ANDROID: KVM: arm64: Unset pvmfw_{addr,size} when clearing

During its initialization, pKVM clears the pvmfw region (pre-populated
by the bootloader) if anything necessary to its isolation from the host
fails to initialize, so that the host can still boot successfully,
without safe support for protected VMs.

However, if userspace then attempts to discover the presence of pvmfw
(see KVM_CAP_ARM_PROTECTED_VM_FLAGS_INFO), KVM returns the pvmfw size
that was originally discovered, leading to userspace being allowed to
boot a pVM running the zeroed pvmfw.

Instead, discard any information about pvmfw when clearing its region.

This only addresses a functional issue, NOT a security vulnerability.
This change technically modifies the uAPI, to fail ASAP.

Bug: 409966371
Fixes: f8df3e24d3 ("ANDROID: KVM: arm64: Parse reserved-memory node for pkvm guest firmware region")
Change-Id: I52aa9fc752643326d4ec482de389e1753a2697a0
Signed-off-by: Pierre-Clément Tosi <ptosi@google.com>

This commit is contained in:

Pierre-Clément Tosi

2025-04-11 13:35:30 +00:00

committed by

Treehugger Robot

parent 7a75949315

commit dcfa6ea5ab

1 changed files with 4 additions and 0 deletions

									
										arch/arm64/kvm/pkvm.c
									
		+4
		
												View File
												
				@@ -774,6 +774,10 @@ static int __init pkvm_firmware_rmem_clear(void)

					kvm_info("Clearing pKVM firmware memory\n");

					size = pvmfw_size;

					addr = memremap(pvmfw_base, size, MEMREMAP_WB);

					pvmfw_size = kvm_nvhe_sym(pvmfw_size) = 0;

					pvmfw_base = kvm_nvhe_sym(pvmfw_base) = 0;

					if (!addr)

						return -EINVAL;