From dcfa6ea5abc56833bd5785d340f60d9eef905984 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pierre-Cl=C3=A9ment=20Tosi?= Date: Fri, 11 Apr 2025 13:35:30 +0000 Subject: [PATCH] ANDROID: KVM: arm64: Unset pvmfw_{addr,size} when clearing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit During its initialization, pKVM clears the pvmfw region (pre-populated by the bootloader) if anything necessary to its isolation from the host fails to initialize, so that the host can still boot successfully, without safe support for protected VMs. However, if userspace then attempts to discover the presence of pvmfw (see KVM_CAP_ARM_PROTECTED_VM_FLAGS_INFO), KVM returns the pvmfw size that was originally discovered, leading to userspace being allowed to boot a pVM running the zeroed pvmfw. Instead, discard any information about pvmfw when clearing its region. This only addresses a functional issue, NOT a security vulnerability. This change technically modifies the uAPI, to fail ASAP. Bug: 409966371 Fixes: f8df3e24d382 ("ANDROID: KVM: arm64: Parse reserved-memory node for pkvm guest firmware region") Change-Id: I52aa9fc752643326d4ec482de389e1753a2697a0 Signed-off-by: Pierre-Clément Tosi --- arch/arm64/kvm/pkvm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c index 379a93e3a4b0..75c8a16fbf84 100644 --- a/arch/arm64/kvm/pkvm.c +++ b/arch/arm64/kvm/pkvm.c @@ -774,6 +774,10 @@ static int __init pkvm_firmware_rmem_clear(void) kvm_info("Clearing pKVM firmware memory\n"); size = pvmfw_size; addr = memremap(pvmfw_base, size, MEMREMAP_WB); + + pvmfw_size = kvm_nvhe_sym(pvmfw_size) = 0; + pvmfw_base = kvm_nvhe_sym(pvmfw_base) = 0; + if (!addr) return -EINVAL;