Unverified Commit bd2e6cac authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5218 [OLK-6.6] Add HGSC_CERT_IMPORT ioctl interface for Hygon CPUs. 

Merge Pull Request from: @hanliyang 
 
Add HGSC_CERT_IMPORT ioctl interface for Hygon CPUs.

issue:
https://gitee.com/open_euler/dashboard?issue_id=I98M2W

Hygon General Security Certificates (HGSC) are the basic certificates that enable Hygon CPUs' security functions. The security functions, such as CSV, will not work until the HGSC is imported.

Test:
1. first, we use Hygon security tool 'hag' to confirm that the HGSC has not been imported.
2. then we try to launch a CSV guest by Qemu, the Qemu return error and quit.
3. we use Hygon security tool 'hag' to import the HGSC.
4. then use Hygon security tool 'hag' to confirm that the HGSC has already been imported.
5. we try to launch a CSV guest again by Qemu, success.
 
 
Link:https://gitee.com/openeuler/kernel/pulls/5218

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 71ec57fe 45620784

drivers/crypto/ccp/Makefile

+5 −2
Original line number Diff line number Diff line
@@ -7,12 +7,15 @@ ccp-$(CONFIG_CRYPTO_DEV_SP_CCP) += ccp-dev.o \ 
	    ccp-dev-v5.o \

	    ccp-dmaengine.o

ccp-$(CONFIG_CRYPTO_DEV_CCP_DEBUGFS) += ccp-debugfs.o

ccp-$(CONFIG_PCI) += sp-pci.o

ccp-$(CONFIG_PCI) += sp-pci.o \

                     hygon/sp-pci.o

ccp-$(CONFIG_CRYPTO_DEV_SP_PSP) += psp-dev.o \

                                   sev-dev.o \

                                   tee-dev.o \

                                   platform-access.o \

                                   dbc.o

                                   dbc.o \

                                   hygon/psp-dev.o \

                                   hygon/csv-dev.o



obj-$(CONFIG_CRYPTO_DEV_CCP_CRYPTO) += ccp-crypto.o

ccp-crypto-objs := ccp-crypto-main.o \

drivers/crypto/ccp/hygon/csv-dev.c

0 → 100644
+122 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * HYGON CSV interface

 *

 * Copyright (C) 2024 Hygon Info Technologies Ltd.

 *

 * Author: Liyang Han <hanliyang@hygon.cn>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 */



#include <linux/psp.h>

#include <linux/psp-hygon.h>

#include <uapi/linux/psp-hygon.h>



#include "psp-dev.h"



int csv_cmd_buffer_len(int cmd)

{

	switch (cmd) {

	case CSV_CMD_HGSC_CERT_IMPORT:		return sizeof(struct csv_data_hgsc_cert_import);

	default:				return 0;

	}

}



static int csv_ioctl_do_hgsc_import(struct sev_issue_cmd *argp)

{

	struct csv_user_data_hgsc_cert_import input;

	struct csv_data_hgsc_cert_import *data;

	void *hgscsk_blob, *hgsc_blob;

	int ret;



	if (copy_from_user(&input, (void __user *)argp->data, sizeof(input)))

		return -EFAULT;



	data = kzalloc(sizeof(*data), GFP_KERNEL);

	if (!data)

		return -ENOMEM;



	/* copy HGSCSK certificate blobs from userspace */

	hgscsk_blob = psp_copy_user_blob(input.hgscsk_cert_address, input.hgscsk_cert_len);

	if (IS_ERR(hgscsk_blob)) {

		ret = PTR_ERR(hgscsk_blob);

		goto e_free;

	}



	data->hgscsk_cert_address = __psp_pa(hgscsk_blob);

	data->hgscsk_cert_len = input.hgscsk_cert_len;



	/* copy HGSC certificate blobs from userspace */

	hgsc_blob = psp_copy_user_blob(input.hgsc_cert_address, input.hgsc_cert_len);

	if (IS_ERR(hgsc_blob)) {

		ret = PTR_ERR(hgsc_blob);

		goto e_free_hgscsk;

	}



	data->hgsc_cert_address = __psp_pa(hgsc_blob);

	data->hgsc_cert_len = input.hgsc_cert_len;



	ret = hygon_psp_hooks.__sev_do_cmd_locked(CSV_CMD_HGSC_CERT_IMPORT,

						  data, &argp->error);



	kfree(hgsc_blob);

e_free_hgscsk:

	kfree(hgscsk_blob);

e_free:

	kfree(data);

	return ret;

}



static long csv_ioctl(struct file *file, unsigned int ioctl, unsigned long arg)

{

	void __user *argp = (void __user *)arg;

	struct sev_issue_cmd input;

	int ret = -EFAULT;



	if (!hygon_psp_hooks.sev_dev_hooks_installed)

		return -ENODEV;



	if (!psp_master || !psp_master->sev_data)

		return -ENODEV;



	if (ioctl != SEV_ISSUE_CMD)

		return -EINVAL;



	if (copy_from_user(&input, argp, sizeof(struct sev_issue_cmd)))

		return -EFAULT;



	if (input.cmd > CSV_MAX)

		return -EINVAL;



	mutex_lock(hygon_psp_hooks.sev_cmd_mutex);



	switch (input.cmd) {

	case CSV_HGSC_CERT_IMPORT:

		ret = csv_ioctl_do_hgsc_import(&input);

		break;

	default:

		/*

		 * If the command is compatible between CSV and SEV, the

		 * native implementation of the driver is invoked.

		 * Release the mutex before calling the native ioctl function

		 * because it will acquires the mutex.

		 */

		mutex_unlock(hygon_psp_hooks.sev_cmd_mutex);

		return hygon_psp_hooks.sev_ioctl(file, ioctl, arg);

	}



	if (copy_to_user(argp, &input, sizeof(struct sev_issue_cmd)))

		ret = -EFAULT;



	mutex_unlock(hygon_psp_hooks.sev_cmd_mutex);



	return ret;

}



const struct file_operations csv_fops = {

	.owner = THIS_MODULE,

	.unlocked_ioctl = csv_ioctl,

};

drivers/crypto/ccp/hygon/csv-dev.h

0 → 100644
+19 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-only */

/*

 * HYGON CSV driver interface

 *

 * Copyright (C) 2024 Hygon Info Technologies Ltd.

 *

 * Author: Liyang Han <hanliyang@hygon.cn>

 */



#ifndef __CCP_HYGON_CSV_DEV_H__

#define __CCP_HYGON_CSV_DEV_H__



#include <linux/fs.h>



extern const struct file_operations csv_fops;



int csv_cmd_buffer_len(int cmd);



#endif	/* __CCP_HYGON_CSV_DEV_H__ */

drivers/crypto/ccp/hygon/psp-dev.c

0 → 100644
+30 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * HYGON Platform Security Processor (PSP) interface

 *

 * Copyright (C) 2024 Hygon Info Technologies Ltd.

 *

 * Author: Liyang Han <hanliyang@hygon.cn>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 */



#include <linux/psp-hygon.h>



#include "psp-dev.h"



/* Function and variable pointers for hooks */

struct hygon_psp_hooks_table hygon_psp_hooks;



int fixup_hygon_psp_caps(struct psp_device *psp)

{

	/* the hygon psp is unavailable if bit0 is cleared in feature reg */

	if (!(psp->capability & PSP_CAPABILITY_SEV))

		return -ENODEV;



	psp->capability &= ~(PSP_CAPABILITY_TEE |

			     PSP_CAPABILITY_PSP_SECURITY_REPORTING);

	return 0;

}

drivers/crypto/ccp/hygon/psp-dev.h

0 → 100644
+33 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-only */

/*

 * HYGON Platform Security Processor (PSP) driver interface

 *

 * Copyright (C) 2024 Hygon Info Technologies Ltd.

 *

 * Author: Liyang Han <hanliyang@hygon.cn>

 */



#ifndef __CCP_HYGON_PSP_DEV_H__

#define __CCP_HYGON_PSP_DEV_H__



#include <linux/mutex.h>



#include "sp-dev.h"



#include "../psp-dev.h"

#include "../sev-dev.h"



/*

 * Hooks table: a table of function and variable pointers filled in

 * when psp init.

 */

extern struct hygon_psp_hooks_table {

	bool sev_dev_hooks_installed;

	struct mutex *sev_cmd_mutex;

	int (*__sev_do_cmd_locked)(int cmd, void *data, int *psp_ret);

	long (*sev_ioctl)(struct file *file, unsigned int ioctl, unsigned long arg);

} hygon_psp_hooks;



int fixup_hygon_psp_caps(struct psp_device *psp);



#endif	/* __CCP_HYGON_PSP_DEV_H__ */