deepin-community · opsiff · Mar 21, 2024 · Mar 30, 2024 · Mar 8, 2024 · Mar 25, 2021
diff --git a/Documentation/arch/x86/hygon-secure-virtualization.rst b/Documentation/arch/x86/hygon-secure-virtualization.rst
@@ -0,0 +1,100 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+===========================
+HYGON Secure Virtualization
+===========================
+
+China Secure Virtualization (CSV) is a key virtualization feature on Hygon
+processors.
+
+The 1st generation of CSV (CSV for short) is a secure virtualization technology
+to provide memory encryption for the virtual machine (VM), each VM's memory is
+encrypted by its unique encryption key which is managed by secure processor.
+
+The 2nd generation of CSV (CSV2 for short) provides security enhancement to CSV
+by encrypting not only the VM's memory but also the vCPU's registers of the VM.
+
+The 3rd generation of CSV (CSV3 for short) is a more advanced secure
+virtualization technology, it integrates secure processor, memory encryption and
+memory isolation to provide the ability to protect guest's private data. The CSV3
+guest's context like CPU registers, control block and nested page table is accessed
+only by the guest itself and the secure processor. Neither other guests nor the
+host can tamper with the guest's context.
+
+The secure processor is a separate processor inside Hygon hardware. The firmware
+running inside the secure processor performs activities in a secure way, such as
+OVMF encryption, VM launch, secure memory management and nested page table
+management etc. For more information, please see CSV spec and CSV3 spec from Hygon.
+
+A CSV guest is running in the memory that is encrypted with a dedicated encrypt
+key which is set by the secure processor. And CSV guest's memory encrypt key is
+unique from the others. A low latency crypto engine resides on Hygon hardware
+to minimize the negative effect on memory bandwidth. In CSV guest, a guest private
+page will be automatically decrypted when read from memory and encrypted when
+written to memory.
+
+CSV3 provides an enhancement technology named memory isolation to improve the
+security. A dedicated memory isolation hardware is built in Hygon hardware. Only
+the secure processor has privilege to configure the isolation hardware. The VMM
+allocates CMA memory and transfers them to secure processor. The secure processor
+maps the memory to secure nested page table and manages them as guest's private
+memory. Any memory access (read or write) to CSV3 guest's private memory outside
+the guest will be blocked by isolation hardware.
+
+A CSV3 guest may declare some memory regions as shared to share data with the
+host. When a page is set as shared, read/write on the page will bypass the
+isolation hardware and the guest's shared memory can be accessed by the host. A
+method named CSV3 secure call command is designed and CSV3 guest sends the secure
+call command to the secure processor to change private memory to shared memory.
+In the method, 2 dedicated pages are reserved at early stage of the guest. Any
+read/write on the dedicated pages will trigger nested page fault. When NPF
+happens, the host helps to issue an external command to the secure processor but
+cannot tamper with the data in the guest's private memory. Then the secure
+processor checks the fault address and handles the command if the address is
+exactly the dedicated pages.
+
+Support for CSV can be determined through the CPUID instruction. The CPUID
+function 0x8000001f reports information to CSV::
+
+	0x8000001f[eax]:
+		Bit[1]	  indicates support for CSV
+		Bit[3]	  indicates support for CSV2
+		Bit[30]	  indicates support for CSV3
+
+If CSV is support, MSR 0xc0010131 can be used to determine if CSV is active::
+
+	0xc0010131:
+		Bit[0]	  0 = CSV is not active
+			  1 = CSV is active
+		Bit[1]	  0 = CSV2 is not active
+			  1 = CSV2 is active
+		Bit[30]	  0 = CSV3 is not active
+			  1 = CSV3 is active
+
+All CSV/CSV2's configurations must be enabled in CSV3. Linux can activate CSV3 by
+default (CONFIG_HYGON_CSV=y, CONFIG_CMA=y). CSV3 guest's memory is managed by
+CMA (Contiguous Memory Allocation). User must specify CSV3 total secure memory on
+the linux kernel command line with csv_mem_size or csv_mem_percentage::
+
+	csv_mem_size=nn[MG]
+		[KNL,CSV]
+		Reserve specified CSV3 memory size in CMA. CSV3's memory will be
+		allocated from these CMAs.
+		For instance, csv_mem_size=40G, 40G memory is reserved for CSV3.
+
+	csv_mem_percentage=nn
+		[KNL,CSV]
+		Reserve specified memory size which is prorated according to the
+		whole system memory size. CSV3 guest's memory will be allocated
+		from these CMAs.
+		For instance, csv_mem_percentage=60, means 60% system memory is
+		reserved for CSV3.
+		The maximum percentage is 80. And the default percentage is 0.
+
+Limitations
+The reserved CSV3 memory within CMA cannot be used by kernel or any application that
+may pin memory using long term gup during the application's life time.
+For instance, if the whole system memory is 64G and 32G is reserved for CSV3 with
+kernel command line csv_mem_percentage=50, only 32G memory is available for CSV/CSV2.
+As a result, user will fail to run a CSV/CSV2 guest with memory size which exceeds
+32G.
diff --git a/Documentation/devicetree/bindings/net/phytmac.yaml b/Documentation/devicetree/bindings/net/phytmac.yaml
@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+* Phytium xgmac Ethernet controller
+
+Required properties:
+- compatible: Should be "phytium,gmac-[version]"
+  Use "phytium,gmac-1.0" for gmac version 1.0 on Phytium SoCs
+  Use "phytium,gmac-2.0" for gmac version 2.0 on Phytium SoCs
+
+- reg: Address and length of the register set for the device
+- interrupts: Should contain phytmac interrupt
+- queue-number: The number of queues for the device
+- phy-mode: See ethernet.txt file in the same directory
+- fixed-link：See ethernet.txt file in the same directory
+- dma-coherent: Boolean property, must only be present if memory
+	accesses performed by the device are cache coherent.
+
+The MAC address will be determined using the optional properties
+defined in ethernet.txt.
+
+Examples:
+
+	eth0@36ce0000 {
+			compatible = "phytium,gmac-1.0";
+			reg = <0x00 0x36ce0000 0x00 0x2000>;
+			interrupts = <0x00 0x20 0x04 0x00 0x21 0x04 0x00 0x22 0x04 0x00 0x23 0x04>;
+			queue-number = <0x04>;
+			magic-packet;
+			dma-coherent;
+			phy-mode = "usxgmii";
+			status = "okay";
+
+			fixed-link {
+					speed = <0x2710>;
+					full-duplex;
+			};
+	};
diff --git a/Documentation/virt/coco/csv-guest.rst b/Documentation/virt/coco/csv-guest.rst
@@ -0,0 +1,33 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+===================================================================
+CSV Guest API Documentation
+===================================================================
+
+1. General description
+======================
+
+The CSV guest driver exposes IOCTL interfaces via the /dev/csv-guest misc
+device to allow userspace to get certain CSV guest-specific details.
+
+2. API description
+==================
+
+In this section, for each supported IOCTL, the following information is
+provided along with a generic description.
+
+:Input parameters: Parameters passed to the IOCTL and related details.
+:Output: Details about output data and return value (with details about
+         the non common error values).
+
+2.1 CSV_CMD_GET_REPORT
+-----------------------
+
+:Input parameters: struct csv_report_req
+:Output: Upon successful execution, CSV_REPORT data is copied to
+         csv_report_req.report_data and return 0. Return -EINVAL for invalid
+         operands, -EIO on VMMCALL failure or standard error number on other
+         common failures.
+
+The CSV_CMD_GET_REPORT IOCTL can be used by the attestation software to get
+the CSV_REPORT from the CSV module using VMMCALL[KVM_HC_VM_ATTESTATION].
diff --git a/MAINTAINERS b/MAINTAINERS
@@ -6878,6 +6878,11 @@ F:	arch/mips/dec/
 F:	arch/mips/include/asm/dec/
 F:	arch/mips/include/asm/mach-dec/
 
+DEEPIN OWNERS
+M:	"WangYuli" <wangyuli@uniontech.com>
+S:	Maintained
+F:	OWNERS
+
 DEFXX FDDI NETWORK DRIVER
 M:	"Maciej W. Rozycki" <macro@orcam.me.uk>
 S:	Maintained

diff --git a/arch/arm64/configs/deepin_arm64_desktop_defconfig b/arch/arm64/configs/deepin_arm64_desktop_defconfig
@@ -1663,6 +1663,8 @@ CONFIG_MT7921E=m
 CONFIG_MT7921S=m
 CONFIG_MT7921U=m
 CONFIG_MT7996E=m
+CONFIG_MT7925E=m
+CONFIG_MT7925U=m
 CONFIG_RT2X00=m
 CONFIG_RT2400PCI=m
 CONFIG_RT2500PCI=m

diff --git a/arch/loongarch/OWNERS b/arch/loongarch/OWNERS
@@ -0,0 +1,5 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+- allinaent
+- JohnsPony
diff --git a/arch/loongarch/configs/deepin_loongarch_desktop_defconfig b/arch/loongarch/configs/deepin_loongarch_desktop_defconfig
@@ -1710,6 +1710,8 @@ CONFIG_MT7921E=m
 CONFIG_MT7921S=m
 CONFIG_MT7921U=m
 CONFIG_MT7996E=m
+CONFIG_MT7925E=m
+CONFIG_MT7925U=m
 CONFIG_WILC1000_SDIO=m
 CONFIG_WILC1000_SPI=m
 CONFIG_WILC1000_HW_OOB_INTR=y

diff --git a/arch/mips/OWNERS b/arch/mips/OWNERS
@@ -0,0 +1,5 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+- allinaent
+- JohnsPony
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
@@ -1975,6 +1975,31 @@ config EFI_RUNTIME_MAP
 
 	  See also Documentation/ABI/testing/sysfs-firmware-efi-runtime-map.
 
+config HYGON_CSV
+	bool "Hygon secure virtualization CSV support"
+	default y
+	depends on CPU_SUP_HYGON && AMD_MEM_ENCRYPT
+	select MMU
+	select CMA
+	help
+	  Hygon CSV integrates secure processor, memory encryption and
+	  memory isolation to provide the ability to protect guest's private
+	  data. It has evolved from CSV, CSV2 to CSV3.
+
+	  For CSV, the guest's memory is encrypted.
+
+	  For CSV2, not only the guest's memory, but also the guest's vCPU
+	  registers are encrypted, neither other guests nor the host can tamper
+	  with the vCPU registers.
+
+	  For CSV3, the guest's context like vCPU registers, control block and
+	  nested page table is accessed only by the guest itself and the secure
+	  processor. Neither other guests nor the host can tamper with the
+	  guest's context.
+
+	  Say Y here to enable support for the whole capbilities of Hygon secure
+	  virtualization on hygon processor.
+
 source "kernel/Kconfig.hz"
 
 config ARCH_SUPPORTS_KEXEC

diff --git a/arch/x86/coco/sev/vc-handle.c b/arch/x86/coco/sev/vc-handle.c
@@ -34,6 +34,7 @@
 #include <asm/cpu.h>
 #include <asm/apic.h>
 #include <asm/cpuid/api.h>
+#include <asm/processor-hygon.h>
 
 static enum es_result vc_slow_virt_to_phys(struct ghcb *ghcb, struct es_em_ctxt *ctxt,
 					   unsigned long vaddr, phys_addr_t *paddr)
@@ -897,6 +898,15 @@ static bool vc_raw_handle_exception(struct pt_regs *regs, unsigned long error_co
 	struct ghcb *ghcb;
 	bool ret = true;
 
+	/*
+	* Make sure the codes between __sev_get_ghcb() and __sev_put_ghcb()
+	* keep in atomic context. If #VC comes from kernel mode, then the
+	* codes here are in atomic context. If #VC comes from user mode, then
+	* it's necessary to switch to atomic context manually.
+	*/
+	if (is_x86_vendor_hygon() && !in_nmi())
+			__preempt_count_add(HARDIRQ_OFFSET);
+
 	ghcb = __sev_get_ghcb(&state);
 
 	vc_ghcb_invalidate(ghcb);
@@ -907,6 +917,9 @@ static bool vc_raw_handle_exception(struct pt_regs *regs, unsigned long error_co
 
 	__sev_put_ghcb(&state);
 
+	if (is_x86_vendor_hygon() && !in_nmi())
+			__preempt_count_sub(HARDIRQ_OFFSET);
+
 	/* Done - now check the result */
 	switch (result) {
 	case ES_OK:

diff --git a/arch/x86/configs/deepin_x86_desktop_defconfig b/arch/x86/configs/deepin_x86_desktop_defconfig
@@ -65,6 +65,7 @@ CONFIG_JAILHOUSE_GUEST=y
 CONFIG_ACRN_GUEST=y
 CONFIG_PROCESSOR_SELECT=y
 CONFIG_GART_IOMMU=y
+CONFIG_NR_CPUS=512
 CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
 CONFIG_X86_MCELOG_LEGACY=y
 CONFIG_PERF_EVENTS_INTEL_RAPL=m
@@ -85,6 +86,7 @@ CONFIG_X86_USER_SHADOW_STACK=y
 CONFIG_EFI=y
 CONFIG_EFI_STUB=y
 CONFIG_EFI_MIXED=y
+CONFIG_HYGON_CSV=y
 CONFIG_LIVEPATCH=y
 CONFIG_HIBERNATION=y
 CONFIG_PM_WAKELOCKS=y
@@ -1493,6 +1495,8 @@ CONFIG_MT7921E=m
 CONFIG_MT7921S=m
 CONFIG_MT7921U=m
 CONFIG_MT7996E=m
+CONFIG_MT7925E=m
+CONFIG_MT7925U=m
 CONFIG_WILC1000_SDIO=m
 CONFIG_WILC1000_SPI=m
 CONFIG_WILC1000_HW_OOB_INTR=y
@@ -4197,6 +4201,7 @@ CONFIG_VFIO_PCI_VGA=y
 CONFIG_VIRT_DRIVERS=y
 CONFIG_VBOXGUEST=m
 CONFIG_NITRO_ENCLAVES=m
+CONFIG_CSV_GUEST=m
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_VDPA=m
 CONFIG_VIRTIO_PMEM=m
@@ -5290,6 +5295,7 @@ CONFIG_CRYPTO_DEV_VIRTIO=m
 CONFIG_CRYPTO_DEV_SAFEXCEL=m
 CONFIG_CRYPTO_DEV_AMLOGIC_GXL=m
 CONFIG_CRYPTO_DEV_TSSE=m
+CONFIG_HYGON_GM=y
 CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
 CONFIG_SIGNED_PE_FILE_VERIFICATION=y
 CONFIG_SYSTEM_EXTRA_CERTIFICATE=y

diff --git a/arch/x86/events/zhaoxin/core.c b/arch/x86/events/zhaoxin/core.c
@@ -659,7 +659,7 @@ __init int zhaoxin_pmu_init(void)
 
 			if (boot_cpu_data.x86_model == 0x5b)
 				pr_cont("Yongfeng events, ");
-			
+
 			if (boot_cpu_data.x86_model == 0x6b)
 				pr_cont("Shijidadao events, ");
 

diff --git a/arch/x86/events/zhaoxin/uncore.c b/arch/x86/events/zhaoxin/uncore.c
@@ -212,7 +212,7 @@ static int kh40000_pcibus_limit[KH40000_MAX_SUBNODE_NUMBER];
 #define KX7000_MC_B1_CHy_PMON_CTL0		0xee0
 #define KX7000_MC_B1_CHy_PMON_BLK_CTL		0xef4
 
-#define	KX7000_ZDI_DL_MMIO_PMON_CTR0		0xf00	
+#define	KX7000_ZDI_DL_MMIO_PMON_CTR0		0xf00
 #define KX7000_ZDI_DL_MMIO_PMON_CTL0		0xf28
 #define KX7000_ZDI_DL_MMIO_PMON_BLK_CTL		0xf44
 #define KX7000_IOD_ZDI_DL_MMIO_BASE_OFFSET	0x168
@@ -397,24 +397,24 @@ DEFINE_PER_CPU(cpumask_t, zx_subnode_core_bits);
 
 static void zx_gen_core_map(void)
 {
-	int i, nr, cpu;
+	int cpu, i;
 	int cluster_id, subnode_id;
 
 	for_each_present_cpu(cpu) {
 		cluster_id = zx_topology_cluster_id(cpu);
 
-		for (i = 0; i < 4; i++) {
-			nr = (cluster_id << 2) + i;
-			cpumask_set_cpu(nr, &per_cpu(zx_cluster_core_bits, cpu));
+		for_each_present_cpu(i) {
+			if (zx_topology_cluster_id(i) == cluster_id)
+				cpumask_set_cpu(i, &per_cpu(zx_cluster_core_bits, cpu));
 		}
 	}
 
 	for_each_present_cpu(cpu) {
 		subnode_id = zx_topology_subnode_id(cpu);
 
-		for (i = 0; i < 8; i++) {
-			nr = (subnode_id << 3) + i;
-			cpumask_set_cpu(nr, &per_cpu(zx_subnode_core_bits, cpu));
+		for_each_present_cpu(i) {
+			if (zx_topology_subnode_id(i) == subnode_id)
+				cpumask_set_cpu(i, &per_cpu(zx_subnode_core_bits, cpu));
 		}
 	}
 }
@@ -2828,6 +2828,7 @@ static void kx7000_uncore_cpu_init(void)
 {
 	u64 val;
 	int cpu;
+
 	uncore_msr_uncores = kx7000_msr_uncores;
 
 	/* clear bit 16 of MSR 0x1877 so that HIF can work normally */

diff --git a/arch/x86/events/zhaoxin/uncore.h b/arch/x86/events/zhaoxin/uncore.h
@@ -45,9 +45,9 @@ struct zhaoxin_uncore_type {
 	unsigned int fixed_ctl;
 	unsigned int box_ctl;
 	union {
-                unsigned int msr_offset;
-                unsigned int mmio_offset;
-        };
+		unsigned int msr_offset;
+		unsigned int mmio_offset;
+	};
 	unsigned int num_shared_regs:8;
 	unsigned int single_fixed:1;
 	unsigned int pair_ctr_ctl:1;