[6.6]HYGON: Print some secure features when running on Hygon CPUs #350

Avenger-285714 · 2024-08-04T10:40:44Z

Hygon CPUs support many security features, such as SME, CSV, CSV2, CSV3, SM3, SM4. Add patch to print these features in the kernel log so that users can check and utilize these security features easily.

Reference:
https://gitee.com/openeuler/kernel/pulls/5243
https://gitee.com/openeuler/kernel/issues/I98NP1

Link: https://gitee.com/deepin-kernelsig/kernel/pulls/1

hygon inclusion category: feature CVE: NA --------------------------- Add the HYGON secure virtualization document describing the secure virtualization features. Signed-off-by: Xin Jiang <jiangxin@hygon.cn> Signed-off-by: hanliyang <hanliyang@hygon.cn>

…support into the kernel hygon inclusion category: feature CVE: NA --------------------------- Provide CONFIG_HYGON_CSV to the arch/x86/Kconfig, and build HYGON's specific memory encryption support into the kernel when CONFIG_HYGON_CSV=y. Besides, add arch/x86/include/asm/processor-hygon.h to contains helpers to determine the Hygon CPUs so that we can call functions specific to CSV in the native code and reduce code intruision. Signed-off-by: hanliyang <hanliyang@hygon.cn>

hygon inclusion category: feature CVE: NA --------------------------- Add CSV and CSV2 to the list of memory encryption features. Also print CPU vendor while printing CSV infos. Signed-off-by: hanliyang <hanliyang@hygon.cn>

hygon inclusion category: feature CVE: NA --------------------------- The Cryptographic Co-Processor module will print 'SEV API' instead of 'CSV API' on Hygon CPU if CSV is supported. Fix this confused message here. Signed-off-by: hanliyang <hanliyang@hygon.cn>

hygon inclusion category: feature CVE: NA --------------------------- The KVM will print 'SEV supported' instead of 'CSV supported' on Hygon CPU if CSV is supported. Fix these confused messages here. Fix other 'SEV' messages in arch/x86/kvm/svm/svm.c. Signed-off-by: hanliyang <hanliyang@hygon.cn>

hygon inclusion category: feature CVE: NA --------------------------- Hygon SME is identified by CPUID 0x8000001f, but requires BIOS support to enable it (set bit 23 of MSR_AMD64_SYSCFG). Hygon CSV and CSV2 are identified by CPUID 0x8000001f, but requires BIOS support to enable it (set bit 23 of MSR_AMD64_SYSCFG and set bit 0 of MSR_K7_HWCR). Only show the SME, CSV, CSV2 features as available if reported by CPUID and enabled by BIOS. Signed-off-by: hanliyang <hanliyang@hygon.cn>

hygon inclusion category: feature CVE: NA --------------------------- This is a pure feature bits leaf. Add SM3 and SM4 feature bits from this leaf on Hygon CPUs. Signed-off-by: hanliyang <hanliyang@hygon.cn>

hygon inclusion category: feature CVE: NA --------------------------- Add CPU feature detection for Hygon 3rd CSV. This feature enhances CSV2 by also isolating NPT and VMCB, making them in-accessible to the hypervisor. Signed-off-by: hanliyang <hanliyang@hygon.cn>

hygon inclusion category: feature CVE: NA --------------------------- The commit 08f253e ("x86/cpu: Clear SME feature flag when not in use") will clear SME feature flag if the kernel is not using it on AMD CPUs, this will help userspace to determine if SME is available and in use from /proc/cpuinfo. Apply this change to Hygon CPUs as well. Signed-off-by: hanliyang <hanliyang@hygon.cn>

hygon inclusion category: feature CVE: NA --------------------------- Configure CONFIG_HYGON_CSV=y so that Hygon Confidential Computing support will be compiled. Signed-off-by: hanliyang <hanliyang@hygon.cn>

deepin-ci-robot · 2024-08-04T10:40:58Z

deepin pr auto review

Hygon: Fix SME/CSV feature detection on SMM

deepin-ci-robot · 2024-08-04T10:41:09Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign yukarichiba for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

https:/raw.githubusercontent.com/deepin-community/template-repository/master/debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hygon inclusion category: feature CVE: NA --------------------------- Add the HYGON secure virtualization document describing the secure virtualization features. Signed-off-by: Xin Jiang <jiangxin@hygon.cn> Signed-off-by: hanliyang <hanliyang@hygon.cn> Link: deepin-community#350 (cherry picked from commit e9aaad4) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>

The following commit remove some macro, fix it. commit 8609dd2 Author: Mario Limonciello <mario.limonciello@amd.com> Date: Tue May 28 16:07:08 2024 -0500 crypto: ccp - Represent capabilities register as a union Making the capabilities register a union makes it easier to refer to the members instead of always doing bit shifts. No intended functional changes. Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Suggested-by: Yazen Ghannam <yazen.ghannam@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Link: deepin-community#350 Signed-off-by: Wentao Guan <guanwentao@uniontech.com>

hygon inclusion category: feature CVE: NA --------------------------- Add CSV and CSV2 to the list of memory encryption features. Also print CPU vendor while printing CSV infos. Signed-off-by: hanliyang <hanliyang@hygon.cn> Link: Link: deepin-community#350 (cherry picked from commit 3a15cca) Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Conflicts: arch/x86/include/asm/mem_encrypt.h arch/x86/mm/mem_encrypt.c

hygon inclusion category: feature CVE: NA --------------------------- The Cryptographic Co-Processor module will print 'SEV API' instead of 'CSV API' on Hygon CPU if CSV is supported. Fix this confused message here. Signed-off-by: hanliyang <hanliyang@hygon.cn> Link: deepin-community#350 (cherry picked from commit 9d1c6b9) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>

hygon inclusion category: feature CVE: NA --------------------------- The KVM will print 'SEV supported' instead of 'CSV supported' on Hygon CPU if CSV is supported. Fix these confused messages here. Fix other 'SEV' messages in arch/x86/kvm/svm/svm.c. Signed-off-by: hanliyang <hanliyang@hygon.cn> Link: deepin-community#350 (cherry picked from commit 8ab045c) Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Conflicts: arch/x86/kvm/svm/sev.c

hygon inclusion category: feature CVE: NA --------------------------- Hygon SME is identified by CPUID 0x8000001f, but requires BIOS support to enable it (set bit 23 of MSR_AMD64_SYSCFG). Hygon CSV and CSV2 are identified by CPUID 0x8000001f, but requires BIOS support to enable it (set bit 23 of MSR_AMD64_SYSCFG and set bit 0 of MSR_K7_HWCR). Only show the SME, CSV, CSV2 features as available if reported by CPUID and enabled by BIOS. Signed-off-by: hanliyang <hanliyang@hygon.cn> Link: deepin-community#350 (cherry picked from commit 54f0805) Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Conflicts: arch/x86/kernel/cpu/hygon.c

hygon inclusion category: feature CVE: NA --------------------------- This is a pure feature bits leaf. Add SM3 and SM4 feature bits from this leaf on Hygon CPUs. Signed-off-by: hanliyang <hanliyang@hygon.cn> [disabled-features.h and required-features.h removed by the commit commit 8f97566 Author: Xin Li (Intel) <xin@zytor.com> Date: Mon Mar 10 08:32:12 2025 +0100 x86/cpufeatures: Remove {disabled,required}-features.h The functionalities of {disabled,required}-features.h have been replaced with the auto-generated generated/<asm/cpufeaturemasks.h> header. Thus they are no longer needed and can be removed. None of the macros defined in {disabled,required}-features.h is used in tools, delete them too. Signed-off-by: Xin Li (Intel) <xin@zytor.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: https://lore.kernel.org/r/20250305184725.3341760-4-xin@zytor.com] Link: deepin-community#350 (cherry picked from commit 4a0be8d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Conflicts: arch/x86/include/asm/cpufeature.h arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/disabled-features.h arch/x86/include/asm/required-features.h

hygon inclusion category: feature CVE: NA --------------------------- Add CPU feature detection for Hygon 3rd CSV. This feature enhances CSV2 by also isolating NPT and VMCB, making them in-accessible to the hypervisor. Signed-off-by: hanliyang <hanliyang@hygon.cn> Link: deepin-community#350 (cherry picked from commit 00a1c40) Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Conflicts: arch/x86/include/asm/cpufeatures.h

hygon inclusion category: feature CVE: NA --------------------------- The commit 08f253e ("x86/cpu: Clear SME feature flag when not in use") will clear SME feature flag if the kernel is not using it on AMD CPUs, this will help userspace to determine if SME is available and in use from /proc/cpuinfo. Apply this change to Hygon CPUs as well. Signed-off-by: hanliyang <hanliyang@hygon.cn> Link: deepin-community#350 (cherry picked from commit 941989f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>

hygon inclusion category: feature CVE: NA --------------------------- Configure CONFIG_HYGON_CSV=y so that Hygon Confidential Computing support will be compiled. Signed-off-by: hanliyang <hanliyang@hygon.cn> Link: deepin-community#350 (cherry picked from commit b0567bb) Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Conflicts: arch/x86/configs/deepin_x86_desktop_defconfig