Re: [PATCH v5 4/7] KVM: arm64: Support FFA_NOTIFICATION_UNBIND in host handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] FFA_NOTIFICATION_UNBIND incorrectly treats the Notification ID bitmap parameter (W2) as a reserved field and requires it to be 0, preventing the host from unbinding notifications and causing a firmware resource leak.
--

commit 33f494c35955148d0babe5e028baf1876db19208
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Support FFA_NOTIFICATION_UNBIND in host handler

This commit adds support for the FFA_NOTIFICATION_UNBIND interface in the
host handler, verifying arguments before forwarding the message to TrustZone.

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
[ ... ]
> @@ -957,6 +956,27 @@ static void do_ffa_notif_bind(struct arm_smccc_1_2_regs *res,
>  	hyp_smccc_1_2_smc(args, res);
>  }
>  
> +static void do_ffa_notif_unbind(struct arm_smccc_1_2_regs *res,
> +				struct kvm_cpu_context *ctxt)
> +{
> +	DECLARE_REG(u32, endp_id, ctxt, 1);
> +	DECLARE_REG(u32, reserved, ctxt, 2);
> +	struct arm_smccc_1_2_regs *args;
> +
> +	if (ffa_check_unused_args_sbz(ctxt, 5) || reserved) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}

[Severity: High]
Does this reject valid unbind requests by forcing W2 to be zero?

It looks like W2 is extracted as reserved and required to be 0 here. However,
the FF-A specification uses W2 to pass the Notification ID bitmap for the
FFA_NOTIFICATION_UNBIND call.

If the host attempts to unbind a notification with a non-zero bitmap, this
check will reject the call with FFA_RET_INVALID_PARAMETERS. Could this
prevent the host from successfully unbinding notifications, potentially
causing a notification tracking resource leak in the secure monitor over time?

> +
> +	if (FIELD_GET(FFA_NOTIF_RECEIVER_ENDP_MASK, endp_id) != HOST_FFA_ID) {
> +		ffa_to_smccc_res(res, FFA_RET_INVALID_PARAMETERS);
> +		return;
> +	}
> +
> +	args = (void *)&ctxt->regs.regs[0];
> +	hyp_smccc_1_2_smc(args, res);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623115354.632361-1-sebastianene@google.com?part=4