linux-kernel - Re: [PATCH] KVM: arm64: Fix error checking for FFA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <86y0nyqoy9.wl-maz@kernel.org>
Date: Sat, 22 Nov 2025 11:36:14 +0000
From: Marc Zyngier <maz@...nel.org>
To: "Kornel Dulęba" <korneld@...gle.com>
Cc: Oliver Upton <oupton@...nel.org>,
	Joey Gouly <joey.gouly@....com>,
	Suzuki K Poulose <suzuki.poulose@....com>,
	Zenghui Yu <yuzenghui@...wei.com>,
	Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will@...nel.org>,
	Bartlomiej Grzesik <bgrzesik@...gle.com>,
	Tomasz Nowicki <tnowicki@...gle.com>,
	Sebastian Ene <sebastianene@...gle.com>,
	linux-arm-kernel@...ts.infradead.org,
	kvmarm@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] KVM: arm64: Fix error checking for FFA_VERSION

On Fri, 14 Nov 2025 11:11:53 +0000,
"=?utf-8?q?Kornel_Dul=C4=99ba?=" <korneld@...gle.com> wrote:
> 
> According to section 13.2 of the DEN0077 FF-A specification, when
> firmware does not support the requested version, it should reply with
> FFA_RET_NOT_SUPPORTED(-1). Table 13.6 specifies the type of the error
> code as int32.
> Currently, the error checking logic compares the unsigned long return
> value it got from the SMC layer, against a "-1" literal. This fails due
> to a type mismatch: the literal is extended to 64 bits, whereas the
> register contains only 32 bits of ones(0x00000000ffffffff).
> Consequently, hyp_ffa_init misinterprets the "-1" return value as an
> invalid FF-A version. This prevents pKVM initialization on devices where
> FF-A is not supported in firmware.

Is this statement accurate? I regularly boot KVM in protected mode in
environments that really cannot be suspected of implementing FF-A
(there is no EL3 to start with). And yet I don't see any failure of
the sort.

Please clarify the circumstances this is triggered.

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.