Messages in this thread | | | Date | Tue, 18 Apr 2023 13:41:49 +0100 | From | Will Deacon <> | Subject | Re: [PATCH 03/12] KVM: arm64: Block unsafe FF-A calls from the host |
| |
On Wed, Nov 16, 2022 at 05:40:48PM +0000, Oliver Upton wrote: > On Wed, Nov 16, 2022 at 05:03:26PM +0000, Quentin Perret wrote: > > From: Will Deacon <will@kernel.org> > > > > When KVM is initialised in protected mode, we must take care to filter > > certain FFA calls from the host kernel so that the integrity of guest > > and hypervisor memory is maintained and is not made available to the > > secure world. > > > > As a first step, intercept and block all memory-related FF-A SMC calls > > from the host to EL3. This puts the framework in place for handling them > > properly. > > Shouldn't FFA_FEATURES interception actually precede this patch? At this > point in the series we're outright lying about the supported features to > the host.
FF-A is in a pretty sorry state after this patch as we block all the memory transactions, but I take your point that we should be consistent and not advertise the features that we're blocking.
I'll return FFA_RET_NOT_SUPPORTED for all FFA_FEATURES calls until the interception patch comes in later and does something smarter.
Will
| |