Re: [PATCH v4 5/7] KVM: arm64: Support FFA_NOTIFICATION_SET in host handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The MBZ (Must Be Zero) check for the `flags` parameter (W2) in `do_ffa_notif_set` uses an incorrect mask, leaving bits [31:16] completely unvalidated.
--

commit 18c05e4ad6759f3bb72be1916c4e1abac54bcb30
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Support FFA_NOTIFICATION_SET in host handler

This commit adds support for proxying FF-A notification SET messages from the
pKVM hypervisor to TrustZone. It introduces validation to enforce MBZ and SBZ
fields before forwarding the call.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index adf8680f32663..fdf1e5fb67267 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c

[ ... ]

> @@ -975,6 +975,32 @@ static void do_ffa_notif_unbind(struct arm_smccc_1_2_regs *res,
>  	hyp_smccc_1_2_smc(args, res);
>  }
>  
> +static void do_ffa_notif_set(struct arm_smccc_1_2_regs *res,
> +			     struct kvm_cpu_context *ctxt)
> +{
> +	DECLARE_REG(u32, endp_id, ctxt, 1);
> +	DECLARE_REG(u32, flags, ctxt, 2);
> +	struct arm_smccc_1_2_regs *args;
> +
> +	if (FIELD_GET(FFA_NOTIF_SENDER_ENDP_MASK, endp_id) != HOST_FFA_ID) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +
> +	if (ffa_check_unused_args_sbz(ctxt, 5)) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +
> +	if (flags & GENMASK(15, 2)) {
[Severity: Medium]
Does this mask properly validate all reserved bits?

The FF-A specification dictates that for the FFA_NOTIFICATION_SET interface,
bits 31 through 2 of the flags parameter passed in W2 are reserved and must
be zero. By using GENMASK(15, 2), the upper 16 bits of the 32-bit flags
variable are completely ignored.

Can this allow a malicious or buggy host to pass non-zero upper bits that
silently bypass validation and get proxied to EL3?

> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +
> +	args = (void *)&ctxt->regs.regs[0];
> +	hyp_smccc_1_2_smc(args, res);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616154149.2763214-1-sebastianene@google.com?part=5