[Deepin-Kernel-SIG] [linux 6.6-y] [Backport] [Security] [ARM] 添加ARM-CCA机密计算特性支持

[Avenger-285714]

kernel为支持CCA特性，需要包含guest和host修改。本次提交包含这2部分修改。

【特性描述】
机密计算通过改变传统信任模型的信任关系，减小用户对计算基础设施的信任，如OS、hypervisor。其基于可信硬件的安全环境中执行计算，旨在保护data-in-use，保护数据和代码免受特权软件和硬件代理的观察和修改。Arm机密计算架构CCA(Confidential Compute Architecture)特性是Arm在架构上引入的机密计算扩展，其主要特性包括：
1）引入机密计算环境Realm保护in-use 数据和代码
2）允许任何第三方开发者保护其VM或应用
3）支持动态内存分配
4）支持远程证明
相比之前的TrustZone技术，能够提供机密虚机级别的安全防护，支持大型应用的无缝迁移。
更多特性介绍可以参考Arm官方主页：https://www.arm.com/architecture/security-features/arm-confidential-compute-architecture

Host/KVM需要通过RMI(Realm Management Interface)接口管理Realm生命周期、分配和回收Realm资源、调度Realm。内核/KVM需要实现相应patch适配CCA特性。

【涉及代码仓】
kernel、libvirt、QEMU

Link: https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel/pulls/489
Link: https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel/issues/ICZ6R2

[sourcery-ai]

Sorry @Avenger-285714, your pull request is larger than the review limit of 150000 diff characters

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from avenger-285714. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deepin-ci-robot]

deepin pr auto review

这个diff看起来是关于ARM64架构下支持ARM CCA(Confidential Compute Architecture)的一系列改动。主要涉及以下几个方面:

1. 内存加密/解密支持
2. Realm Management Monitor (RMM)接口
3. KVM对Realm的支持
4. TSM(Trusted Security Module)报告接口
5. 配置文件和文档更新

从代码审查角度,我提出以下建议:

1. 安全性:

• rsi_attestation_token_init()函数需要更严格的输入验证,目前只检查了长度(32-64字节),建议增加内容格式验证
• 内存加密/解密操作(set_memory_encrypted/decrypted)应该增加额外的权限检查
• RMI调用需要增加返回值检查,防止恶意guest通过这些接口泄露信息

2. 性能:

• realm_map_protected()和realm_map_non_secure()中的内存分配可以优化为批量分配
• RTT(Realm Translation Table)的创建和销毁可以考虑缓存机制
• attestation token的生成过程可以考虑异步化,避免阻塞

3. 代码质量:

• 部分函数缺少详细的文档注释,特别是RMI相关的接口函数
• 错误处理路径需要更加统一和完整
• 一些魔数(如0x1000)应该用宏定义替代

4. 具体修改建议:

// 在rsi_attestation_token_init()中增加格式验证
static int validate_challenge(const u8 *challenge, unsigned long size)
{
    if (size < 32 || size > 64)
        return -EINVAL;
        
    // 检查challenge内容格式
    for (int i = 0; i < size; i++) {
        if (!is_valid_challenge_byte(challenge[i]))
            return -EINVAL;
    }
    return 0;
}

// 在内存加密操作中增加权限检查
int set_memory_encrypted(unsigned long addr, int numpages)
{
    if (!capable(CAP_SYS_ADMIN))
        return -EPERM;
        
    // 现有代码...
}

// 统一RMI调用错误处理
static int handle_rmi_error(int ret, const char *op)
{
    switch (RMI_RETURN_STATUS(ret)) {
    case RMI_SUCCESS:
        return 0;
    case RMI_ERROR_INPUT:
        pr_err("%s: Invalid input\n", op);
        return -EINVAL;
    case RMI_ERROR_REALM:
        pr_err("%s: Realm error\n", op);
        return -EPERM;
    default:
        pr_err("%s: Unknown error %d\n", op, ret);
        return -EIO;
    }
}

5. 其他建议:

• 考虑增加更多的调试和监控接口,方便问题诊断
• 在关键路径上增加tracepoints,用于性能分析
• 考虑添加更多的单元测试,特别是安全相关的代码路径

这些建议旨在提高代码的安全性、性能和可维护性。建议分阶段实施这些改进,优先处理安全相关的问题。

[Copilot]

Pull request overview

This pull request adds support for ARM Confidential Compute Architecture (CCA/RME) to the Linux 6.6 kernel, enabling confidential virtual machines (Realms) on ARM64 systems. The implementation includes both guest-side and host-side (KVM) support for running and managing Realm VMs, which provide hardware-enforced isolation from the hypervisor.

Key Changes:

• Adds Realm Management Monitor (RMM) and Realm Services Interface (RSI) support for ARM64 guest environments
• Implements KVM extensions to create, manage, and execute Realm VMs with protected memory
• Introduces memory encryption/decryption infrastructure for ARM64 with bounce buffer support for I/O

Reviewed changes

Copilot reviewed 78 out of 78 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
kernel/jump_label.c	Adds jump label sealing mechanism for ro_after_init static keys
init/main.c	Calls jump_label_init_ro() during boot
virt/kvm/kvm_main.c	Filters HVA notifications for private mappings
include/linux/tsm.h	New TSM (Trusted Security Module) attestation interface
include/uapi/linux/kvm.h	Adds KVM_VM_TYPE_ARM_REALM and RME capability definitions
drivers/virt/coco/tsm.c	New TSM attestation report generation framework
drivers/virt/coco/arm-cca-guest/	New ARM CCA guest driver for attestation
arch/arm64/kernel/rsi.c	New RSI implementation for Realm guests
arch/arm64/mm/*.c	Memory encryption/decryption and page attribute support
arch/arm64/kvm/rme.c	New RME support for KVM (1723 lines)
arch/arm64/kvm/rme-exit.c	Realm exit handling
arch/arm64/kvm/*.c	Various KVM changes for Realm support
drivers/perf/	PMU counter field access updates
drivers/irqchip/irq-gic-v3-its.c	Memory encryption support for ITS tables

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.