Update HAOC 3.0 to HAOC 4.0 for Deepin

[amjac27]

将 HAOC 3.0 更新至 HAOC 4.0，依据 Unixbench，性能开销在 5% 左右。目前提供的功能如下：

• IEE：提供内核内隔离执行环境的框架，由受到保护的内存、堆栈、可信的代码出入口等构建而成。在内核由于漏洞发生安全问题时，IEE 可以确保内部的数据和代码不受到影响，因此可以用于加固对内核关键数据的防护，并承载一定的安全检查代码，用于监视内核行为。

  • IEE_SIP: 保护那些可能破坏IEE隔离性的关键指令，例如写入系统控制寄存器的指令，这些指令将在IEE内部执行。这类关键指令一旦被恶意或错误地执行，将直接破坏内核行为，导致安全敏感数据泄露或权限提升。

  • IEE_PTRP: 进程的 task_struct结构体包含大量关键指针，例如 struct cred*，它直接决定了进程的权限和能力。一旦该指针被恶意篡改，攻击者即可提升权限，导致严重安全风险。该选项为每个进程提供称为 task_token 的 IEE 元数据，在运行时动态验证 task_struct 中关键指针（例如 struct cred*，该指针决定了进程的权限能力）的完整性，防止指针被非法覆盖或重定向

  • IEE_PTRP_W: 与PTRP的功能相比，此选项仅对关键指针执行写保护。启用此选项可提升性能，并缩小防护范围。

  • IEE_SELINUXP：对 Linux 有名的安全子系统 Selinux 进行安全加固的选项。Selinux 是广泛使用的 LSM（Linux security module）的代表之一，它在内核的各个关键函数中进行插桩检查，并引入了自己的一套用户访问控制模型。我们将 Selinux 所使用的最关键的数据结构放入 Haoc 安全内存中进行监视，确保其提供的安全检查不被攻击者绕过。

• PTP：由于 IEE 的防护设计基于内核页表实现，需要将内核页表进行隔离和保护，确保 IEE 自身的完整性。此外，内核页表也是内核运行的最关键数据，PTP 通过对内核页表的隔离与监视，确保了内核 DEP （Data execution prevention）防止代码篡改与注入，并阻止 Alias mapping，防止内核数据与代码被攻击者泄露到用户空间。

  • PTP_S: PTP 的子选项，开启后能提高 PTP 页表保护的性能，在 PTP 的基础上将页表划分为内核页表和用户页表，仅对内核页表实施只读保护，用户页表开放读写权限，减小开销。

• CREDP：对内核内 cred 结构体的防护。cred 结构体是 Linux 访问控制策略中的关键数据，负责标识进程的各项权限，在进程访问各种资源时提供信息进行安全校验。如果 cred 被非法篡改或替换，攻击者将很容易绕过内核的各种安全防护，达到为所欲为的效果。Haoc 将 cred 放入隔离环境内，所有对 cred 的访问都需要经过 Haoc 的接口进行检验。我们在这些接口布置了相应的安全策略，即使攻击者利用内存安全漏洞，也无法直接修改 cred，或者构建 ROP 攻击复用内核接口修改进程 cred 为非法目标。

• KEYP：对内核内 key 结构体的防护。key 是内核密钥环安全子系统的关键数据结构，可以用于强化 Linux 的控制访问策略。但在宏内核中，暴露的 key 结构体仍可能被攻击者通过内核漏洞随意篡改，导致这些安全加固失去意义。Haoc 框架则通过提供可信的内存并确保相关验证代码的控制流完整性，给这些安全加固机制提供了更为可靠的保障。

• VARP: 对 Linux 内核中易被攻击者利用的关键全局变量进行安全加固的选项，例如 modprobe_path 等。这类变量会影响内核安全决策或用户态辅助程序执行路径，攻击者获得内核任意写后常通过篡改它们劫持内核行为。我们将这些关键变量放入 Haoc 安全内存，确保这些安全敏感变量在运行期仍可被内核正常读写，但不会被攻击者直接改写以绕过系统保护。

Summary by Sourcery

Enable HAOC 4.0 security hardening for Deepin by integrating page-table protection, credential and key isolation, and SELinux/varp hardening across arm64 and x86, while wiring the new infrastructure into memory management, exec/fork paths, keyrings, and security subsystems.

New Features:

• Introduce HAOC bitmap infrastructure and per-page type tagging to distinguish IEE data, page tables, credentials, keys, SELinux data, and protected variables.
• Add PTP-based page table protection that enforces read-only kernel page tables, guarded TLB/free paths, and WP-aware context switches on x86 and arm64.
• Extend CREDP to track and verify per-task credentials via task tokens, add periodic credential integrity checking threads, and tighten cred lifecycle verification.
• Introduce KEYP to isolate and guard keyring metadata and payloads in IEE memory, including new key_union/key_struct layouts and RCU-safe payload handling.
• Add VARP to protect sensitive kernel variables such as modprobe_path via IEE-backed storage and custom proc string handling.
• Harden SELinux (SELINUXP) by placing policy structures, status pages, and caps into IEE memory with dedicated caches and gate functions, and updating SELinux fs and status handling accordingly.

Bug Fixes:

• Ensure HAOC is opt-in via a boot parameter, with hardware capability checks and CET/CR4 pinning adjustments to avoid conflicts on unsupported systems.
• Prevent creation of writable-executable or alias mappings over IEE-protected regions by adding DEP-style checks in page table mutation paths and early identity mapping code.

Enhancements:

• Refine IEE MMU and early init on arm64 and x86 to allocate separate IEE pools for stacks, data, and page tables and to support HPD/ASID-based isolation.
• Strengthen IEE_PTRP by associating task tokens with pgd/cred state, adding seqcount-based verification, and integrating verification hooks into IO, scheduler context switches, and fork/exec paths.
• Augment slab allocation paths to tag and protect cred, key, and SELinux policy slabs as IEE types, including deferred free handling and split-order adjustments.
• Update generic MM/TLB, page fault, and mprotect/mmap/exit_mmap paths to honor PTP constraints, route page-table frees through HAOC-aware caches, and add new TLB flush helpers.
• Adapt keyring and key type implementations to respect KEYP semantics, including new locking macros, assoc_array usage over key_struct wrappers, and explicit field setters for HAOC.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign lanlanxiyiji for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deepin-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[sourcery-ai]

Reviewer's Guide

Upgrade HAOC from 3.0 to 4.0 on both arm64 and x86, extending kernel hardening features (IEE/IEE_PTRP/PTP/CREDP/KEYP/VARP/SELINUXP) and tightening page-table, cred, key, and SELinux policy protection via new verification logic, kernel threads, and bitmap-based tracking of protected memory types.

Sequence diagram for cred update with HAOC task_token verification

sequenceDiagram
    participant Task as task_struct
    participant Token as task_token
    participant HAOC as haoc_iee_credp

    Note over Task,Token: Cred copy for new kernel task
    Task->>HAOC: _iee_copy_kernel_cred(old,new)
    HAOC->>Token: iee_get_task_token(current)
    HAOC->>Token: token.new_cred = new
    HAOC->>new: _iee_memcpy(old,new)

    Note over Task,Token: Initialize copied cred for child
    Task->>HAOC: _iee_init_copied_cred(new_task,new)
    HAOC->>Token: iee_get_task_token(current)
    HAOC->>Token: iee_get_task_token(new_task)
    HAOC->>Token: [check token.valid]
    HAOC->>Token: [verify token.new_cred == new]
    HAOC->>Token: token.new_cred = NULL
    HAOC->>Token: token.curr_cred = new
    HAOC->>new_task: new_task.cred = new

    Note over Task,Token: Commit new credentials
    Task->>HAOC: _iee_commit_creds(new)
    HAOC->>Token: iee_get_task_token(current)
    HAOC->>Token: [verify token.new_cred == new]
    HAOC->>Token: token.new_cred = NULL
    HAOC->>Token: write_seqcount_begin(token.seq)
    HAOC->>Token: token.curr_cred = new
    HAOC->>Task: rcu_assign_pointer(real_cred,new)
    HAOC->>Task: rcu_assign_pointer(cred,new)
    HAOC->>Token: write_seqcount_end(token.seq)

    Note over Task,Token: Background cycle checker
    actor CheckerThread
    CheckerThread->>HAOC: check_all_threads()
    HAOC->>Token: iee_cycle_verify_cred(task)
    HAOC->>Token: [panic if token.curr_cred != task.cred]

Loading

File-Level Changes

Change	Details	Files
Strengthen cred protection (CREDP/IEE_PTRP) with type verification, token-based tracking, and optional periodic integrity checking	Add iee_verify_cred_type helpers and call them before all cred field mutations Wire IEE_PTRP task_token usage through copy/commit/abort/override/revert cred paths, updating curr_cred and new_cred under seqcount Introduce optional CONFIG_IEE_CYCLE_CHECK kernel thread on arm64 and x86 that scans all tasks and panics on cred/token corruption Add iee_fill_cred_for_session_keyring helper to copy and validate keyring-related cred fields	arch/arm64/kernel/haoc/credp/credp.c arch/x86/kernel/haoc/credp/credp.c fs/process_keys.c kernel/cred.c fs/read_write.c kernel/sched/core.c
Introduce page-table protection (PTP) and bitmap-based memory typing to enforce read-only page tables and safe TLB/table freeing	Extend IEE early allocation to tag stack, data, and pgtable pages with bitmap types, and protect their IEE mappings Add CONFIG_PTP implementations for pte/pmd/pud/p4d/pgd setters using iee_rw_gate, plus compare-and-swap helpers Add PTP-aware vmemmap allocation and page-table/TLB free paths in mmu_gather, sparse-vmemmap, and arm64/x86 pgtable code Enable kernel command-line controlled HAOC boot, hardware capability checks, and multi-stage IEE/PTP initialization on x86/arm64	arch/arm64/kernel/haoc/iee/iee-mmu.c arch/arm64/kernel/haoc/iee/iee-func.c arch/arm64/kernel/haoc/iee/iee-init.c arch/arm64/mm/mmu.c arch/arm64/mm/pgd.c mm/mmu_gather.c mm/sparse-vmemmap.c arch/x86/mm/pgtable.c arch/x86/mm/pgtable_64.h arch/x86/mm/ident_map.c arch/x86/mm/init_64.c mm/mmap.c mm/memory.c
Protect kernel key structures (KEYP) by splitting key layout, routing updates through IEE, and adjusting keyring operations	Introduce key_union/key_struct/key_payload layouts and caches, and store pointers in list_head fields Add iee_key_* setters and REFCOUNT/flag helpers that go through iee_rw_gate when HAOC is enabled Update keyring.c, key.c, keyctl.c, key type implementations (encrypted, trusted, big_key, user, rxrpc, fscrypt, etc.) to use KEYP accessors and sem macros Make keyring name lists and assoc_array trees operate on key_struct instead of bare struct key, preserving semantics	security/keys/keyring.c security/keys/key.c security/keys/key.c include/linux/key.h security/keys/encrypted-keys/encrypted.c security/keys/trusted-keys/trusted_core.c security/keys/big_key.c security/keys/user_defined.c net/rxrpc/key.c fs/crypto/keyring.c
Add SELinux hardening (SELINUXP) by moving key policy structures/status into protected memory and wrapping policy updates	Place selinux_state and policy structures into HAOC-protected sections on arm64/x86 and tag via bitmap Route selinux_status page, enforcing flag, initialized flag, and policycap updates through IEE SELINUXP helpers Wrap selinux policy commit and boolean updates to copy from kernel policy into IEE policy objects and free originals safely Protect selinux status/policy mutexes by storing their backing structs in IEE memory and using indirection	security/selinux/hooks.c security/selinux/ss/services.c security/selinux/status.c security/selinux/selinuxfs.c arch/arm64/kernel/haoc/selinuxp/selinuxp.c arch/x86/kernel/haoc/selinuxp/selinuxp.c arch/arm64/include/asm/haoc/iee-selinux.h arch/x86/include/asm/haoc/iee-selinux.h
Harden selected kernel global variables (VARP) such as modprobe_path by relocating them into HAOC memory and mediating writes	Place modprobe_path in a dedicated IEE section and tag pages as VARP in both arm64 and x86 Add iee_set_varp_modprobe_path, used in proc_dostring for modprobe_path sysctl writes Initialize VARP regions and mark associated pages read-only while allowing mediated updates via IEE gate Ensure verification of VARP region types via bitmap before writes	kernel/module/kmod.c kernel/sysctl.c arch/arm64/kernel/haoc/varp/varp.c arch/x86/kernel/haoc/varp/varp.c arch/arm64/include/asm/haoc/iee-varp.h arch/x86/include/asm/haoc/iee-varp.h
Wire HAOC/IEE hooks into slab, fixmap, and various subsystems to ensure protected objects (cred, key, selinux policy) are allocated and freed correctly	Adjust slub allocator to treat cred_jar, key_jar, policy_jar specially: zeroing, placing pages into HAOC memory, and using iee_set_freeptr Update slab_unmergeable and find_mergeable to prevent merging of HAOC-specific caches Ensure free paths for cred/key/policy slabs unset HAOC bitmap types and return pages to normal usage Integrate HAOC bitmap initialization with early IEE data setup on arm64/x86	mm/slub.c mm/slab_common.c mm/slab.h arch/arm64/kernel/haoc/haoc-bitmap.c arch/x86/kernel/haoc/bitmap.c arch/arm64/kernel/haoc/iee/iee-init.c arch/x86/kernel/haoc/iee/iee-init.c

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[opsiff]

2026-08-14T02:18:09.3240706Z ./arch/arm64/include/asm/pgalloc.h:62:7: error: call to undeclared function 'pgtable_l4_enabled'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
2026-08-14T02:18:09.3260194Z 62 | if (!pgtable_l4_enabled())

[Copilot]

Pull request overview

Upgrades Deepin’s HAOC integration to 4.0 across x86-64 and arm64.

Changes:

• Adds page-table, key, SELinux, credential, pointer, and variable protection.
• Integrates HAOC gates into memory management, keyrings, filesystems, and architecture code.
• Enables HAOC 4.0 features in Deepin desktop configurations.

Reviewed changes

Copilot reviewed 196 out of 196 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
security/smack/smack_lsm.c	Protects Smack key metadata
security/selinux/status.c	Protects SELinux status state
security/selinux/ss/services.c	Protects policy lifecycle
security/selinux/include/security.h	Adds protected setters
security/selinux/ima.c	Uses protected policy lock
security/selinux/hooks.c	Initializes protected SELinux state
security/keys/user_defined.c	Adapts user-key payloads
security/keys/trusted-keys/trusted_core.c	Adapts trusted keys
security/keys/request_key.c	Protects request-key state
security/keys/request_key_auth.c	Adapts authorization payloads
security/keys/proc.c	Supports split key structures
security/keys/internal.h	Declares KEYP caches
security/keys/gc.c	Adapts protected-key cleanup
security/keys/encrypted-keys/masterkey_trusted.c	Uses protected key semaphore
security/keys/encrypted-keys/encrypted.c	Adapts encrypted keys
security/keys/dh.c	Uses protected key locking
security/keys/big_key.c	Adapts large-key payloads
security/integrity/evm/evm_crypto.c	Adapts EVM key access
net/rxrpc/server_key.c	Adapts RxRPC server keys
net/rxrpc/sendmsg.c	Checks protected payloads
net/rxrpc/security.c	Reads protected tokens
net/rxrpc/rxkad.c	Adapts RxKAD payloads
net/rxrpc/key.c	Adapts RxRPC keys
net/rxrpc/conn_event.c	Reads protected connection keys
net/rxrpc/af_rxrpc.c	Checks protected payloads
net/dns_resolver/dns_key.c	Protects DNS keyring state
net/ceph/crypto.c	Adapts Ceph keys
net/ceph/ceph_common.c	Reads protected Ceph secrets
mm/sparse-vmemmap.c	Adds PTP vmemmap allocation
mm/slab.h	Adds protected slab handling
mm/slab_common.c	Prevents protected-cache merging
mm/pgtable-generic.c	Defers protected table frees
mm/mprotect.c	Integrates PTP protection changes
mm/mmap.c	Integrates protected unmapping
mm/memory.c	Integrates protected fault handling
mm/Makefile	Builds HAOC memory support
mm/huge_memory.c	Adapts arm64 PMD setup
mm/haoc/Makefile	Builds PTP cache
mm/early_ioremap.c	Adds protected early fixmaps
mm/debug_vm_pgtable.c	Uses protected table setters
lib/digsig.c	Uses protected key locking
kernel/sysctl.c	Routes VARP sysctl writes
kernel/sched/core.c	Adds token and WP handling
kernel/module/kmod.c	Protects modprobe_path
kernel/fork.c	Adds token and PTP hooks
kernel/cred.c	Protects credential overrides
init/main.c	Adds x86 HAOC post-init
include/linux/ptp-cache.h	Defines protected table cache
include/linux/mm.h	Uses PTP page allocation
include/linux/mm_types.h	Declares PTP TLB completion
include/linux/key.h	Defines KEYP structures
include/linux/haoc-ptp.h	Declares WP helpers
include/linux/efi.h	Includes arm64 PTP initialization
include/keys/request_key_auth-type.h	Adapts authorization payload access
include/keys/asymmetric-type.h	Adapts asymmetric payload access
include/keys/asymmetric-subtype.h	Adapts subtype access
include/asm-generic/tlb.h	Adds PTP TLB removal
fs/verity/signature.c	Adapts fs-verity keyring
fs/ubifs/auth.c	Uses protected key locking
fs/smb/client/smb2pdu.c	Adapts SMB2 SPNEGO keys
fs/smb/client/sess.c	Adapts SMB session keys
fs/smb/client/connect.c	Uses protected key locking
fs/smb/client/cifsacl.c	Adapts CIFS ID mapping
fs/smb/client/cifs_spnego.c	Adapts SPNEGO keys
fs/read_write.c	Adds credential verification
fs/nfs/nfs4idmap.c	Protects NFS keyring state
fs/ioctl.c	Adds credential verification
fs/exec.c	Adds exec protection hooks
fs/ecryptfs/main.c	Uses protected key semaphore
fs/ecryptfs/ecryptfs_kernel.h	Adapts encrypted payload access
fs/crypto/keysetup_v1.c	Uses protected key locking
fs/crypto/keyring.c	Adapts fscrypt keyrings
drivers/usb/early/ehci-dbgp.c	Uses protected early fixmap
drivers/tty/serial/earlycon.c	Uses protected earlycon fixmap
drivers/nvdimm/security.c	Uses protected key locking
drivers/md/dm-verity-verify-sig.c	Uses protected signature keys
drivers/md/dm-crypt.c	Adapts dm-crypt keys
drivers/firmware/efi/arm-runtime.c	Changes PTP EFI unmapping
crypto/asymmetric_keys/signature.c	Adapts signature payload checks
crypto/asymmetric_keys/public_key.c	Adapts public-key payloads
crypto/asymmetric_keys/asymmetric_type.c	Adapts asymmetric-key cleanup
crypto/af_alg.c	Uses protected key locking
certs/system_keyring.c	Adapts trusted keyring payloads
certs/blacklist.c	Protects blacklist permissions
block/sed-opal.c	Uses protected key locking
arch/x86/platform/efi/efi_64.c	Protects EFI page tables
arch/x86/mm/pti.c	Uses PTP table setters
arch/x86/mm/pgtable.c	Adds protected table caches
arch/x86/mm/pat/set_memory.c	Protects mapping updates
arch/x86/mm/init_64.c	Reworks HAOC initialization
arch/x86/mm/ident_map.c	Protects identity mappings
arch/x86/kernel/vmlinux.lds.S	Adds protected data sections
arch/x86/kernel/paravirt.c	Adds protected TLB removal
arch/x86/kernel/nmi.c	Handles WP state during NMI
arch/x86/kernel/haoc/varp/varp.c	Implements x86 VARP
arch/x86/kernel/haoc/varp/Makefile	Builds x86 VARP
arch/x86/kernel/haoc/selinuxp/selinuxp.c	Implements x86 SELinuxP
arch/x86/kernel/haoc/selinuxp/Makefile	Builds x86 SELinuxP
arch/x86/kernel/haoc/ptp/ptp-gate.S	Implements x86 PTP gate
arch/x86/kernel/haoc/ptp/Makefile	Builds x86 PTP
arch/x86/kernel/haoc/Makefile	Builds HAOC modules
arch/x86/kernel/haoc/keyp/Makefile	Builds x86 KEYP
arch/x86/kernel/haoc/iee/iee.c	Adds token lookup
arch/x86/kernel/haoc/iee/iee-si.c	Extends SIP handling
arch/x86/kernel/haoc/iee/iee-func.c	Adds page tagging helpers
arch/x86/kernel/haoc/haoc.c	Registers new IEE gates
arch/x86/kernel/haoc/gate.h	Defines WP gate macros
arch/x86/kernel/cpu/common.c	Moves SIP initialization
arch/x86/kernel/alternative.c	Protects text-poke mappings
arch/x86/Kconfig	Defines HAOC 4.0 options
arch/x86/include/asm/tlb.h	Adds protected TLB free
arch/x86/include/asm/pgalloc.h	Uses protected table cache
arch/x86/include/asm/haoc/ptp.h	Defines x86 PTP API
arch/x86/include/asm/haoc/iee.h	Extends x86 IEE API
arch/x86/include/asm/haoc/iee-varp.h	Defines x86 VARP API
arch/x86/include/asm/haoc/iee-token.h	Extends task tokens
arch/x86/include/asm/haoc/iee-si.h	Extends SIP declarations
arch/x86/include/asm/haoc/iee-selinux.h	Defines SELinuxP gates
arch/x86/include/asm/haoc/iee-func.h	Extends page APIs
arch/x86/include/asm/haoc/iee-cred.h	Extends credential checks
arch/x86/include/asm/haoc/haoc-def.h	Adds gate operation IDs
arch/x86/include/asm/haoc/haoc-bitmap.h	Defines x86 page tags
arch/x86/configs/deepin_x86_desktop_defconfig	Enables HAOC 4.0
arch/x86/boot/compressed/ident_map_64.c	Protects boot mappings
arch/arm64/mm/trans_pgd.c	Protects transitional tables
arch/arm64/mm/pgd.c	Uses protected PGD allocation
arch/arm64/mm/init.c	Changes init-memory cleanup
arch/arm64/mm/fault.c	Adds bitmap diagnostics
arch/arm64/kernel/vmlinux.lds.S	Adds protected data sections
arch/arm64/kernel/setup.c	Initializes table caches
arch/arm64/kernel/haoc/varp/varp.c	Implements arm64 VARP
arch/arm64/kernel/haoc/varp/Makefile	Builds arm64 VARP
arch/arm64/kernel/haoc/selinuxp/selinuxp.c	Implements arm64 SELinuxP
arch/arm64/kernel/haoc/selinuxp/Makefile	Builds arm64 SELinuxP
arch/arm64/kernel/haoc/ptp/Makefile	Builds arm64 PTP
arch/arm64/kernel/haoc/Makefile	Builds arm64 HAOC modules
arch/arm64/kernel/haoc/keyp/Makefile	Builds arm64 KEYP
arch/arm64/kernel/haoc/iee/iee-si-gate.S	Updates SIP gate
arch/arm64/kernel/haoc/iee/iee-init.c	Reworks IEE post-init
arch/arm64/kernel/haoc/iee/iee-gate.S	Adds disabled-mode gate path
arch/arm64/kernel/haoc/haoc.c	Registers arm64 gates
arch/arm64/kernel/cpufeature.c	Uses protected KPTI tables
arch/arm64/include/asm/tlb.h	Frees protected tables
arch/arm64/include/asm/pgtable.h	Selects HAOC pgtable API
arch/arm64/include/asm/pgalloc.h	Adds protected PUD freeing
arch/arm64/include/asm/mmu_context.h	Protects TTBR updates
arch/arm64/include/asm/haoc/iee.h	Extends pointer translation
arch/arm64/include/asm/haoc/iee-varp.h	Defines arm64 VARP API
arch/arm64/include/asm/haoc/iee-token.h	Extends arm64 tokens
arch/arm64/include/asm/haoc/iee-selinux.h	Defines SELinuxP gates
arch/arm64/include/asm/haoc/iee-ptp-init.h	Defines early PTP API
arch/arm64/include/asm/haoc/iee-mmu.h	Extends IEE allocation API
arch/arm64/include/asm/haoc/iee-init.h	Defines protected sections
arch/arm64/include/asm/haoc/iee-func.h	Extends arm64 page APIs
arch/arm64/include/asm/haoc/iee-fixmap.h	Defines protected fixmaps
arch/arm64/include/asm/haoc/iee-cred.h	Extends credential checks
arch/arm64/include/asm/haoc/haoc-def.h	Adds arm64 gate IDs
arch/arm64/include/asm/haoc/haoc-bitmap.h	Defines arm64 page tags
arch/arm64/include/asm/fixmap.h	Includes PTP fixmap support
arch/arm64/configs/deepin_arm64_desktop_defconfig	Enables HAOC 4.0

Suppressed comments (2)

security/selinux/ss/services.c:2226

• The first-policy path has the same unchecked protected-cache allocation: a transient allocation failure is passed to the gate and becomes a NULL type check/copy target. Handle allocation failure before publishing the initial policy.
  security/selinux/ss/services.c:2227
• This also frees newpolicy before the unconditional security_load_policycaps(newpolicy) call, producing a use-after-free on the initial policy load. Delay the free until after all accesses to newpolicy, or load from the protected policy copy.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.