iee_set_key_perm(unsigned long __unused, struct key *key, key_perm_t perm);
+void _iee_set_key_quotalen(unsigned long __unused, struct key *key, unsigned short quotalen);
+void _iee_set_key_datalen(unsigned long __unused, struct key *key, unsigned short datalen);
+void _iee_set_key_state(unsigned long __unused, struct key *key, short state);
+void _iee_set_key_magic(unsigned long __unused, struct key *key, unsigned int magic);
+void _iee_set_key_flags(unsigned long __unused, struct key *key, unsigned long flags);
+void _iee_set_key_index_key(unsigned long __unused, struct key *key,
+					struct keyring_index_key *index_key);
+void _iee_set_key_hash(unsigned long __unused, struct key *key, unsigned long hash);
+void _iee_set_key_len_desc(unsigned long __unused, struct key *key, unsigned long len_desc);
+void _iee_set_key_type(unsigned long __unused, struct key *key, struct key_type *type);
+void _iee_set_key_domain_tag(unsigned long __unused, struct key *key, struct key_tag *domain_tag);
+void _iee_set_key_description(unsigned long __unused, struct key *key, char *description);
+void _iee_set_key_restrict_link(unsigned long __unused, struct key *key,
+					struct key_restriction *restrict_link);
+unsigned long _iee_set_key_flag_bit(unsigned long __unused, struct key *key, long nr, int flag);
+#endif
+
+#ifdef CONFIG_IEE_SELINUX_P
+struct page;
+struct selinux_policy;
+
+void _iee_set_selinux_status_pg(unsigned long __unused, struct page *new_page);
+void _iee_set_selinux_enforcing(unsigned long __unused, bool value);
+void _iee_mark_selinux_initialized(unsigned long __unused);
+void _iee_set_sel_policy_cap(unsigned long __unused, unsigned int idx, int cap);
+void _iee_sel_rcu_assign_policy(unsigned long __unused,
+			struct selinux_policy *new_policy, struct selinux_policy *iee_new_policy);
+#endif
+
+#ifdef CONFIG_VARP
+void _iee_set_varp_modprobe_path(unsigned long __unused, char *data, int maxlen, size_t len,
+		char *buffer, size_t *lenp);
+#endif
+
 #endif